THS IS AN UNCONTROLLED COPY. UNCONTROLLED COPIES ARE FOR REFERENCE ONLY AND NOT SUBJECT TO AUTOMATIC UPDATE WHEN A NEW VERSION IS RELEASED. CONTACT THE COMPLIANCE MANAGER FOR UPDATES.

Records Management and Retention Periods

1. PURPOSE

Lightning Health’s business is built around providing our clients with high quality data. There are legal and regulatory requirements for us to retain some of our data, and this policy is intended to ensure our compliance with these requirements and associated timescales. We also retain data to help our business operate and to have information available when we need it. However, we do not need to retain all data indefinitely, and retaining data can expose our company to risks and costs. This policy explains our requirements to retain data and to dispose of data.

2. SCOPE

This policy covers all data that Lightning Health hold or has control over. This includes physical data such as hard copy documents, contracts, and invoices. It also includes electronic data such as emails, electronic documents, data within SharePoint, the Lightning Insights platform, Scoro and HubSpot, as well as audio and video recordings. It applies to both Personal Data and Non-personal Data. This policy applies to all departments and Workers.

3. DEFINITIONS & ABBREVIATIONS

4. RESPONSIBILITIES

5. POLICY

This policy has been developed to ensure that Lightning Health meets the following commitments:

• We comply with legal and regulatory requirements to retain data
• We comply with our data protection obligations, in particular, to keep Personal Data no longer than is necessary for the purposes for which it is processed (storage limitation principle)
• We handle, store and dispose of data responsibly and securely
• We create and retain data that we need to operate our business effectively, but we do not create or retain data without a good business reason
• We allocate appropriate resources, roles and responsibilities to data retention
• We regularly remind employees of their data retention responsibilities

With the above in mind, Lightning Health has reviewed its data, and documented the data we hold and the appropriate retention periods for this data in the attached schedule. Records will be retained for the periods shown in the attached schedule. All retention periods are given in whole years and are from the end of the financial year to which the records relate. Once data has exceeded its retention period it should be disposed of securely.

Data that does not require retention

We do not need to retain all information we generate as a business. Where data is not detailed within the attached schedule, is no longer of value and has no business purpose, it should be disposed of. This includes:

• Trivial, spam and junk emails
• Preliminary drafts of letters, memoranda, reports, worksheets, and informal notes that do not represent significant steps or decisions in the preparation of a final report or research
• Duplicated and superseded data
• Hard copy documents where an electronic copy exists
• Reference material not produced by Lightning Health where a copy is available online

If you are not actually using a record, you should consider whether you need to retain it.

What to do if data is not listed in the Record Retention Schedule.

If data is not listed in the Record Retention Schedule, it is likely that it should be classed as disposable information. However, if you consider that there is an omission in the Data Retention Schedule, or if you are unsure, please contact the appropriate Functional Head or Lightning Health’s Data Protection Officer.

Destruction

Functional Heads are responsible for the continuing process of identifying the data that has met its required retention period and supervising its destruction. The destruction of confidential, financial, and Worker-related hard copy data must be conducted by shredding. Non-confidential data may be destroyed by recycling. The destruction of electronic data must be co-ordinated with our IT Support Partner.

Procedure

To ensure we retain data in line with our below retention schedule, you must tag within Microsoft 365, the folders/files with the appropriate label. The pre-set labels determine the data type and retention period.

It is essential that the pre-set labels are used, as they ensure that data will automatically be deleted or triggered for review depending on the assigned retention period.

How to assign retention label to folders/files in Teams App

1. Navigate to the appropriate channel
2. Find the folder/files you need to assign a retention to
3. Select the ‘three dots’ option that appears on that line item
4. Select ‘Details’
5. The Properties panel will appear on the right-hand side
6. Click the ‘Apply label’ field and select the appropriate retention label in accordance with the Data Retention Schedule

6. RELATED DOCUMENTS

7. REFERENCES

8. APPENDICES

9. DOCUMENT HISTORY

Appendix 1

Data Retention Schedule

Finance

HR

Marketing & Business Development

Research Participant

Client Operations/Audit and Compliance

Consultancy