Data & compliance

Who can use it

Admin → Data & compliance. Admins have everything. The Manager role has See Data & compliance, Handle requests, holds and the archive, and Ask for records to be deleted from the start; to give them to someone else, use Admin → Team (their Access tab, or a role). Only Admins can approve deletion or change the policy. The Admin menu shows a number when requests are open or profiles are ready to delete.

Requests

Every “Client asked about their data” logged from a client’s Access log tab, and everything clients send through Manage my data: a copy of their data, deleting it, a correction, updating their contact details, stopping marketing, or that they can’t get into their email. Each shows who asked, how, when, its step, and the reply due date: one calendar month from the day they asked (not the day it was logged). Tap Work on it to go through three steps: check it’s them, act on it, reply. Whoever handles requests is told in the bell when one arrives, and reminded at 7, 21 and 28 days and when one is overdue. Tapping the notification opens that request.

Manage my data (your clients’ page)

Your website has a Manage my data link in the footer (move or hide it in Website → Header and menu, like any other link; clients can still reach it at your address followed by /my-data). A client types their email; if it’s the address on one of your client profiles, they’re emailed a link that works for one hour. The page says the same thing whatever address is typed, so it never shows who your clients are. From the link they can update their contact details, update their health questions, ask for a copy of their data, stop marketing emails, or ask for their data to be deleted. Nothing you hold is shown on the page. Requests appear here within a minute or so of Pulosa being open, marked Confirmed through Manage my data, so step 1 is already done. Stopping marketing happens straight away; the rest wait for you. Updated health questions go to the client’s Medical history as a new version (earlier answers are kept) with a blue Medical history updated badge, encrypted on the client’s device so only people who can see clinical records can read them. They can only update health questions if online health forms are on. The page also lists their upcoming appointments, each with Manage to change the time or cancel (see Online booking).

1. Check it’s them

Before acting, make sure the request came from the client. Tap Confirmed in person if you’ve checked face to face (for example photo ID); it’s recorded under your name. Or tap Email a link to send a one-time link to the email address already on file (never one given in the request): when they open it and tap Yes, it was me, the request moves on by itself. The link works for 7 days. Both are noted in the audit log.

2. Deleting their data

Pulosa works out the split for you. Delete now: phone number, address, emergency contact, gender, admin notes, marketing, cancelled, missed and upcoming appointments (their emails stop), and every record past its retention period or from a service kept 0 years. Keep and restrict: clinical records and visits still inside retention, with just their name, date of birth and email. A restricted profile disappears from your client list, search, booking and calendar names, and can only be opened from the Vault; once retention ends it comes up in Ready to delete. If they book again, online or at the desk, they start a new profile: the restricted one is never reused. If nothing has to be kept, the whole profile goes. If it’s on legal hold, nothing is deleted and the reply explains why. Only an Admin applies it, with their PIN.

2. A copy of their data

Their copy is a .zip: a cover letter (what you hold, why, who it’s shared with, how long it’s kept and their rights), a summary page to print as a PDF, a copy for other software (CSV and JSON), their earlier contact details, and their original photos and files, each checked against its fingerprint. Practitioners’ notes are left out unless an Admin ticks Include practitioners’ notes (or Policy releases them automatically). Someone who can see clinical records prepares it. Send by secure link encrypts it on your device and uploads it; the link goes in the reply, works for 7 days, then the copy is deleted automatically (noted in the audit log). Copies over 50 MB can’t go by link: tap Download their data and hand it over another way. Never attach it to an email.

2. Updating their contact details

When a client sends new contact details through Manage my data, the request shows what you have now beside what they’ve asked for. Check them and tap Update their details. Their old details are kept: on the client’s Access log tab, open Earlier details to see every change to their name, date of birth, phone, email, address or emergency contact, when, and who made it. Changes you make with Edit details are kept there too.

Lost access to their email

A client who can’t get into the email on file can tap I can’t get into that email any more and give their name, date of birth and a way to reach you. It arrives as Lost access to their email, not matched to anyone. Search for the client and tap This is them. Use their contact details only to arrange seeing them: confirm who they are in person (for example photo ID), then enter their new email and tap Update their email. The reply goes to the new address.

