Status¶

Accepted

Date¶

2026-07-24

Context¶

Closed beta will handle real-ish PHI. Hard-deleting medical records and medications on user delete removes forensic and recovery options and complicates mistaken deletes. Full GDPR account export/delete APIs are out of scope for this track.

Decision¶

Add deleted_at to medical_records and medications. List/get APIs omit soft-deleted rows. Object storage hard-delete is delayed via a retention purge (default 30 days) rather than immediate R2 delete. No account-level export/delete APIs in this track.

Alternatives Considered¶

Immediate hard-delete (current behavior)¶

• Pros: Simple; frees storage immediately
• Cons: Irreversible PHI loss; harder incident recovery
• Rejected for closed-beta safety bar

Full GDPR erasure APIs now¶

• Pros: Compliance completeness
• Cons: Large scope; payments/account lifecycle unfinished
• Deferred

Consequences¶

• Mobile contract shape unchanged; lists simply omit deleted items
• Purge worker stub must be scheduled before retention TTL elapses in production
• IDOR responses remain 404 for deleted and foreign rows alike
• See Phase 4 in tasks/plan.md