How many years must your clinic keep a patient record?
"Delete my data" and "keep this record for ten years" arrive from two different authorities, and both bind you. This guide puts the mandatory period for every country we serve in one table, explains which obligation wins and when, and shows how to answer a patient who asks for erasure before the clock runs out.
Two requests can land on a practice manager's desk in the same week: a patient asking for their data to be deleted in full, and an inspector asking for the file of a visit that happened seven years ago. Both are legitimate, both are binding, and they cannot both be honoured. What separates a clinic that knows what to do from one that improvises is a single number: the mandatory retention period in its own country.
This guide collects that number for every country we serve, and explains the case where the duty to keep outranks the right to erase — the most common situation and the least understood.
The mandatory period, country by country
Check what the clock runs from, because it is missed constantly. Counted from each visit, a patient seen in 2016 who returned in 2024 has two records with two different expiry dates. The UAE law instead counts its twenty-five years from the patient's last procedure, so the whole file stays for as long as they keep coming back. Check how your own country's rule is counted.
| Country | Minimum | Note |
|---|---|---|
| Saudi Arabia | 10 years | Dental records included |
| UAE | 25 years | Every record, from the patient's last procedure — the longest in the region |
| Egypt | 15 years | Longest after the UAE |
| Kuwait, Qatar, Bahrain | 10 years | Confirm with your ministry |
| Jordan, Oman, Lebanon | 10 years | Confirm with your ministry |
| Morocco, Tunisia, Iraq | 10 years | Confirm with your ministry |
| Libya, Yemen | 10 years | No explicit rule; the default applies |
The UAE is the exception that catches people
Twenty-five years for every health record, not ten, counted from the patient's last procedure under Federal Law No. 2 of 2019. A Dubai clinic that deleted a twelve-year-old record on the ten-year rule common elsewhere in the region is in breach, and the mistake surfaces only on the day the file is asked for. If your system does not know your country, it cannot protect you from this.
When retention beats the right to erasure
Data protection laws across the region — Saudi PDPL among them — give a person the right to request erasure of their data. In the UAE, health data is governed largely by its own health-data law rather than the general data-protection law, so check which one applies to the request. Wherever the right exists, it is qualified by other legal obligations: where the law requires you to keep a record, keeping it wins, and refusing is compliance with a higher rule rather than a breach of a lower one.
That does not mean the request is ignored. A correct answer has three parts: what cannot be deleted, why, and when it becomes deletable. The third part is usually what satisfies the patient — a specific date beats "we can't".
- Separate the medical record from everything else. The visit note, the diagnosis and the prescription sit inside the mandatory period; marketing preferences and contact details not needed for the record do not, and are deleted on request immediately.
- Work out the expiry the way your rule counts it — from each visit, or from the patient's last procedure as in the UAE — rather than from today.
- Log the partial refusal and its reason in the audit trail. A request refused with nothing written down is the one that is hard to defend later.
- Tell the patient the date their record becomes deletable, and what was in fact deleted today.
What happens when you close, or change systems
Ending a subscription with a software vendor does not end your obligation to the health ministry. A record that must be kept for ten years must be kept for ten years whether you stay on the system or leave it — which makes one question decisive before you subscribe to anything: can I get all of my data out, in a format I can still read years later, with no fee and no request?
If the answer is no, you are not buying software, you are pledging your archive. Read the guide to migrating between systems before you sign, not after.
What we do about it
In 3yadtk, medical records and patient documents cannot be deleted in the app, and each is protected for at least your country's minimum — counted from each visit or upload, with imaging kept for 25 years — and nothing is deleted automatically when that period ends. We keep a clinic's data while its account exists, including after access ends, so it can return or take its data; we delete it when the clinic asks in writing, within 90 days of the request, except what the law requires us to keep. Exports of the main records — patients, appointments, visit notes, prescriptions, invoices and more — are available as CSV or Excel at any time, with no request and no fee.
Three mistakes that keep recurring
- Assuming one way of counting. Some rules run from each visit, the UAE's from the patient's last procedure; the wrong one deletes too early or keeps too long.
- Relying on the backup alone. A backup you cannot quickly restore a single record from is disaster insurance, not an archive.
- Deleting attachments but not the record. X-rays, photographs and reports are part of the medical file; their size does not change what they are.
The periods above are the ones the system enforces, based on each country's health ministry rules as we understand them. Circulars are amended and sub-specialties can carry extra requirements, so check with your own regulator before you build an irreversible decision on them — we are a data processor, not your counsel.
A record nobody can erase ahead of its time
3yadtk knows the mandatory period for your country and protects every medical record and document from deletion for at least that long, and its activity log — which cannot be edited or deleted — shows who opened and changed what. Its Data protection page records patients' requests to see, correct or delete their data, with the date each answer is due and what the patient was told when it closed.
Start the 7-day free trial