2. Corrections, marketing and earlier records

Correction: choose the record it’s about and write the correction. Clinical records are never changed: the correction is a sealed, dated note shown beside the original, on the consent form and in Medical history and Clinical notes. Stop marketing: one tap; appointment emails still go. Earlier records: when someone whose old profile was restricted comes back, ask them whether to link their earlier treatment records. An Admin records their answer: linked (the restriction is lifted) or kept separate.

3. Reply

Pulosa writes the reply from what was done: what was deleted and what’s kept until when (with the legal reason), the copy you’ve prepared, the correction, or the end of marketing, plus how to complain to the ICO. Check it and change anything, then Email it to their address on file, Copy it, or tap I’ve sent it another way. Replies never include health information. The request is then marked Replied. Confirmation links and replies show in Admin → Website & messages → Client messages → Sent log.

Need more time?

For a complex request, or one of several from the same person, tap Need more time? and say why. The deadline moves out by two months, once only, and Pulosa writes the letter telling the client why (send it within the first month).

Vault

Archived clients, with names hidden (S•••• T•••••). Search by name, email or ID. Each shows the last visit, how long they’ve been inactive, their last service with its risk and retention, when their records can go, and how many records and files they have. View record opens the profile and is noted in the audit log; Restore brings them back to your client list. Archive a client (at the bottom) is for duplicates or people who’ve moved away.

Legal holds

Place a hold when records might be needed, for example for an insurance claim or complaint: find the client and say why. Nothing on a held profile can be deleted by anyone, including the weekly check, until the hold is released. Releasing a hold asks for your PIN. The client’s profile shows a red Legal hold badge to Admins and Data & compliance.

Retention review

1. 1Going inactive: clients with nothing booked who’ll be archived within 2 months. A good list to invite back.
2. 2Recently archived: archived automatically in the last 30 days, with Restore.
3. 3Ready to delete: archived, not on hold, and past retention. A manager ticks them and taps Send for approval. An Admin ticks them (requests waiting for approval show first), taps Delete permanently, types PERMANENTLY DELETE and enters their PIN.
4. 4Held back: past retention but on legal hold.
5. 5Coming up: archived and still inside retention, with the days left.

What deleting does

The profile and everything on it go for good: details, consents, health forms, notes, photos, files and bookings, from your records and file storage. Any scheduled emails stop. Your accounts keep the payments without the name, and the audit log notes how many records went, never who. Deleted data can stay in the database host’s encrypted backups for up to 7 days.

Policy

You decide, as the data controller. For each service: its risk and how many years records are kept after the treatment (we start you at 8 years for injectables, peels, lasers and microneedling, 5 for colour, tints and lashes, and 0 for things like cuts and nails; while consent forms and health records are off in Admin → Business → Profile, every service is treated as 0 years unless you set its own, and keeping under-18s until their 25th birthday is off). These are common starting points, not legal requirements: check with your insurer and professional body. A service on 0 years has nothing protecting its appointments, consent forms and photos: they can be deleted as soon as the client is archived or asks for their data to be deleted, so you’d have nothing to show if a client made a claim. Policy warns you about any service left on 0 years; most insurers expect at least 6. Also: how many months with no activity before a client is archived (24 to start), whether past-retention profiles wait for an Admin or are deleted automatically after a notice period, whether under-18s are kept until their 25th birthday, and whether practitioners’ notes go straight into copies of data. Only Admins can change it; changes are in the audit log.

The weekly check

Once a week, the first time someone logs in, Pulosa archives clients with no activity for the period you set (anyone with something booked is left alone), removes unpaid cancelled and missed appointments over 2 years old, notes profiles newly ready to delete, and, only if you chose automatic deletion, deletes those whose notice has run out. It’s logged as Weekly check.

In the app

Working on a request: check it’s them, act on it, replyWhat clients see on Manage my dataUpdating contact details a client sentRetention reviewYour data policy