How long pilot information is kept
Pilot Data Retention & Deletion Policy
Pilot version · Updated 8 September 2026
Interim closed-pilot position: Recovery Connect does not keep every conversation for two years. Information is kept only while it is needed to provide an active pilot account, handle an open safety, security or complaint matter, or meet a legal requirement. When none of those reasons applies, it is deleted or permanently de-identified. Recovery Connect must obtain qualified advice about its legal classification before wider launch.
Principles we apply
- Collect as little identifying information as the pilot reasonably needs.
- Keep information only while it is necessary to provide an active account or handle an open safety, security or complaint matter.
- After that purpose ends, retain only the minimum information that Australian law, a court or a tribunal requires.
- Delete or permanently de-identify everything else.
- Document deletion, legal holds and exceptions instead of making informal decisions.
What happens during the closed pilot
Profile and consent record
Kept while your pilot profile is active so sign-in, display name, eligibility, role and accepted policy version can be managed. The live profile is removed when you use the account-deletion control.
Community messages
Active, hidden and held messages remain in the live pilot database while the profile exists. A member can permanently delete an individual message, including its linked reports, or delete the whole profile and all of that member's messages from the live pilot database.
Member reports and blocks
A report is kept only while it is open. Resolving it deletes the report details from the live database. A minimal action entry, without the report text, remains while needed to operate and review the pilot or because the law requires it. Blocks remain while the account exists.
Public concerns
A concern and any optional contact details are kept only while the concern is open. Resolving it deletes the concern record from the live database. A minimal action entry, without the concern text or contact details, remains only while needed to operate and review the pilot or because the law requires it.
Invitation records
Invitation codes are stored as one-way hashes rather than readable codes. A used invitation record is deleted when the invited profile is created. Expired invitation records are cleared during invitation administration.
Moderation and settings records
Only a minimal record of a moderation decision or pilot access change is kept while it is needed to operate the closed pilot, review an open dispute or meet a legal requirement. It does not preserve the deleted report or concern text.
Hosting and security records
Technical logs, security records and backups are managed by the hosting and sign-in providers under their service schedules. Information deleted from the live database may remain in protected backups until those backups rotate or are securely removed.
Direct emails and business records
Emails are kept only while needed to answer the request, manage a complaint or meet a legal or company-record obligation. Avoid sending unnecessary health information by email.
At the end of the pilot
Recovery Connect will close posting, identify any information that Australian law, a court or a tribunal requires it to preserve, and restrict that information to the minimum necessary people and purpose. Other personal and health information will be destroyed or permanently de-identified. De-identified information will only be retained if re-identification risk has been assessed and appropriately reduced.
When information may be kept longer
Deletion may be delayed only for the information needed to handle an open safety, security, privacy or complaint matter, or where Australian law, a court or tribunal order, or a regulator requires preservation. After the open matter ends, information will be retained only if a legal requirement still applies. Access will be restricted, only the minimum necessary information will be kept, and unrelated conversations will not be included.
What must happen before wider launch
- An Australian privacy lawyer must confirm whether Recovery Connect is a health service provider and which federal, Victorian and other state or territory rules apply.
- A final record-by-record schedule must set lawful minimums and maximums for messages, profiles, reports, moderation records, incidents, backups and business records.
- Automatic deletion or de-identification must be implemented and tested against the final schedule.
- The provider's storage locations, backup rotation and deletion process must be documented.
- Pilot members must be told about material changes and asked for fresh consent where appropriate.
Requesting access, correction or deletion
Email recoveryconnect.org@outlook.com. Include your pilot display name and the email used to sign in, but do not email passwords, invitation codes or unnecessary recovery details. Recovery Connect may verify your identity before acting on the request.
This interim policy describes the current closed pilot and the decisions still requiring qualified review. It will be replaced by a final schedule before wider launch.