Data and compliance

Set the practice sign-in policy, read the audit log, export data, check retention, and handle patient erasure or practice closure.

Organization → Compliance (under Manage in the sidebar) has five tabs: Audit, Exports, Erasure, Retention and Offboarding. You see it if your role has the View audit history permission, which Owner and Admin have. Each section below names who can act.

Only the owner can do this, under Settings → Two-factor and Settings → Single sign-on.

Require two-factor makes every member use an authenticator app. Check Member enrolment first. The confirmation says how many members have not set one up, and they cannot sign in until they do. Passkeys do not satisfy the requirement.

Single sign-on needs the Enterprise plan. Choose Microsoft Entra ID or Other OpenID Connect, enter your provider's details, add the Redirect URI there, and verify your domain with the TXT record and Check domain. Then choose Test sign-in, which must succeed before you can enforce SSO. Members still need an invitation to their exact email address.

Require SSO for clinic members blocks local sign-in and ends members' local sessions. Your owner account keeps local sign-in for recovery, so it needs two-factor and a password or passkey first.

Either requirement can lock members out until they set up, so check enrolment and your own recovery access before you switch it on. Personal sign-in settings are in Account and security.

Read the audit log

Open Compliance → Audit. It shows who signed in, who opened which record, and what was allowed or refused. Filter by Action family (Org admin, Organization changes, Patient access, Patient write), actor, From and To. Open a row for Event details, including the fields that changed.

For one patient, open the menu in the patient bar and choose Access log. To see what a record used to say, use the record's own history.

Export data

Open Compliance → Exports. Owners and Admins can choose Export organization data. It creates a complete archive. Its status moves from Preparing your archive to Ready to download, or Export failed. Choose View export to download it. Exports stay in the list for seven days, and Expires shows when each one ends.

Extract the ZIP and open START-HERE.html. An archive contains confidential records and is available only to the person who requested it, so share it only through your approved secure method.

A patient's own record is exported from the patient bar with Export record, by people who may open that record.

Check retention

Open Compliance → Retention. Each row shows a record class, its period and legal source, and when the period starts: From end of treatment, From last modification or Based on patient age. The rows are set per country and read-only.

These are the rules the erasure preview applies. Agent chat and recording retention is separate and does not shorten them. See Agent settings.

Erase a patient

Needs the Owner or Admin role, and two-factor sign-in if the practice requires it.

Open Compliance → Erasure, or choose Patient erasure in the patient bar menu. Enter the Patient ID and choose Load patient.
Read the Pre-deletion report: records per data area, and Retention classes with their dates.
An active legal hold blocks erasure. Create legal hold with a reason, or Release legal hold when it ends.
Choose Create erasure draft with the date the request was received. The request type is Privacy erasure, or WGBO destruction in the Netherlands.
Under Controller attestation, tick every statement. Set the Grace period (days), from 0 to 21. Type DELETE and choose Attest and restrict access.
During the grace period, Cancel request restores access.
When the grace period and any retention period have passed, choose Queue execution and type DELETE. Download the certificate when the status is completed.

Attesting restricts the patient at once and removes them from Insights figures. With no retention period, such as WGBO destruction, execution starts when the grace period ends. Otherwise the record stays restricted until the period ends. It then runs by itself only if you ticked the automatic purge box, or you queue it.

Execution permanently deletes the patient's chats, working data and records. It cannot be undone. A legal hold always blocks it.

Close the practice

Only the owner can use Compliance → Offboarding. Choose Start organization offboarding and check the counts of patients, members, files, legal holds and subscriptions. Create an organization export and let it finish, or tick the waiver. Tick every attestation, type DELETE and choose Confirm and start 30-day grace period.

During the grace period you can choose Cancel offboarding. Download the deletion certificate when the request completes.

When the grace period ends, Salisan permanently deletes the organization and its medical records. This cannot be undone.