5. Backup and data retention

5.1The rule in one paragraph

The backup of the Main Server — the database, the documents and the uploaded files — is the sole responsibility of the practice. Stardent B.V. holds no copy of your data, cannot restore anything and is not liable for loss of data. If the disk of your Main Server fails and you have no backup outside that machine, your records are gone. Nobody else can bring them back.

5.2Why this is so

LatinoSoft keeps everything on hardware you choose. That is a deliberate choice: your patient data does not leave your practice (document 1). The other side of it is that the care for that hardware, and for copies of it, lies with you.

5.3What the software itself does, and does not do

1. The software has its own backup function that writes database backups under %LOCALAPPDATA%\LatinoSoft\backups on the computer it runs on, or into another folder the practice sets under Settings, Backup.
2. The software makes such a backup by itself once every 24 hours: a copy of the practice database as a .sql file in that folder. This automatic backup is on in every new installation and can be switched off on the same page. It is taken by the program's automatic run (document 1, clause 1.8(5)): a minute after a user signs in if a backup is due, and every 30 minutes if the practice installed the scheduled task that comes with the program. It does not depend on Automatic messages being switched on. An Installation whose Licence states the role Workstation does not take it; the Main Server does (document 3, clause 3.2). A user can also make a backup at any moment on the same page.
3. After each automatic backup the software keeps the newest 30 backups it wrote in that folder, or the number the practice sets there (1 to 365), and deletes the older ones. It never deletes a file in that folder that it did not write itself. The backup file is a plain .sql file; the software does not encrypt it (document 1, clause 1.3).
4. That is a convenience, not a backup strategy: by default that folder sits on the same disk as the database — with the bundled database engine even in the same tree, next to %LOCALAPPDATA%\LatinoSoft\data. If the disk fails, database and backup are lost together. If the machine is hit by ransomware, that folder is encrypted with it, and a network folder that stays connected to it can be too.
5. Documents and uploaded files (X-ray images, letters, attachments) are not in that database backup. They sit in the folder the practice uses for them and must be included separately.
6. The practice itself checks that the backups are being made, itself copies them off the machine and itself tests that they can be restored.

5.4How long you must keep data

1. Patient records: for as long as your national record-keeping duty lasts. In the Netherlands that is 20 years after the last change, or longer where good care requires it (art. 7:454 Dutch Civil Code, WGBO). Elsewhere, the rules of your own country apply.
2. Financial records, including invoices and claims: in the Netherlands 7 years (art. 52 General Taxes Act); elsewhere, your national fiscal retention period.
3. For as long as those periods run, the practice must be able to make the data readable. That means: keeping the backups, and keeping a way to open them (a working installation of LatinoSoft or an export in a common format).
4. These duties stay with the practice after the Licence ends too. Arrange an export or a preserved, readable copy before the end (document 3, clause 3.11).

5.5Checklist the practice follows

• What: the MariaDB/MySQL database of the Main Server, the folder with documents and uploaded files, and the backup folder of clause 5.3 (by default %LOCALAPPDATA%\LatinoSoft\backups).
• How often: at least daily, preferably automated, at a time the practice is not working. The daily backup of clause 5.3 covers the database only, and only on days when the program or its scheduled task runs on the Main Server; check under Settings, Backup when the last one was made.
• Where to: at least one copy outside the Main Server (an external disk disconnected after the backup, a NAS, or storage with a party you hold a data processing agreement with, provided the copy is encrypted there). Three copies, two kinds of media, one off the premises.
• Encrypted: the backup media themselves encrypted, because they contain the same as the database.
• Tested: at least every quarter, actually restore a backup on another computer and check that the records open.
• Before an update: make a fresh backup before installing an update that carries a database migration.
• Who: one person in the practice is responsible; a second knows how it works.
• Log: record the date, medium and result of every test.
• When replacing the Main Server: backup first, then move, only then wipe the old machine.
• At the end of the practice or of the Licence: secure a readable copy for the full retention period.

5.6What Stardent B.V. can do

Stardent B.V. can explain by e-mail how the backup function works and how a database backup is restored into a new installation. It cannot supply data it does not have.