How many years must your clinic keep a patient record?
"Delete my data" and "keep this record for ten years" arrive from two different authorities, and both bind you. This guide puts the mandatory period for every country we serve in one table, explains which obligation wins and when, and shows how to answer a patient who asks for erasure before the clock runs out.
Two requests can land on a practice manager's desk in the same week: a patient asking for their data to be deleted in full, and an inspector asking for the file of a visit that happened seven years ago. Both are legitimate, both are binding, and they cannot both be honoured. What separates a clinic that knows what to do from one that improvises is a single number: the mandatory retention period in its own country.
This guide collects that number for every country we serve, and explains the case where the duty to keep outranks the right to erase — the most common situation and the least understood.
The mandatory period, country by country
The clock runs from the date of the visit, not from the patient's most recent visit — a distinction that is missed constantly. A patient seen in 2016 who returned in 2024 has two records with two different expiry dates, not one record.
| Country | Minimum | Note |
|---|---|---|
| Saudi Arabia | 10 years | Dental records included |
| UAE | 10 years — 25 for dental | The longest in the region |
| Egypt | 15 years | Longest after UAE dental |
| Kuwait, Qatar, Bahrain | 10 years | — |
| Jordan, Oman, Lebanon | 10 years | — |
| Morocco, Tunisia, Iraq | 10 years | — |
| Libya, Yemen | 10 years | No explicit rule; the default applies |
UAE dental is the exception that catches people
Twenty-five years, not ten. A Dubai dental clinic that deleted a twelve-year-old record on the general rule is in breach, and the mistake surfaces only on the day the file is asked for. If your system does not know your specialty, it cannot protect you from this.
When retention beats the right to erasure
Data protection laws across the region — Saudi PDPL and the UAE federal law among them — give a person the right to request erasure of their data. In every one of them that right is qualified by other legal obligations: where the law requires you to keep a record, keeping it wins, and refusing is compliance with a higher rule rather than a breach of a lower one.
That does not mean the request is ignored. A correct answer has three parts: what cannot be deleted, why, and when it becomes deletable. The third part is usually what satisfies the patient — a specific date beats "we can't".
- Separate the medical record from everything else. The visit note, the diagnosis and the prescription sit inside the mandatory period; marketing preferences and contact details not needed for the record do not, and are deleted on request immediately.
- Work out the expiry per record, from the visit date rather than from today.
- Log the partial refusal and its reason in the audit trail. A request refused with nothing written down is the one that is hard to defend later.
- Tell the patient the date their record becomes deletable, and what was in fact deleted today.
What happens when you close, or change systems
Ending a subscription with a software vendor does not end your obligation to the health ministry. A record that must be kept for ten years must be kept for ten years whether you stay on the system or leave it — which makes one question decisive before you subscribe to anything: can I get all of my data out, in a format I can still read years later, with no fee and no request?
If the answer is no, you are not buying software, you are pledging your archive. Read the guide to migrating between systems before you sign, not after.
What we do about it
3yadtk holds the retention table for every country and specialty inside the system and checks it before any erasure request is executed. On account termination, data is securely deleted within 90 days unless it sits inside a mandatory period. Full export as CSV or Excel is available from inside the system at any time, with no request and no fee.
Three mistakes that keep recurring
- Counting from the last visit. Every visit is its own record with its own expiry date.
- Relying on the backup alone. A backup you cannot quickly restore a single record from is disaster insurance, not an archive.
- Deleting attachments but not the record. X-rays, photographs and reports are part of the medical file; their size does not change what they are.
The periods above are the ones the system enforces, drawn from each country's health ministry rules. Circulars are amended and sub-specialties can carry extra requirements, so check with your own regulator before you build an irreversible decision on them — we are a data processor, not your counsel.
A record nobody can erase ahead of its time
3yadtk knows the mandatory period for your country and your specialty, checks it before any deletion, and writes every request and every refusal to an audit log the database will not allow anyone to delete.
Start the 30-day free trial