1. Why retention matters
Personal data should be kept only as long as it serves a legitimate purpose. Practicks retains data along two dimensions: (a) how long the underlying service needs it, and (b) how long applicable law requires it to be kept (e.g. audit-log retention for security investigations).
2. Retention by data category
2.1 Account data
Kept while your account is active. The account data itself is the short list in the privacy policy — name, email address and country. For institutional accounts, your training institution's administrator controls account lifecycle (provisioning, deactivation, deletion). When an account is deactivated, login is disabled but the historical record (attempts, reports) remains available to the institution for their own retention window. When deleted, see Section 3.
2.2 Attempt and assessment data
Attempts, answers, scores, time per question, and derived reports are retained as long as the institution's subscription is active. After the subscription ends, attempt data is kept for an additional 90 days to permit re-activation, then archived. Self-service accounts retain attempt data for as long as the account remains active.
2.3 Proctoring photos and telemetry
Webcam photos captured during opted-in proctored attempts are retained for 180 daysfrom the date of the attempt, then automatically deleted. Browser-side telemetry observations (no images, only signals) follow the same window. The shorter window reflects the sensitivity of the data and the operational need (your institution's staff should be able to revisit a contested attempt within a reasonable period).
2.4 Institution-authored content
Questions and assessments your faculty author, and the feedback they leave on an attempt, are retained while the institution's subscription is active and for 30 days thereafter. Faculty can delete their own content at any time; org admins can delete on their behalf. Cohort Notes— the images, PDFs and videos a cohort's trainers share with that cohort — are institution content on the same terms; deleting a note removes its file, not just the listing. Practicks publishes no study material of its own.
2.5 Audit logs
Security-relevant events (sign-in, password change, role change, sharing and deletion of content) are retained for 1 year to support security investigations and compliance audits. Audit logs are retained for this period even after an account is deleted, as required by the IT Act for incident traceability.
2.6 Database backups
Automated database backups are retained for 30 days on a rolling window. Deleted personal data may persist in backups for up to the backup window but is not used to restore an individual record; backups are used only for disaster-recovery of the platform as a whole.
2.7 Anonymised / aggregated data
Statistical aggregates (e.g. "average accuracy on the Generics chapter of the Java skill") that cannot reasonably be re-identified to a single user may be retained indefinitely for service improvement and research.
3. Deletion requests
There are two ways your data gets deleted, and they produce different results. Which one applies is stated below rather than left to be inferred, because the difference is the whole answer to “is it gone?”
3.1 Deleting your own account, yourself
Every signed-in account except Practicks' own platform staff can delete itself, from Settings → Delete my account. You do not need to ask anyone, and you do not need to give a reason.
Before you confirm, the screen shows you a download of everything we hold about you and a list of exactly what is about to be removed. Take the download first: once the account is gone we cannot produce it for you, and we cannot recover any of it on your behalf.
The deletion happens immediately, not within a window. What is removed is your account, your attempts and answers, what you have practised and mastered, your review history, and any proctoring images taken during a supervised sitting.
What does not disappear, and why. Some records are about other people as well as you — an audit entry showing what an administrator did, a group practice session other learners took part in, a question you wrote for an institution. Those records stay and your name is removed from them. Deleting them outright would delete other people's data along with yours, which is not something your request can authorise.
If you administer an institution and you are its only administrator, we will ask you to give someone else that role first, or to ask us to remove the whole institution. That is not a refusal of your request: it is so that everyone else at the institution is not left with nobody who can manage their data.
3.2 Asking us, or your institution, to do it
- Institutional users: contact your institution's administrator. They can action it themselves for anyone in their own organisation, without waiting on us. You can also contact us directly using the details on the Contact page.
- Self-service users: contact us using the details on the Contact page.
- A whole institution: an institution can ask us to remove its entire account. That deletes every person in it along with their practice history, and everything the institution authored. Only Practicks can carry this one out — an institution's own administrator cannot delete the institution, because it would remove every colleague's and learner's data at once and nobody there could undo it.
We act on a verified request within 30 days, and every deletion we carry out is recorded — who asked, when, what was removed and why — so it can be accounted for afterwards.
3.3 Anonymisation, where records have to stay countable
An institution can instead ask for an account to be anonymised: the personal details are erased and the attempt history stays, attached to an account that no longer identifies anybody. Institutions use this where their own obligations mean a cohort's results have to remain complete. It is a different outcome from deletion, and we will tell you which one has been applied.
When an institution is removed, content it receivedfrom the Practicks catalogue or from another organisation goes with it — its copies are its own records. What does not go is the originalthose copies were made from, and any copy another organisation holds: those belong to whoever holds them, and one organisation's deletion request cannot reach another's work.
3.4 What survives either route
- Audit log entries are retained as described in Section 2.5, with the user identifier removed.
- Residual data in database backups expires per the 30-day rolling window in Section 2.6. We do not reach into backups to remove individual records; they age out.
4. Exceptions
We may retain specific data beyond the windows above where retention is required by law (e.g. a pending legal hold), required to defend a legal claim, or required by your institution's subscription terms (e.g. regulatory audit retention for a regulated training institute).
5. Changes to this policy
Material changes to retention windows are reflected in the "Last updated" date at the top and signalled to active users. For questions, contact us using the details on the Contact page.