Deleting your account and all data

Deletion is irreversible. Once your data is gone, we cannot recover it — not from a backup, not from an archive, not from support. If your clinical records retention period hasn't expired (typically 7–10 years depending on your state and client age), export first.

Go to Settings → Privacy → Export data and tap Generate full export. You'll receive a ZIP containing: a JSON file with every session, transcript, and note; a PDF of each finalized progress note; your signed BAA; and a copy of your audit log. The export is encrypted with a password you set during the request.

In Conjoin, go to Settings → Privacy → Delete account. Read the confirmation screen — it summarizes what will be erased and what will be retained (see below). Tap Continue. We'll send a six-digit confirmation code to your email. Enter it, then tap Delete permanently.

From that moment, your account is locked. You cannot sign in, and any active sessions on other devices are terminated immediately. The deletion job then runs through the following cascade.

• Immediately: all transcripts, generated notes, session metadata, client pseudonym records, and integration tokens are marked for deletion and hidden from every API response.
• Within 24 hours: rows are purged from the primary database. Derived indexes and caches are cleared.
• Within 7 days: soft-deleted rows are hard-deleted from database replicas.
• Within 30 days: encrypted backups that contained your data are rotated out of storage. After 30 days no backup anywhere in our infrastructure contains your data.

You'll receive a deletion certificate by email once the 30-day cascade completes, signed and dated, that you can keep for your records.

A small amount of metadata is retained after account deletion because the law requires it:

• Audit log of access events (not content): retained for six years per HIPAA § 164.530(j). This records who accessed what and when — not the underlying clinical content, which is gone.
• Billing and tax records: retained for seven years per IRS requirements. This is invoice-level data (amount, date, your practice name) — no client data.
• A hash of your email address: used only to prevent an accidental re-signup of a deleted account. The plaintext address is gone.

If you want to delete one session rather than your entire account, open the session from the Sessions tab, tap the overflow menu, and choose Delete session. This removes the transcript and note immediately and is subject to the same 30-day backup cascade. Your account and all other sessions remain intact.

There is a 24-hour grace period after you initiate deletion. During that window you can email support@conjoin.app from the same email on file and ask us to cancel the deletion. After 24 hours, hard deletion begins and the data is unrecoverable.

• Why session audio is never stored
• Exporting notes to PDF
• Installing Conjoin on iPhone