Exporting a patient's data, and erasing it

Two GDPR obligations land on a clinic more often than any others: a patient asking for a copy of everything you hold on them (Article 15), and a patient asking you to delete it (Article 17). Orla does both from the patient's record, and both are owner-only.

Exporting one patient's data

The export is a single structured file covering the whole record:

• the patient's own details, and the clinic and timezone the record belongs to
• every consent, with when it was given and when it was withdrawn
• every appointment, with the service and the practitioner named
• every message sent to or received from them
• forms they submitted, and signatures they gave
• invoices and payments
• care plans
• waitlist entries
• photographs, described by capture date, body site, caption and file details
• the access log — who looked at this record, and when

That last section is the one clinics are surprised by and regulators ask about. Because Orla journals reads and not only writes, a subject access request can answer "who has been looking at my file", which is usually the real question behind the request.

Exporting is itself journalled. The act of answering a subject access request is recorded as one.

Erasing a patient

Erasure is irreversible, so it is owner-only and it checks before it acts.

It refuses if the patient still has upcoming appointments. Cancel them first. Erasing somebody who is due in on Thursday would leave the diary pointing at a person who no longer exists.

Photographs are destroyed. They are the one part of the record that cannot be kept under any basis, so they go.

Bookings are anonymised rather than deleted, so the clinic's own history — utilisation, takings, what happened in the room — survives without naming anybody.

What survives erasure, and why

Some records are kept, and Orla tells you which and on what basis rather than silently retaining them. Each retained item names the article it survives under. For example, a signed consent keeps the definition hash and the signed-at time — which name nobody — while the IP address and user agent are stripped, on the basis that a clinic must be able to show what was agreed if it is ever disputed.

Clinical documents that form part of the record — letters, referrals, note exports and scans — are retained on the same footing as the notes themselves, under the clinic's retention policy.

You get this list back from the erasure, so it can go straight into your reply to the patient.

Taking the whole clinic with you

Beyond individual patients, everything the clinic holds is exportable, and every report exports to CSV. There is no lock-in mechanism and no exit fee. A system that has to trap you to keep you is telling you what it thinks of its own product.