GRiN Finance Data Retention & Deletion Policy
Effective October 8, 2026
Scope
This policy covers the data in GRiN Finance, the internal finance tool of GRiN Pediatric Dentistry & Orthodontics, including the business bank (PNC) and business credit card (Chase) data we receive through Plaid. What we collect and who can see it is described in our Privacy Policy.
The rule
- We keep bank and card records for up to 7 years, for tax and accounting purposes.
- When a bank or card connection is removed, we immediately revoke it at Plaid and delete its access token and the transactions received through it.
- An owner can ask for earlier deletion at any time; we carry it out within 30 days unless the law requires us to keep a record.
- We review this policy at least once a year.
What we keep, where, and for how long
| Data | Kept | How it is deleted |
|---|---|---|
| Plaid access token (AWS Secrets Manager, encrypted) | While the connection exists | Revoked at Plaid and deleted when the connection is removed |
| Connection record: bank name, account names, last 4 digits | While the connection exists | Deleted when the connection is removed |
| Bank and card transactions received through Plaid | Up to 7 years | Deleted when the connection is removed; otherwise deleted at the annual review once older than 7 years |
| Accounting records: practice deposit totals, deposit matches, exceptions and notes, budget categorizations and approvals | Up to 7 years | Deleted at the annual review once older than 7 years, or sooner on request |
| Audit log of who did what and when (for connections: bank name, last 4 digits and record counts) | Up to 7 years | Deleted at the annual review once older than 7 years |
| Uploaded daily-totals files (no patient data) | 7 years | Deleted automatically by a storage rule after 7 years |
| Server logs | 90 days | Deleted automatically |
| Encrypted database backups (point-in-time recovery) | 35 days, rolling | Expire automatically, so deleted database records are gone from backups within 35 days |
How deletion works
- Removing a connection: an owner clicks Remove on the GRiN Finance Setup page and confirms. The system asks Plaid to remove the connection (which ends our access), deletes the access token, deletes every transaction received through that connection and deletes the connection record. An audit entry records who removed it and when. Accounting records listed above that were built from those transactions follow the 7-year rule unless an owner asks for them to be deleted too. Because the token is revoked at Plaid first, any earlier copy left in the secret store's version history can no longer be used.
- 7-year cleanup: at each annual review we run our documented cleanup procedure, which deletes records whose date is more than 7 years old. This step is run by hand, not on an automatic schedule.
- Requests: email admin@grinpediatricdentistry.com.
Annual review
At least once a year, and whenever the system or the law changes, a GRiN owner:
- confirms each bank and card connection is still needed and removes any that are not;
- checks who has access (owner, manager and lead-assistant roles, and whether budget access is on);
- runs the 7-year cleanup and checks the automatic storage, log and backup limits above;
- updates this page and its review dates.
Legal basis
This policy is designed to meet the U.S. federal and Colorado privacy and record-keeping requirements that apply to us. Seven years covers the usual IRS record-keeping periods for business records (3 to 7 years). Plaid's own handling of data is covered by the Plaid End User Privacy Policy.