Active accounts
Account information and customer content are retained while the account is active and as needed to provide the service. Healthcare customers determine their clinical record-retention obligations and should establish their own retention and export procedures.
After cancellation or termination
Authorized account owners should export needed information before access ends. We may maintain a limited recovery period described in the applicable order or account notice, after which customer content is deleted or de-identified from active systems unless law, a legal hold, dispute, security investigation, or written agreement requires retention.
Backups and technical records
Deleted information may remain temporarily in encrypted backups until those backups are overwritten under normal rotation. Backup data is isolated from ordinary product access and retained only for continuity, security, or legal obligations. Security and audit records may be retained longer when needed to investigate access, protect the service, or demonstrate compliance.
Financial and legal records
Invoices, transaction records, contracts, consent records, and required business records may be retained for the period required by tax, accounting, contract, and other law. These records are not used to restore deleted clinical content.
Requests
An authorized account owner may request export, correction, or deletion through the product or at privacy@sessionsteps.com. We verify identity and authority before acting and will acknowledge the request with the applicable scope and timeline. A client should generally direct requests to their healthcare practice, which controls the record.