SLP Nova Retention, Return and Deletion Policy
Version 2026-10-launch-retention-v3 · Last updated October 8, 2026.
We keep information for the agreed service and specific lawful retention duties. Your clinician/practice maintains its legally required final clinical record; Nova is not its only record repository. The applicable BAA/processing addendum controls conflicting generic wording. Use authenticated controls or contact hello@slpnova.com without clinical content for access, correction, return or deletion; we verify authority and arrange secure handling.
Retention by category
| Category | Retention and disposal |
|---|---|
| Raw session audio | Expires 30 days from upload/creation, with earlier lawful deletion available. Any recording the clinician must keep as part of an official record is retained independently by that clinician. |
| Transcripts, notes, sessions, goals and report drafts | Kept while needed in the workspace until separately deleted through clinical/account controls or verified lawful instructions. Deleting audio does not automatically erase an existing transcript/report. Legal holds are limited to the affected record and purpose. |
Private clinical replay cache: clinical_request_results | Protects against accidental double submission. Replies expire after the configured dedupe window (120 seconds by default) or no later than 24 hours for explicit request keys; expired replies cannot be replayed. Cleanup deletes expired copies. Never exported or used for analytics or logs. Account erasure deletes them. Persisted clinical records use ownership-checked references; assistant replies may have short-lived private copies. Source clinical deletion removes related replay content and prevents pending responses from restoring it. |
Content-free request metadata: billing_request_keys | Account/operation identifiers, hashed keys/fingerprints, status and timing; no clinical request/response body. Purged after 30 days and removed on account erasure. Content-free accounting tombstones separately prevent an old explicit key from charging again until account erasure; they contain no clinical body. Replay/metadata expiry never resets quota/spend or changes source-record retention. |
| Professional account/authentication | Kept for the account and necessary security operations. Verified account deletion removes/minimizes active account data; a request has a revocable seven-day waiting period, subject to earlier statutory/security action. Provider residual copies are governed separately. |
| Exports and local copies | Structured export streams to the authenticated user; it does not include raw audio files or replay-cache copies. Retained audio is returned through secure support on verified request. Downloaded/local recordings are controlled by the clinician/recipient. Transient server delivery copies are removed after delivery or failure recovery and are not an archive. |
| Minimal contract/security evidence | Kept separately for required proof. HIPAA security documentation is retained six years from creation or last effective date, whichever is later. Necessary contract evidence follows applicable limitation/record duties; clinical content is excluded when unnecessary. |
| Breach/accounting evidence | Required information is retained under the governing law/BAA; all PIPEDA breach records are retained at least 24 months. A product-export event cap does not set an accounting retention period. |
| Financial records | Minimum invoices/payment/tax records are retained for applicable statutory periods and provider legal duties. No child identifiers or clinical content are needed in them. |
| Routine logs/support | Content is minimized, restricted to operational purposes and removed when no longer necessary, with specific documented legal/security exceptions. Ordinary messages contain no clinical attachments. Resend's standard email/log period is 30 days; mailbox and other provider copies have separate applicable cycles. |
| Generic game assets | Microsoft Azure AI Speech text to speech generates audio from curated, non-identifying game words using prebuilt neural voices. These generated clips are publicly cached and remain available until replaced or removed; no customer clinical records or session recordings enter game synthesis or its cache. These public assets are not customer clinical storage. |
Return and active deletion
We provide usable return/rights assistance within 10 calendar days of verified instructions and destroy remaining active-system clinical copies within 30 calendar days of the return or authorized-destruction instruction, sooner when applicable law requires. We provide a meaningful return/export opportunity before irreversible destruction, explain lawful restrictions and preserve urgent statutory rights. We confirm completion or identify a specific retained copy and basis; hiding a record or marking it deleted does not prove physical disposal.
Trial expiry, complimentary-grant ending and ordinary subscription cancellation never by themselves charge or delete records. Retained records remain viewable/exportable under these independent retention rules. Cancel billing and request account deletion through their separate controls.
Replay cleanup and backups
Replay expiry prevents reuse even before a cleanup pass finishes. Cleanup runs on account requests and periodic operational monitoring, using bounded batches to remove expired replay copies and 30-day metadata. Any backlog is monitored and cleared; replay copies remain private and unavailable after expiry. Account/clinical erasure invalidates pending and completed replay content independently of normal cleanup.
PostgreSQL has a 14-day rolling backup window. Blob, authentication, email, monitoring and AI-safety copies may have separate processor/security cycles. We restrict residual copies from routine use, identify their purpose/location/expiry when an exception applies and reapply deletion after recovery. Application deletion is not a promise of immediate erasure of every processor copy.
A retention exception must identify the specific information, lawful reason, authorized access and expiry. We destroy the copy when justification ends. An indefinite claim of dispute handling or deletion difficulty does not authorize keeping every child's record. Clinician recordkeeping duties, including Chilean official clinical records, do not automatically extend Nova's service-copy retention.