Data Retention & Deletion Policy
Last Updated: June 9, 2026
Policy Owner: Marpass Privacy Office
Approved By: Marpass Privacy Office
This Policy describes how Marpass, Inc., a Delaware corporation, retains and deletes Customer Data and personal information across the Service. It consolidates the retention rules that also appear, in operative form, in the Privacy Policy, the HIPAA Notice, the Business Associate Agreement (BAA), and the Florida-Specific Addendum to the BAA. Where this Policy and another Marpass legal document differ as to a specific data category, the more protective rule controls.
Retention Schedule
| Category | Retention period | Source |
|---|---|---|
| Resident PHI (eMAR, care plans, vitals, notes, photos of orders) | For the term of the BAA. After termination, returned or destroyed within 60 days, except where state long-term-care rules require longer (e.g., FAC 59A-36.015 in Florida, WAC 388-76 in Washington). | BAA §5; HIPAA Notice §12; FL Addendum §5 |
| Florida-licensed ALF records | Longer of FAC 59A-36.015 (2 years post-departure), Fla. Stat. §400.145 where applicable, and 6 years (HIPAA). | FL Addendum §5 |
| Washington Adult Family Home records | WAC 388-76 minimum, plus the 6-year HIPAA minimum. | Privacy Policy §5; HIPAA Notice §11 |
| HIPAA compliance documentation (policies, training, authorizations, accounting of disclosures, breach records) | 6 years from creation or last effective date. | 45 C.F.R. §164.316(b)(2); §164.530(j)(2) |
| Account data | Life of the account plus a reasonable post-termination window (target 90 days, longer for legal holds). | Privacy Policy §5 |
| Billing data | 7 years from the year of the transaction (tax and accounting). | Privacy Policy §5.3 |
| Waitlist and sales inquiries | Up to 24 months from the last interaction, then deleted. | Privacy Policy §5 |
| Support tickets | 3 years from resolution. | Privacy Policy §5 |
| Product analytics events (PostHog) | 13 months from collection. | Privacy Policy §5 |
| Raw error logs (Sentry) | 90 days from collection. | Privacy Policy §5 |
| Audit logs of PHI access (append-only) | 6 years minimum (HIPAA), longer where Customer state requires. | HIPAA Notice §6; 45 C.F.R. §164.312(b) |
| Washington Consumer Health Data (MHMDA, non-PHI) | Only as long as necessary. Deletion within 30 days from production, 6 months from archive and backup. | Consumer Health Data Privacy Policy §5; RCW 19.373.050 |
| Sandbox or demo content | Purged on a rolling basis; not used for production. | TOS §7 |
| Backups containing PHI | Hot backups up to 90 days, cold backups up to 12 months, encrypted at rest. Deletion requests flow to backups within 6 months. | Privacy Policy §5; BAA §5 |
Deletion Requests
Marpass honors deletion requests from individuals and from Covered Entity facilities subject to legal-hold and statutory carve-outs. Account-holder personal information may be deleted on written request to privacy[at]marpass.com. Marpass responds within 45 days, extendable by one additional 45-day period where reasonably necessary. California residents (CCPA/CPRA) and Washington consumers (MHMDA) have additional rights described in the Privacy Policy and the Consumer Health Data Privacy Policy.
Deletion Mechanics
Production deletion writes a tombstone in the source-of-truth tables and removes the row from indexed views. Append-only audit logs are not deleted as a matter of design; their retention is enforced by a database trigger. Backups continue to carry data after the production tier deletes it, until the backup expires under the schedule above; backups are a sealed archive used only for disaster recovery, and restored backups re-apply deletion requests recorded after the backup point in time.
Contact
Marpass, Inc., 14 NE 1st Ave Ste 1403 #235, Miami, FL 33132. Reach the Marpass Privacy Office for privacy questions, the Legal team for BAA and contract requests, and the Security team for incident reports. privacy[at]marpass.com · legal[at]marpass.com · security[at]marpass.com
Questions about how we retain or delete data?
Our team will walk you through the schedule and any state-specific requirements.