Healthcare
Medical records run on two clocks, and only one of them is yours: retention law keeps the clinical file for years or decades whatever you ask. Around it, what you looked up can become an advertising interest, and a deletion request usually comes back half done.
The read at a glance
This is the record of your health, and your doctor is not the only one holding it.
A leak reveals your conditions, medications, and mental health. Those facts cannot be changed once exposed.
Medical-records law holds clinical files for years to decades; an app is bound only by what its own policy says.
A clinic or pharmacy verifies who you are; a wellness app often asks for nothing.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
If it leaks
A diagnosis does not expire and cannot be reissued. Leaked, it reaches employers, insurers and family in a form you cannot deny, and the tracking cases show this data escaping without any breach at all.
What repeats in the policies
Health data is not one thing here
At a surgery, an online doctor or a pharmacy, the consultation and what was dispensed sit in a medical record that they say stays confidential. Everything around it, your device, the pages you opened and the identifiers that follow you, lives under the ordinary commercial policy. Apps holding the same kind of body data promise that protection only where the medical-privacy law reaches them, and where it does not, a mood log or a cycle log is ordinary company data.
What you looked up becomes a shopping interest
The identifiers from your visit can move to ad networks and analytics vendors. Accept the advertising cookies and the pages you opened travel with them, so the condition you looked up becomes an advertising signal rather than a medical fact. Where an employer pays for the app, the policy can hand them your name and when you last used it, and one large online pharmacy reserves your details for marketing on behalf of other organisations entirely.
Two clocks, and only one of them is yours
How long the everyday data stays is their claim, and most name no end, only as long as necessary; where a number appears it runs to years after your last sign-in. The medical record has a separate clock set by law, reaching ten years after death for a GP record in the UK, so closing the account can clear the sign-up data within months while the record stays. Outside those rules an app has only the first clock, and a request is what ends it.
A deletion here comes back in two halves
Providers commonly clear the marketing and account data and refuse the clinical record, on continuity-of-care or records-law grounds; one says plainly that the account cannot be deleted, only suspended. The refusal is the useful half, because it names what they are keeping and why. Where no clinical record exists there is nothing to refuse, and what comes back is whatever they judged necessary.
What a company here typically holds
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
Identity documents sit at a maybe because an app asks for none. At a surgery, an online doctor or a pharmacy the ID check is routine, and the file it opens is the one kept longest.
What this can reveal about you
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Health Highly likely
Diagnoses, prescriptions, and visits are the record itself.
Mental health Likely
Therapy notes and mood tracking sit in the same file.
What lawfully stays after you leave
Two kinds of hold. Law sets it: a statute makes them keep it. They set it: a ground the company grants itself.
Medical records Law sets it 8 to 25 years
Health-records law sets long minimum retention for clinical data.
Tax and accounting records Law sets it about 6 years
Tax and company law makes them keep billing and payment records.
Records tied to a live or potential dispute They set it the limitation period of the claim
They can keep records to defend a live or possible legal claim.
Who wants this data
Independent testers found advertising trackers on a third of the largest US hospital websites, firing when a person booked an appointment, and inside the password-protected patient portals of several health systems. In those documented cases the tracking reached the records the confidentiality promise is meant to cover.
Sold or shared Possible
Regulated care rarely sells you, but wellness apps have shared health data with advertisers.
AI training Moderate
Clinical notes and app data train diagnostic and wellness models.
Even anonymised, this can still be you
Health data is where anonymisation first failed in public: in 1997 a researcher re-identified a US governor's supposedly anonymous hospital record using only his postcode, date of birth, and sex (Sweeney, 2000).
Name, date of birth, postcode Typical
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Payment patterns Sometimes
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
How you write Sometimes
Language models infer where a person lives, their income, and their sex from their writing alone, at near-human accuracy and at scale (Staab et al., ICLR 2024).
Face and voice Sometimes
A face, voice, or fingerprint template identifies a person directly; there is nothing left to anonymise, and it cannot be reissued like a password.
The studies Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)·Beyond Memorization: Violating Privacy via Inference with Large Language Models (ICLR 2024, 2024)
The wording that does the work
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation and AI training all fit under it. When they want to do something new with your data, this sentence usually already allows it.
The move An objection tells them to use your data to run the service and nothing more.
“we do not sell your personal information”
Usually this means no cash changes hands. Your data can still go to ad networks, analytics firms and partners, because they count that as sharing rather than selling.
The move Use the do-not-sell switch where there is one, and put an objection in writing as well.
“service providers, partners, and affiliates”
This is how your data leaves with no name attached. Recipients are described by what they do rather than named, and you cannot send a request to a company you cannot name.
The move An access request can ask for recipients by name rather than by category, and UK and EU law put that choice with you.
“aggregated or de-identified information”
Taking your name off does not take away the pattern, and the pattern often still points at you. Policies give themselves free use of this data with no end date, on the basis that it is no longer about you.
The move If a deletion comes back as 'anonymised', keep the reply. It usually means de-identified, and it is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for legal duties, tax rules, fraud prevention, possible lawsuits and their own business reasons. None of those has a firm end date, so deletion turns into something you have to argue for.
The move Which reasons apply to you, and how long each runs, is a request of its own.
“you grant us a licence to use your content”
This is a contract term rather than a data setting, so a privacy request cannot undo it. A careful version ends when your account does. A broad one can be passed on, never expires and survives deletion.
The move Their terms say whether the licence ends when the account does. Close the account and log the date here.
“to the extent any data is considered protected health information, under HIPAA where applicable”
Only the data inside the consultation is treated as medical and kept confidential. The sign-up forms, the intake questions, the browsing and the app usage all fall under the ordinary commercial policy instead. The wording borrows the US medical-privacy law's name while limiting how much of your data it actually covers.
The move A request makes them state, in their own words, which of your data they treat as medical and which they do not.
“following the Records Management Code of Practice and the NHS records retention schedule”
The retention promise points away from the policy to a separate NHS schedule the reader never sees on the page. That schedule keeps medical records for years, a GP record for ten years after death, so the record outlives the account and any request to close it.
The move A request puts the period, and what it covers, in their own words on your record.
“we keep a document which tells us how long we need to keep this information”
The retention answer exists and is not on the page. The policy points at an internal schedule and offers it if you get in touch, so how long your dispensing or consultation record is held is not something reading the policy can tell you.
The move Asking for that schedule is a request of its own, and it is answered in writing.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply.