Data retention and deletion policy
Effective 18 October 2026 · Version 1.0
1. What we keep, and why
We keep only what a practice needs to talk to its clients and run its appointments: names, contact details, handles, messages and their attachments, appointment details, and, if the practice uses them, clinical notes. We do not collect more than that, do not sell it, do not use it for advertising, do not combine it with other sources, and do not use it to train AI models. The practice decides what to do with its clients' information; we hold it on the practice's behalf.
2. How long
| Messages, contacts, appointments | While the practice uses Switchboard, or until a person's data is erased. Removed within 30 days after the practice stops using the service, unless it asks us to keep it longer or to hand it over first. |
| Clinical notes | Held for the practice, which is responsible for how long its treatment records must be kept. Deleted when the practice deletes them, or on its instruction. Because they may have to be kept by law, erasing a person's data asks for a separate confirmation before their notes go. |
| Staff accounts | While the person has access. A switched-off account keeps the person's name and email so past messages and notes keep their author; it is removed on request when no legal or record-keeping reason prevents it. |
| Connection keys and tokens | Until the practice disconnects the service, at which point they are deleted from Switchboard. |
| Activity record | For as long as the installation exists; deleted with it. It holds identifiers, times, IP addresses and counts, not message text. |
| Server access logs | A short rotation: the most recent days only. |
| Raw copies of incoming messages | The server keeps a copy of each incoming message as it arrived, only so a message is never lost if it can't be read the first time. These copies are deleted automatically after 30 days, and removed at once when the person is erased. |
| Backups | 14 days, encrypted, then deleted. |
3. Requests from a person
Anyone whose information a practice holds in Switchboard can ask for a copy, a correction or deletion, either from the practice or from us at support@theswitchboardinbox.com (see also Deleting your data). We confirm that the request is genuine before acting, to protect the person, and answer within 45 days; most are done within a week. A person can also stop a practice's automatic messages by telling the practice, which then adds them to its do-not-contact list.
4. How deletion works
- Copy. The practice owner can download everything held about one person (contact record, messages, appointments, and a note of how many clinical notes exist) as a file from inside the app.
- Erase. The practice owner can permanently erase one person: their contact record, their conversations and every message and attachment in them, the raw copies the server holds of their incoming messages, and their appointments. The action needs an explicit confirmation, cannot be undone, and is written to the activity record with identifiers and counts only.
- Opt-outs are kept. If the person had asked not to be contacted, we keep only their phone number on a suppression list so they are not messaged again. They can ask us to remove that too.
- Other systems. Switchboard cannot delete information held by other services the practice uses, such as its booking calendar, or on its own phone and email. We tell the person which to contact.
5. Messaging platforms
Messages that arrive through Facebook Messenger, Instagram or TikTok are handled like any other message. If a practice disconnects an account, we delete the stored access tokens immediately and stop receiving new messages; the messages already received stay in the practice's inbox until erased. If a person removes Switchboard's access from their own account on a platform, or asks the platform or us to delete their data, we erase what we hold about them on request as above. If a platform tells us that a person has deleted their account or withdrawn permission, we delete the data we hold for them from that platform.
6. When a practice stops using Switchboard
On request we hand the practice an export of its data. We then delete the practice's database and its stored keys and tokens within 30 days and confirm in writing. Copies remain only in encrypted backups, which are deleted within a further 14 days.
7. Backups
Information erased from the live system remains in encrypted nightly backups until they age out after 14 days. If a backup is ever restored, anything erased since it was made is erased again before the service resumes.
8. Where the law says to keep something
We may keep information we are legally required to keep, such as tax records or information needed for a legal claim, and will tell the person what and why. A practice may have its own duties to keep treatment or business records; those are the practice's to manage, and we will not delete clinical notes without the practice's confirmation.