Retention policy

Data class	Default retention	Mechanism
Clinical records	Until tenant deletion / DSAR erasure	Admin + DSAR API
Audit logs	365 days (configurable)	AUDIT_RETENTION_DAYS, archive job
Backups	GFS: 7d / 4w / 12m	Celery + BACKUP_* settings
Cache (Redis/static)	5 min – 7 days	TTL
RAG / Chroma	Until admin purge / DSAR erasure	Knowledge uploads live in Chroma (CHROMA_PERSIST_DIR); purge on erasure checklist
Tutor chats (chat_sessions / chat_messages)	Until user/admin delete or DSAR	Postgres tables
Learning progress	Until user/admin delete or DSAR	progress table
Sessions	7 days	Redis TTL

Admin knowledge-base ingest uploads feed the RAG collection; retain only as long as the tenant needs them for tutoring.

Legal hold: set legal_hold=true in tenant settings to skip automated purge (future automation).