Data Ownership & Retention

Part of the Anaya Care Handbook — the source of truth for how the product must behave. When the product needs to change, change this document first, then make the system match it.

Implementation status — this module is specified but not yet built. Every rule below is 🚧 Spec only until the feature ships and this page is audited against the code. Legend: ✅ In code · ⚠️ Partial · 🚧 Spec only (not yet built).

What this covers

This page settles who owns the data we hold about a client and how long we keep it. It names the client as the data subject who owns the data with full rights; the responsible party as the data steward who acts on the client's behalf and is the gatekeeper from whom all access flows; the subscribing company as a processor with no ownership; and Anaya as a custodian with no ownership. It grants institutional subscribers and healthcare providers read-only, authorised access only; and it fixes the retention clock — the care relationship plus at least seven years, or longer where state law demands — after which deleted data must be purged from every system, backups included. It also lets a subscriber request a full data export before its subscription ends.

Key terms

• Data subject — the client, who owns their own data with full rights.
• Data steward — the responsible party, who acts on the client's behalf and is the gatekeeper of the client's data: they grant and revoke access, and all access flows from their authorisation outward.
• Data processor — the subscribing company that records and acts on the data to deliver care, but never owns it.
• Data custodian — Anaya, which stores and safeguards the data on the platform, but never owns it.
• Institutional subscriber — a Tier 4 subscriber (insurance, IHSS, hospital) granted read-only, authorised access to a client's data, never write access or ownership.
• Authorised viewer — an institutional subscriber or a healthcare provider granted read-only access to a client's data — specific, authorised, and (for healthcare providers) for care coordination only.
• Retention period — the duration of the care relationship plus a minimum of seven years, or the period required by applicable state law — whichever is longer.
• Purge — the permanent, irreversible removal of data from every system, primary stores and backups alike, once the retention period has expired.
• Data export — a full copy of a subscriber's data the subscriber may request before its subscription is terminated.

How it works

Every record about a client has a clear chain of responsibility. The client is the data subject — the owner of their own data, with full rights over it. Their responsible party is the data steward: they act on the client's behalf, grant and revoke access, and serve as the gatekeeper from whom all access flows outward. The subscribing company processes that data to deliver care, and Anaya holds it on the platform, but neither owns it. Institutional subscribers who pay into a client's care — insurance, IHSS, a hospital — and healthcare providers involved in coordinating that care get read-only access, and only when it has been authorised; healthcare-provider access is for care coordination only. None of them can write to or take ownership of the record. This mirrors the platform principle that all data belongs to exactly one business (see Clients).

Retention runs on a single clock. While the care relationship is active the data is kept; when the relationship ends, a countdown of at least seven years begins — or longer if the client's state sets a longer minimum, in which case the longer period wins. Only once that period expires is the data purged, and the purge must reach everywhere the data lives, including the geographically separate backups. Backups are never kept beyond the schedule that governs the primary copy. Before a subscriber's subscription is terminated, the subscriber may request a full export of its data.

Rules

1. DATA-1 — The client, or their responsible party, is the owner and gatekeeper of the client's data. Sharing or releasing that data must rest on the owner's authorisation. (🚧 Spec only)
2. DATA-2 — The subscribing company is a data processor only: it may record and act on a client's data to deliver care but never holds ownership of it. (🚧 Spec only)
3. DATA-3 — Anaya is a data custodian only: it stores and safeguards the data but never holds ownership of it. (🚧 Spec only)
4. DATA-4 — Institutional subscribers (insurance, IHSS, hospitals) must be granted read-only access, and only where that access has been authorised. The system must never give them write access or ownership. (🚧 Spec only)
5. DATA-5 — Client data must be retained for the duration of the care relationship plus a minimum of seven years, or the period required by applicable state law — whichever is longer. (🚧 Spec only)
6. DATA-6 — Once the retention period for a client's data has expired, that data must be purged from all systems. (🚧 Spec only)
7. DATA-7 — Backup data must follow the same retention schedule as the primary data it copies, and must be purged on the same clock. (🚧 Spec only)
8. DATA-8 — The client is the data subject and owns their own data with full rights over it. (🚧 Spec only)
9. DATA-9 — The responsible party is the data steward and the gatekeeper of the client's data: they act on the client's behalf and grant and revoke access, and all access to the data must flow from their authorisation. (🚧 Spec only)
10. DATA-10 — Healthcare providers may be granted read-only access to a client's data for care coordination only, and only where that access has been authorised. The system must never give them write access or ownership. (🚧 Spec only)
11. DATA-11 — Before a subscriber's subscription is terminated, the subscriber must be able to request a full export of its data. (🚧 Spec only)

Who can do what

The ownership chain assigns each party a fixed standing, independent of the per-feature role permissions.

Decisions needed

• What is the legal floor when state law is silent or unclear? The rule keeps data for at least seven years or the state minimum, whichever is longer. Options: treat seven years as the universal default whenever a state sets no clear minimum; require legal sign-off per state before any purge runs; hold purges until a state's retention period has been confirmed in writing.
• Does the owner's gatekeeping include a right to early deletion? The retention floor and the owner's gatekeeping role can collide if an owner asks to delete data before seven years have passed. Options: honour deletion requests but keep a legally required minimum in cold storage until the clock expires; refuse early deletion and keep all data until the retention period ends; case-by-case with legal review. This depends on the deletion / data-retention-policy decision still open on Clients.
• Who confirms authorisation for read-only viewer access, and how is it recorded? This now covers both institutional subscribers (DATA-4) and healthcare providers (DATA-10). Options: the responsible party (data steward) authorises each viewer explicitly per client; the subscribing company grants access on the steward's behalf with a logged authorisation; access is scoped by a signed data-sharing agreement at the institutional level. Settle whether healthcare-provider authorisation follows the same path as institutional authorisation or has its own.
• What does a subscriber data export contain, and who may request it? DATA-11 lets a subscriber request a full export before termination but does not fix its scope or format. Options: a machine-readable export of all the subscriber's records; a human-readable report bundle; both. Settle who within the subscriber may trigger the export (Owner/Admin only, or any management role) and whether the export is gated on responsible-party (data steward) authorisation per client.
• How is the purge proven complete? Options: require a verifiable purge certificate or audit-trail entry per client; rely on the backup expiry schedule alone; both, with a reconciliation check.