Data Retention and Account Deletion Policy

Last updated: 11 October 2026

This policy explains how Nightscout Pro Ltd handles account closure, health data and the records we must keep. It applies to the services and copies we control. Contact [email protected] with a deletion request or any question.

Cancellation and permanent deletion

Cancelling a subscription stops future renewal. It is separate from permanently deleting your account and data. Closing access to an account also does not, by itself, erase its data. If your meaning is unclear, we will clarify whether you want cancellation, permanent deletion, or both.

After the relevant paid service ends, ordinary cancellation allows a recovery period of two calendar months. At the end of that period, the related service data is due for permanent deletion. Where an account has more than one site or subscription, cancellation of one does not authorise deletion of the others.

An explicit erasure request does not have to wait for this recovery period. We act without undue delay and normally respond within one calendar month. Where the law permits an extension because a request is complex or numerous, we will explain the reason and revised timeframe within the first month. You may expressly choose a later deletion date, for example the end of a paid period. We do not impose that delay on you.

Making and scheduling a request

You can request deletion through support even if you cannot sign in. We take proportionate steps to verify your identity and authority over the account and the affected health data. Where reasonably necessary, we may ask for additional verification. An authorised parent, guardian or representative may request deletion on behalf of the person concerned; we will check their authority.

Support records the request date, verification, scope and scheduled date in a deletion register. An administrator can schedule deletion, change its date or cancel the schedule before erasure starts. The request remains tracked if the support ticket is closed. Once erasure starts, removed data cannot be recovered. Ask for any export you need before the scheduled date; requesting an export does not automatically change that date.

Scheduling permanent account deletion also stops subscription renewal. If you choose deletion before the paid period ends, remaining service ends when deletion starts. Refund requests are considered separately, and statutory rights are unaffected.

What is erased

For a verified full-account request, we remove the account and its sites, health readings and treatment history, profiles, stored credentials and tokens, connector and transfer settings, follower access and unnecessary customer support records, attachments and derived customer information. Uploads and account access are disabled as part of erasure. We verify ownership before removing shared resources and stop for review if the scope changes or is unclear.

We also check migration archives, exports, historical databases, mailbox copies and other managed storage. Unnecessary personal data is deleted or irreversibly anonymised. A pseudonym, disabled login or deleted database row alone is not treated as full erasure.

Limited records we retain

• Accounting and tax: issued invoices, payments, refunds, relevant billing identity and supporting transaction evidence are normally kept for six years from the end of the company financial year to which they relate. Applicable VAT OSS or MOSS records may need ten years from the end of the relevant calendar year. A longer period is used only where required by applicable law or a documented specific obligation.
• Specific legal claims or investigations: we may keep only the information necessary for an applicable legal obligation or for establishing, exercising or defending a legal claim. The reason, scope and review date must be documented. This does not justify keeping an entire health record as a general precaution.
• Deletion evidence and prevention of restoration: we keep a limited record of the request, verification, dates and outcome, and the identifiers needed to prevent old imports or events from recreating deleted data. Detailed personal request information is removed when no longer needed. Restricted financial records have their own retention periods.

Retained records are restricted to authorised staff for the recorded purpose. They are not used for service delivery, marketing or profiling. We review continuing retention and remove company-controlled copies when the applicable period ends and no documented hold applies. Payment providers such as Stripe may retain financial information under their own legal obligations.

Backups and completion

Live erasure and backup expiry are tracked separately. Where an individual record cannot reasonably be removed from a backup immediately, the copy is put beyond normal use, restricted and kept only until its recorded expiry or verified removal. We record the actual location and expiry for the request; we do not assume a universal backup period. A restoration must reapply the deletion register before restored personal data is made available.

We tell you what has been erased from live services and explain any lawful retained categories or remaining backup period. Full completion is recorded only after the relevant checks and verification of backup removal. If a step fails or needs specialist review, the request stays open in the deletion register until resolved.

Other organisations and copies you control

Where required, we tell recipients or processors about erasure and request appropriate action. Deleting Nightscout Pro data does not delete source records held independently by device manufacturers, healthcare providers or other services, nor exports or copies held by you or your followers. We explain relevant limits rather than claiming to erase data we do not control.

Questions and rights

Contact [email protected] to make or amend a request, ask about retained information or raise a concern. We explain any lawful refusal or partial refusal and your right to complain to the relevant supervisory authority, including the UK Information Commissioner. This policy supplements our Privacy Policy and does not limit statutory rights.