Data retention & deletion

Quillentra handles protected health information (PHI) on behalf of the clinicians and practices who use it. In the United States we act as their business associate under HIPAA; in Canada we act as their service provider under PIPEDA and provincial health-privacy laws. The practice remains in control of its records: we process them only to provide the service, and we keep them only as long as this page describes.

• We collect only what is needed to draft and store your documentation.
• We never sell your data, use it for advertising, or use it to train AI models.
• Every vendor that can access PHI has signed a Business Associate Agreement with us.
• Audio is temporary by default. Your notes stay until you delete them.

Scheduled deletions run every 15 minutes. Quillentra doesn't delete your notes on a timer, because how long a medical record must be kept is set by your practice and the laws that apply to it. Copy or export each signed note into your EHR or record system of record.

• Before recording, the clinician confirms that the patient has been informed and has consented. That confirmation is logged.
• Audio is uploaded in short segments while you record, over TLS 1.2 or higher. It is never stored in the browser.
• Segments are stored encrypted (AES-256 with keys held in AWS Key Management Service), joined into one recording, and sent to our transcription provider.
• The transcription provider's output files and job records are deleted as soon as we have the transcript.
• The recording itself is deleted once the note is written, unless your practice has chosen 7- or 30-day retention.

Visits

A deleted visit moves to the trash, where it can be restored for 3 days (or the window your practice set). After that, its recording, transcript, documents and version history are permanently purged. You can also choose Delete forever from the trash. If your practice turns the trash off, deletion is immediate.

Documents, patients and conversations

Deleting a document removes it along with its version history and AI edit conversation. Deleting a patient removes their record; their visits remain, without the patient attached. You can delete an assistant conversation at any time.

When someone leaves a practice

Visits, documents and patients are part of the practice's records, so they stay with the practice when the person who created them is removed, leaves or deletes their account. Owners and admins see them under Former members in Settings → Organization → Members and can reassign them to an active member. Until then, with the shared workspace off, no one else can open them. Signed documents always keep their original signer. Personal assistant conversations aren't practice records: they're never reassigned.

Your account

You can delete your account in Settings → Data & privacy by typing DELETE to confirm. If you've added a password, you enter it too; otherwise, deletion must happen within 10 minutes of signing in, so we know it's really you. Your account is deactivated and signed out everywhere right away, and a background job finishes the deletion, normally within minutes:

• Your sign-in methods, sessions, preferences and personal assistant conversations are deleted, and you can never sign in to the account again. You can sign up again later with the same email address.
• In a practice that has other members, the visits, documents, patients and templates you created stay with the practice, with your name and credentials kept on them for attribution. The practice and its plan continue without you, and the plan's seat count updates automatically.
• If you're the only member of a practice, the practice and all of its data are deleted too, and a paid plan is canceled immediately.
• If you're the only owner of a practice that has other members, make someone else an owner (or delete the practice) before deleting your account.

Export anything you need first: the same page offers a full export of your data. Step-by-step instructions are in Delete your account.

Your practice

Owners and admins can delete the whole practice in Settings → Organization → General, after typing the practice's name and confirming it's them. Everyone loses access at once, pending invitations are canceled, a paid plan is canceled with no further charges, and every member is emailed. For the next 30 days an owner can restore the practice exactly as it was (on the Free plan). After that, its visits, documents, transcripts, patients, templates and recordings are permanently deleted. Step-by-step instructions are in Delete or restore a practice.

We keep three kinds of record after deletion, none of which contains clinical content. The first is the audit trail, which HIPAA requires us to retain. The second is usage counts (minutes recorded, with no patient information), which we keep for billing and accounting. The third is the record of the practice's acceptance of our Terms and Business Associate Agreement.

Backups

Deleted data can remain in our encrypted backups until they expire, at most 35 days later. Backups are used only to recover from a failure. If we ever restore one, we re-apply every deletion made after the backup was taken.

• Encryption. Data is encrypted with TLS 1.2+ in transit and AES-256 at rest. Patient details, transcripts, documents and assistant conversations are encrypted a second time at the field level, with AES-256-GCM.
• Passwordless sign-in. Users sign in with a single-use code emailed to them (it expires after 10 minutes, with limited attempts), or with Google or Apple. Anyone who adds an optional password must also use an authenticator app for password sign-ins.
• Automatic sign-out. You are signed out after 15 minutes of inactivity, and every session ends after at most 12 hours.
• Tamper-evident audit trail. Sign-ins, views, edits, copies and exports are recorded in a hash-chained, append-only log, and its integrity is verified daily.
• Isolation and least privilege. Each practice's data is kept separate. Visits are private to the clinician unless the practice turns on a shared workspace. Administrators have only the access their role requires.
• No PHI in email or logs. Our emails contain only links back into the app. Our operational logs contain identifiers only.

Quillentra uses Claude models to draft notes, apply edits you ask for, and answer questions in Ask Quillentra. The AI provider processes content only to return a result to us, under a Business Associate Agreement. We do not use your data to train AI models, and our providers do not use it to train theirs. Style learning only adjusts your own account, and you can review, edit or turn it off at any time.

HIPAA

Every customer is covered by our Business Associate Agreement, accepted when the practice is created. The safeguards above implement the HIPAA Security Rule's administrative, physical and technical requirements, and we follow a documented incident-response and breach-notification procedure.

PIPEDA and Canadian health-privacy laws

See PIPEDA Compliance for how we meet the ten fair information principles, and what Canadian clinics should know about data residency.

SOC 2

We are aligning our controls with the AICPA SOC 2 Trust Services Criteria. We have not yet completed a SOC 2 examination, and we will update this page when a report is available.

These are the companies that process customer data on our behalf. Each one that can access PHI is bound by a Business Associate Agreement. Our payment processor receives only billing information for paid plans, never patient information.

Customer data is stored in the United States (Amazon Web Services, us-east-1). We will update this list before a new subprocessor begins processing PHI. To be told about changes, email privacy@quillentra.com.

For questions about retention or compliance, or to request our security documentation, email privacy@quillentra.com. To report a security vulnerability, email security@quillentra.com.