Data Retention Policy

Effective Date: July 31, 2026

This Data Retention Policy describes how long MedSystum ("Company," "we," "us," or "our") retains the categories of data processed through MedSystum (the "Service"), and how that data is returned or destroyed. It supplements our Privacy Policy and any Business Associate Agreement ("BAA") between us. Where a BAA conflicts with this Policy, the BAA controls for Protected Health Information ("PHI").

Note: This is a placeholder policy provided for the initial release of the marketing website and does not constitute legal advice. Specific retention periods will be confirmed with counsel and reflected in your contract and BAA before general availability.

Section 1 — Principles

We retain data only for as long as necessary to provide the Service, to meet our legal and contractual obligations, and to support legitimate business needs such as security and audit. We apply the minimum-necessary principle to PHI throughout its lifecycle.

Section 2 — Retention Periods by Category

• Remittance Data and PHI. The 835/ERA files and related claim, payment, and adjustment records you submit are retained only as long as needed to provide the Service and as permitted by the applicable BAA. On termination, PHI is returned or securely destroyed within thirty (30) days, unless a longer period is required by law.
• Free-audit submissions. Data provided for a free retrospective audit is retained for the duration of the audit and up to thirty (30) days after your Recovery Report is delivered, then deleted unless you engage the Service or request earlier deletion.
• Recovery Reports and derived findings. Reports and the findings computed from your data are retained for the term of your engagement and are available for export on request; they are deleted following termination on the schedule above.
• AI-generated content. Explanations and draft appeal letters you generate are stored as part of your Recovery Report. The underlying prompts and responses are not retained by our AI subprocessors beyond what is needed to return a result (see our Responsible AI page).
• Account and contact information. Names, work emails, and organization details are retained while your account is active and for up to twelve (12) months after closure, unless a longer period is required by law.
• Security and audit logs. Logs, including records of access to PHI, are retained for up to twelve (12) months to support security review and compliance.
• Backups. Data in encrypted backups is retained on a rolling basis and purged within ninety (90) days. Deleted records may persist in backups until the backup rotation completes.

Section 3 — Return and Destruction on Termination

On termination of the Service, and in accordance with the applicable BAA, we will return or securely destroy PHI in our possession, and certify destruction on request, except where retention is required by law. Secure destruction renders data unreadable and unrecoverable.

Section 4 — Your Choices

You may request export or deletion of your data at any time by contacting us. We will honor verified requests subject to our legal obligations and the terms of any BAA. Requests involving PHI are handled through the covered entity or its authorized representative.

Section 5 — Legal Holds and Exceptions

We may retain data beyond the periods described above where required to comply with legal obligations, resolve disputes, enforce our agreements, or preserve information subject to a legal hold. Such data is retained only for as long as the obligation or hold requires.

Section 6 — Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by updating the effective date above and, where appropriate, by notice to customers.

Section 7 — Contact

Questions about this Policy may be directed to hello@medsystum.com.