Public Retention Schedule

Our approach

Retention periods vary by information type and applicable law. We retain information only as long as reasonably necessary to provide services and meet legal, professional, regulatory, tax, accounting, warranty, security, and dispute-resolution requirements. Where obligations differ by Canadian jurisdiction, we retain records for the longer applicable period where required.

General retention periods

• Clinical records, consultations, prescriptions, and home sleep test reports: in accordance with applicable provincial health-record legislation and professional requirements.
• PAP therapy records and adherence information: as long as reasonably necessary to provide care, support therapy, and meet legal or regulatory obligations.
• Orders, invoices and receipts, subscription records if a future subscription service is offered, warranties, and payment transaction records: seven years after the last transaction. This applies even if you close your customer account. Subscriptions are not available at launch.
• Price-estimate details (name, email, phone): kept only in a temporary browser cookie to print on the estimate, cleared when you close your browser or place an order; we do not keep a copy.
• Checkout links sent by clinicians: contain product numbers only; no personal information is stored.
• Klarna, Stripe and PayPal payment records: held by those providers under their own retention rules; we keep the payment confirmation with your order.
• Customer account information: until account closure, plus two years unless a longer period is required.
• Marketing-consent records: while consent remains active, and generally three years after withdrawal or expiry where needed to demonstrate compliance.
• Website analytics: aggregated where practical; identifiable analytics generally 26 months or less, subject to platform configuration.
• Security and audit logs: generally 12 months unless longer retention is needed for an investigation or legal obligation.
• Privacy complaints and access requests: seven years after resolution.
• Privacy breach records: at least 24 months after we learn of the breach, as federal regulations require.
• Backup data: overwritten according to established backup-retention schedules.

Secure disposal and questions

When information is no longer required, we securely destroy, delete, or permanently de-identify it using methods appropriate to its sensitivity. Residual copies may remain temporarily in encrypted backup systems until securely overwritten or retired.

For questions, contact privacy@virtualsleepcare.ca. Read our Privacy Policy and Trust Centre.