Data Retention and Deletion Policy

This Data Retention and Deletion Policy explains how MyBenefitsPA retains, archives, deletes, de-identifies, and disposes of personal information, Financial Data, documents, AI interactions, audit logs, and operational records. It applies to data collected directly from users, obtained through Plaid or similar integrations, uploaded by users or advisors, generated by Platform use, or maintained for security, legal, audit, and compliance purposes.

Retention periods are designed around data minimization, user control, public-benefit monitoring needs, Medicaid look-back considerations, SSI/SSDI income and resource verification, SNAP/MAWD/QMB records, legal defense, security investigations, and privacy-rights obligations. Actual retention may vary where state law, contract, legal hold, business associate agreement, litigation, audit, agency inquiry, user direction, or program-specific requirement applies.

• Collect only data reasonably necessary for the selected service, authorized advisor access, security, legal compliance, and user-requested benefit monitoring.
• Retain data only for the shortest period consistent with user expectations, legal requirements, benefit-program needs, security, dispute resolution, and operational necessity.
• Use encrypted archive, access restriction, cryptographic erasure, token revocation, and lifecycle deletion to reduce risk after active use ends.
• Separate active data from archived data when records no longer need routine access.
• Honor verified deletion requests subject to legal holds, statutory retention, fraud/security needs, dispute records, and other lawful exceptions.

Users may request deletion by contacting support@mybenefitspa.com or using account settings where available. MyBenefitsPA will verify identity and authority before deleting or exporting sensitive information.

When advisor or caregiver authority is revoked, disputed, expired, or terminated, MyBenefitsPA will disable or restrict advisor access after verification. Records of advisor access, invitations, authority documents, data exports, and revocation events may be retained for audit, legal defense, and privacy compliance. Revoking advisor access does not delete the Beneficiary's underlying records unless the Beneficiary or authorized account holder separately requests deletion and no exception applies.

Data subject to litigation, anticipated litigation, subpoena, regulatory investigation, law enforcement request, government audit, security incident, fraud investigation, payment dispute, authority dispute, or other legal hold is preserved until the hold is released. Legal holds supersede routine deletion schedules and user deletion requests to the extent permitted by law.

• Records may also be retained beyond standard periods when required by contract, business associate agreement, tax/accounting duty, audit duty, security incident remediation, or user-requested case preservation.
• MyBenefitsPA will restrict access to held data and preserve only what is reasonably necessary for the hold purpose.
• Users will be notified of legal-hold limits on deletion where legally permitted.

Backups are encrypted, access-controlled, and maintained on a rolling schedule. When active data is deleted, corresponding backup copies expire through normal backup rotation, generally within 90 days unless a legal hold, incident investigation, or disaster-recovery requirement applies. Restored backups are re-subjected to current deletion, access-control, and retention rules.

Users may request a copy of personal information in a portable format where required by law and technically feasible. Export files may include sensitive documents, financial records, benefit records, and advisor-access history. MyBenefitsPA verifies the requester before providing exports and may provide secure download links with expiration and audit logging.

The Chief Privacy Officer or designated privacy owner is responsible for this Policy. The Policy is reviewed at least annually and whenever material changes occur in data flows, laws, integrations, benefit-program coverage, AI processing, vendor relationships, or incident experience. Personnel with access to user data receive training on retention, deletion, legal holds, and secure handling.

Retention and deletion requests, security incidents, and general support: support@mybenefitspa.com.