Skip to main content

Consent, access logging and erasure

The platform holds special-category health data. What an integrator needs to know about how it is protected and let go.

  • No health data is stored for a participant until they consent (consentGivenAt on their user). Until then the writes of their readings, responses and journeys are refused with consent_required.
  • Consent is recorded, withdrawn (consentWithdrawnAt) and restored as a change to the user, by the participant themselves or an admin, and each change is written to the audit trail. A participant who declines at the first prompt is recorded as declining and signed out.
  • Reading another person's records needs their consent to stand. Staff who can reach every participant in their tenant still can't read one who has withdrawn.
  • A participant with no consent has nothing due from their journeys.

Access logging​

Every read of, and change to, a participant's health information, every journey run, and every sign-in, sign-out and revocation is written to an append-only audit trail (access_log), naming the person or API key that did it. The trail is never updated or deleted, and isn't exposed by the API. Logs elsewhere carry ids and types only, never health values, names, emails or tokens.

Data export​

getUserDataExport returns everything the platform holds about one person, for them or an admin answering a request.

Erasure​

Deleting erases, and the erasure reaches every system that held the person:

  • Deleting an identity removes the person and every user of theirs in every tenant (a platform admin's act; a person can also delete their own).
  • Deleting a user who has no other membership, and deleting a tenant (for the people only it held), erase the same way.
  • In the same transaction, their account at the identity provider and their files in object storage are queued for erasure, and background jobs finish both, retrying until done.
  • A users.deleted webhook is the signal for an integrator to erase its own copy; any other queued event about that person is dropped.

Where retention is switched on for a deployment, readings older than 365 days are purged, sparing current participants.