1. Overview
This Data Retention Schedule describes how long CareSwaps, LLC retains each category of data and how we dispose of it when the retention period ends. Retention periods reflect the longest applicable legal obligation, including HIPAA (45 CFR § 164.530(j), six years minimum), IRS recordkeeping (seven years for tax records), the federal Anti-Kickback Statute (documentation retained indefinitely to support a defense), and Colorado consumer-protection recordkeeping.
Legend: PHI Protected Health Information · PII Personal Identifying Information · OPS Operational data (de-identified) · FIN Financial/billing · LEGAL Legal and compliance.
2. Protected Health Information (PHI)
| Data Category | Retention | Disposal |
|---|
| PHI Resident identifiers, DOB, POA status, care needs | 6 years after subscription end (HIPAA minimum) | Secure Deletion w/Audit Log |
| PHI Intake form submissions | 6 years after submission | Secure Deletion w/Audit Log |
| PHI Outbound email with PHI | 6 years | Secure Deletion w/Audit Log |
| PHI PHI access / audit logs | 6 years minimum | Secure Deletion w/Audit Log |
HIPAA Minimum: 45 CFR § 164.530(j) requires covered entities and business associates to retain HIPAA-related documentation for six years from the date of its creation or the date when it last was in effect, whichever is later. CareSwaps applies this minimum to all PHI records and all PHI-related audit logs.
3. Personal Identifying Information (PII — Non-PHI)
| Data Category | Retention | Disposal |
|---|
| PII Subscriber account (name, email, state) | Life of subscription + 3 years | Secure Deletion |
| PII Support tickets and communications | 3 years after resolution | Secure Deletion |
| PII Marketing / waitlist signups (pre-subscription) | 2 years from signup or opt-out | Secure Deletion |
4. Operational Data (De-identified — No PHI)
| Data Category | Retention | Disposal |
|---|
| OPS Swap IDs, match status, timestamps | 6 years (consistent with HIPAA audit trail) | Secure Deletion |
| OPS Facility roster (business info, not PHI) | Life of contract + 6 years | Secure Deletion |
| OPS Automation execution logs | 90 days (rolling) | Automated Purge |
| OPS Website analytics (aggregated, IP-anonymized) | 14 months | Automated Purge |
5. Financial and Billing Data
| Data Category | Retention | Disposal |
|---|
| FIN Invoices, receipts, subscription history | 7 years (IRS) | Secure Deletion |
| FIN Refund records, chargebacks, disputes | 7 years | Secure Deletion |
| FIN Tax returns and supporting documents | 7 years | Secure Deletion |
6. Legal, Regulatory, and Compliance Records
| Data Category | Retention | Disposal |
|---|
| LEGAL Executed BAAs with facilities | Term + 6 years | Secure Deletion |
| LEGAL Executed Client Subscription Agreements | Term + 6 years | Secure Deletion |
| LEGAL Executed Technology Services Agreements | Term + 6 years | Secure Deletion |
| LEGAL Anti-Kickback Statute compliance documentation | Indefinite (to support defense) | No automatic disposal |
| LEGAL Breach investigation records | 6 years after incident close (HIPAA minimum) | Secure Deletion w/Audit Log |
| LEGAL Complaint records (customer, OCR, AG) | 6 years | Secure Deletion |
| LEGAL Policies, procedures, audit reports | 6 years after each version retired | Secure Deletion |
7. Disposal Methods
| Method | Description | Applies To |
|---|
| Secure Deletion w/Audit Log | Record is cryptographically erased or fully deleted from primary and backup systems; disposal action is recorded with actor, timestamp, and record ID. | PHI and PHI-adjacent records |
| Secure Deletion | Record is deleted from primary and backup systems. Disposal recorded at the aggregate level. | PII, FIN, LEGAL (non-PHI) |
| Automated Purge | System-level purge governed by the service provider's retention controls (e.g., a rolling 90-day log window and 14-month analytics retention). | Operational logs, analytics |
| Standard Deletion | Standard user-initiated deletion where formal audit logging is not required. | Marketing / top-of-funnel records |
| No Automatic Disposal | Records retained indefinitely to support regulatory defense. Reviewed annually. | AKS documentation |
8. Legal Holds
When CareSwaps receives notice of litigation, a governmental investigation, a subpoena, or a regulatory audit, the records implicated are placed under a legal hold. Retention and disposal schedules are suspended for those records until the hold is released in writing by the Privacy Contact or outside counsel.
9. Contact
Questions about retention or disposal: privacy@careswaps.com · (970) 306-7131 · CareSwaps, LLC, 2519 S. Shields St., Suite 1K PMB 1159, Fort Collins, CO 80526.