Patient data export & deletion (Articles 15 & 17)

UK GDPR Articles 15 (right of access) and 17 (right to erasure) are both built into the platform.

Article 15 — Patient data export

Every patient can download a copy of all the data we hold on them, in a structured JSON file.

How a patient requests their data

1. Sign into the portal
2. Open Account → Privacy
3. Click Download my data
4. The export-patient-data Edge Function:
   • Reads every row referencing the patient
   • Generates a JSON file with patient profile, requirements, uploads metadata, cases, prescriptions, orders, comms log, consent records, audit log entries about them
   • Returns a signed download URL
5. Patient downloads — the export is available for 24 hours

What's in the export

• Their patients row (everything they entered)
• Every patient_requirements item + verification status
• Every prescription_requests (cases) row + status
• Every prescriptions row + drug / dose / frequency
• Every orders row + dispatch / tracking
• Every consent_records row + wording snapshots
• Every documents row (metadata + signed URL for download)
• Every patient_measurements row
• Every comm_events row sent to them
• Every audit_logs row with their patient ID as subject

What's NOT in the export

• Clinician notes that are flagged confidential (rare; only applies to safeguarding contexts)
• Server logs and observability data (held separately)
• Internal Stripe / Royal Mail data (held by those processors; patient should request directly from them under their DPAs)

Article 17 — Deletion / Right to be forgotten

A patient can request deletion of their data from the portal.

How a patient requests deletion

1. Sign in → Account → Privacy → Delete my data
2. They must confirm by typing their email
3. A patient_deletion_requests row is created with status pending

What happens next

A clinic manager reviews the request (some requests must be denied for legal reasons — see below) and either:

• Approves — patient data is anonymised in-place (their case record stays for clinical audit, but PII is overwritten with Anonymised Patient <id>)
• Refuses — with a written reason. The patient is notified.

The anonymisation uses the same primitives as anonymise_tenant (see tenant anonymise) but per-patient.

When can a request be refused?

UK GDPR Article 17 has exceptions. Common ones for clinical data:

• Ongoing clinical care — if the patient has an active prescription, deletion would harm continuity of care
• Legal obligation — UK clinical records retention is typically 10 years for adults
• Public health — adverse-event reports must be kept

The manager writes the refusal reason; the patient sees it + can escalate to the ICO. Both decision and reason are audited.

Self-service vs admin

• Patient triggers — request is created from their portal
• Manager triggers — anonymise an existing patient outside a self-service request (same SQL primitive)
• Platform admin triggers — anonymise_tenant() for an entire clinic