# Patient rights (/docs/en/trust/patient-rights)



The practice is the controller of its patients' data, so patients send requests to the practice. If a patient contacts Salisan, Salisan forwards the request to the practice. This page shows which tools support each kind of request. Whether a request must be granted is a decision for the practice under the law that applies to it.

## Access and copies [#export]

In the patient's menu, choose **Export record**, or **Export record with access history** to add the list of who accessed the record. Any member who can read that patient's clinical records can start the export.

You are notified when the archive is ready. The download is available for seven days. The archive is a ZIP file:

* Open `START-HERE.html` for a readable copy that works offline and can be printed or saved as a PDF.
* It contains structured data, original attachments and a manifest with a SHA-256 digest for every file.
* Working drafts, chats and notifications are left out.

The export is made for you as the requester. Salisan does not send it to the patient. Share it by the secure method your practice uses.

Owners and admins can export the whole practice under **Organization → Compliance → Exports** with **Export organization data**.

## Correction [#correction]

A member with write access edits the record in the app. The record's **History** keeps the earlier content. Amending a signed note shows the note as edited after signing.

Notes and reports are versioned per editing session. Several edits by one author in the same session can appear as one version.

## Limiting use of a record [#restriction]

Two controls limit how a record is used:

* **Exclude from AI assistance** is on the patient's details. The Agent cannot read or act on the record, uploaded documents are not scanned, and visits cannot be recorded or transcribed. [How the AI works](/docs/en/trust/how-the-ai-works#patient-exclusion) explains the effect.
* **Attest and restrict access** starts a patient erasure request. It restricts access to the record while the request runs.

Patients can stop appointment, form and request emails with the link in each email. The patient record then shows **Stopped by the patient**.

## Erasure [#erasure]

Owners and admins handle erasure under **Organization → Compliance → Erasure**, or with **Patient erasure** in the patient's menu.

1. Find the patient and review the pre-deletion report: the records affected, the retention classes and any legal hold.
2. Record the date the request was received and complete the controller attestation for the practice's country.
3. Choose a grace period of up to 21 days, type the confirmation shown, then choose **Attest and restrict access**.
4. After the grace period, choose **Queue execution**. Download the certificate when it completes.

An active legal hold blocks execution. You can choose **Cancel request** while it is eligible. After the grace period, deletion is permanent.

<CountryCallout country="nl">
  A destruction request under the Dutch WGBO is executed at the end of the grace period.
</CountryCallout>

<CountryCallout country="de">
  Record classes still inside their retention period stay restricted until the date shown as **Restricted until**. The practice can choose automatic deletion when every retention clock has expired.
</CountryCallout>

Execution destroys the patient's Agent chats and derived working data. The certificate records what was checked. Salisan's backups are kept for 35 days. Audit events about the patient, and a minimal record that the erasure happened, are kept for the audit retention period.

## Your own account data [#own-account]

A Salisan user can download their profile, preferences, security metadata and support history under **Settings → Security → Export personal data**. Records created for a practice stay with the practice.