Data Retention & Deletion

Last updated: October 23, 2026

1. Subscription expiry is not account deletion

An expired subscription does not by itself delete your account, personal credential wallet, credential documents or CE records. You may sign in to view/download available credentials and use account, billing, support and privacy controls. Renewing qualifying access restores the paid features for retained records. Ending an agency seat does not transfer ownership of your personal wallet to the agency or automatically delete it.

We retain professional records while you maintain your account and retain those records, subject to your deletion choices, security restrictions and applicable law. After at least 24 months without recorded sign-in or signed-in account activity, we send an inactivity notice giving you at least 30 days to sign in, export your information or contact support. Signing in cancels that inactivity notice. You do not need to subscribe to keep an account active. Active qualifying subscriptions, saved paid time, agency coverage and platform/store-review administration are protected from this inactivity process. Known bounced notices and unaccepted notice emails do not trigger automatic deletion.

Existing accounts receive a full inactivity window from adoption of this process because historical mobile last-use information was not reliably recorded. A subscription ending by itself does not start an immediate deletion countdown.

2. Deleting a credential or account

Subscription cancellation, credential removal and account deletion are separate actions. Cancelling renewal does not request deletion; requesting account deletion does not cancel a subscription with Stripe, Apple or Google or request a refund. Export records you want to keep before requesting deletion.

Account-deletion requests are available through account settings or https://medcertpro.com/account/delete. When accepted, the application disables account access and revokes sessions and sharing access. This initial deactivation is not a statement that every stored copy has already been erased. A scheduled worker removes personal credential files, CE and authentication data and de-identifies the personal profile, retaining only minimal deletion evidence and independently justified financial/security records. Failed or unsafe removal is recorded for review rather than marked complete. Requests requiring review are resolved within applicable legal time limits. We will explain any permitted extension or relevant exception. Contact [email protected] for assistance or the status of a request.

3. Limited retained records

Financial transactions, invoices, receipts and tax records may be retained for the applicable statutory/accounting period. A security incident, fraud investigation, legal claim, legal obligation or documented hold may justify limited additional retention. These purposes do not automatically justify retaining all uploaded credential documents. We restrict retained information to its permitted purpose and review continuing need when that purpose ends.

Organizations may independently retain lawfully exported or organization-controlled workforce records under their own obligations. Removing your Med-Cert Pro account does not retrieve copies already lawfully held by an employer or share recipient. Agency membership does not give an agency ownership of your separate personal wallet.

4. Security, support and access records

The application's security-maintenance rules remove failed-login and rate-limit records older than seven days and eligible used/expired reset and verification records older than seven days. Execution depends on the scheduled maintenance service. Token validity and access revocation are enforced separately.

Other audit, support and inquiry records are kept only while necessary for their service, security, dispute-resolution or lawful retention purpose. We review continuing need, restrict exceptions and avoid retaining unrelated credential contents in ordinary logs. Expired or revoked share tokens stop granting access; limited audit evidence may remain. Push registrations are removed through applicable opt-out, invalidation and account-deletion controls.

5. Backup copies and recovery

Deleting active data may not immediately remove a copy in a restricted recovery archive. Any retained backup copy must remain restricted to recovery, security or legal obligations, be subject to the actual backup service's retention/deletion process, and not be used to reactivate an account you deleted. Deletion restrictions must be reapplied before a restored service is returned to normal use.

The database backup configuration keeps 14 daily encrypted recovery copies and 8 weekly encrypted recovery copies, which ordinarily provides approximately two weeks of daily copies and eight weeks of weekly copies when schedules complete. Encrypted copies are emailed to the operator's controlled recovery inbox; mailbox copies must be managed under the same restricted recovery purpose and the mailbox provider's deletion process. Server retention does not automatically erase an emailed attachment or its trash copy.

The operator also plans to use GoDaddy's hosting backup service for site files. Its actual included paths, expiry cycle and restore capability must be verified separately; a 30-day rolling hosting recovery window is a target, not an established provider guarantee. In particular, database-only email backups do not include credential-document files or the document-encryption keys.

A minimal deletion ledger is preserved for recovery so that an older database or hosting backup cannot be used to reactivate a deleted account. Reapply the latest deletion ledger and complete erasure before reopening a restored service.

6. Questions and rights

Tyche Services, d.b.a. Med-Cert Pro, 609 Metairie Rd PMB 4015, Metairie, LA 70005. Privacy: [email protected]. Security: [email protected]. Applicable access, correction, export, deletion and appeal rights are described in the Privacy Policy. Nothing in this schedule limits a mandatory legal right.