Deletion

Circadify’s architecture is designed around ephemeral data. In the default configuration, vital sign results are not persisted server-side at all — they are returned directly in the HTTP response and no health data is stored.

Session Data

Default Mode (PERSIST_VITALS=false)

By default, vital sign results are returned directly to the client in the upload-complete response. No health data is written to any persistent or cached store. Session metadata (IDs, status) is held transiently during the upload flow and cleaned up immediately after results are delivered. There is no health data to delete.

Note

In default mode, there is no persisted health data to delete — vitals are returned inline and session metadata is cleaned up automatically.

Persist Mode (PERSIST_VITALS=true)

When persist mode is enabled for async or telehealth workflows, session data (vital sign results, confidence metrics, processing metadata, and any telehealth context) is cached with a configurable TTL (default 15 minutes). When the TTL expires, the data is automatically and irreversibly deleted.

No manual deletion API is required for session data — in default mode nothing is stored, and in persist mode the ephemeral TTL ensures automatic cleanup.

Developer Account Data

Developer accounts (email, name, company, API keys, usage records) are persistent and retained for the duration of the contract.

To request account closure or deletion of developer account data, contact support@circadify.com. Upon account closure:

• The developer account is deactivated
• All associated API keys are revoked
• Usage records are retained as required for billing and compliance

Data Subject Requests (GDPR / CCPA)

For data subject access or deletion requests:

1. Contact support@circadify.com with the request details
2. Our team will identify any data associated with the data subject
3. In default mode, no health data is persisted server-side. In persist mode, session data auto-expires per the configured TTL
4. Developer account data and audit log references will be handled per the request

Caution

Audit logs are retained for compliance purposes (HIPAA) and may not be eligible for deletion. Audit logs record access events and do not contain health data.

Audit Logs

Audit logs are retained for a minimum of 6 years per HIPAA requirements. They record access events (actor, action, resource, outcome, timestamp) but do not contain health data. Audit log deletion requests should be directed to support@circadify.com and will be evaluated on a case-by-case basis.

Next Steps

• Residency — Where data is stored
• Compliance — Regulatory compliance details