Data Retention Policy
Last updated: 24 October 2026
Policy owner: Dr. Henna Safiyah Malik. Contact: hennamaikuk@gmail.com.
Clinical records
Patient questionnaires, clinical messages, clinically relevant photographs, test results, doctor notes and prescriptions are retained for at least five years after the last clinical interaction or clinical entry, whichever is later. Longer applicable obligations and complaint, investigation or litigation holds take precedence.
Scope of the legal reference
Article 13 of Qatar Law No. 2 of 1983 requires private clinic patient registers to be kept for at least five years after the last entry. DrOnline applies this baseline to its related clinical materials as a platform policy. DHP Circular 12 of 2024, section 3 item 4, requires patient files to be retained for the period prescribed by applicable law.
Other information
Optional images that are not part of the clinical record follow the separate photo privacy notice. Account, payment, identity and delivery information follow their applicable purposes and legal requirements; the five-year clinical period is not a blanket period for every item of personal data.
Disposal and requests
At expiry, authorised staff must review records for secure deletion or irreversible anonymisation. Records under a legal hold must not be deleted. Backups must remain access-restricted and expire under the documented backup schedule. Restoration must not reintroduce deleted data to normal use. Patients may request access, correction or deletion through the privacy contact; account closure does not erase records that must lawfully be kept.