Bulk anonymization permanently removes the personal data of inactive clients, for GDPR right-to-erasure requests and data retention rules. It handles many clients in one run instead of one client at a time. The feature is being introduced gradually, and GDPR & data retention appears in Settings once it is enabled for your organization.
Note: Anonymization cannot be undone. Once a run finishes, the removed personal data is gone permanently. Read this article fully before you run a bulk anonymization for the first time.
Permissions for Bulk Anonymization
Bulk anonymization requires specific user permissions. By default, these are set up only for the 'Administrator' permission group.
Three permissions control who can view and run an anonymization:
Settings page: Read — required to open Settings. Without it, none of the settings below are reachable.
Organization settings: Read — required to open GDPR & data retention. Write — required to change the retention periods and the anonymization settings.
Delete client: Write — required to start an anonymization run.
Note: By default, the 'Manager' permission group does not have Delete client write access. A manager can therefore open and change the anonymization settings, but cannot start a run.
For more information, see View and Manage User Permissions.
Set the Retention Periods
The retention periods set the minimum time data must be kept for compliance. Vetera checks these periods before it allows any client to be anonymized or deleted.
To open the settings, select the clinic location name in the top left, then go to Settings > Organization > GDPR & data retention. The page opens on Data retention settings, which holds three periods:
Consultation data retention period: How long consultation data is kept before it becomes eligible for anonymization.
Invoice data retention period: How long invoice data is kept before it becomes eligible for anonymization.
Revision log data retention period: How long revision log data is kept. Vetera deletes revision log entries older than this period automatically.
Each period can be set in months or years.
Select Delete attachments connected to client and patient if attachments must be removed along with the client's other personal data. Attachments can contain personal data. The checkbox is not selected by default.
When you change a period or the checkbox, Save and Discard changes appear at the bottom of the page. The change takes effect when you select Save.
Client Eligibility for Anonymization
A client is anonymized only when it matches both the retention criteria and the inactivity criteria. The retention periods are set in Data retention settings. Two further periods, set in the Bulk anonymization view, control the inactivity side:
Retention period for inactive clients: How long an inactive client is kept before it becomes eligible for anonymization.
New client inactivity period: How long a new client with no activity is kept before it becomes eligible for anonymization.
Vetera also skips some clients automatically, regardless of the periods you set. A run always skips a client in the following situations:
the client has an active consultation
the client has an unbalanced financial record, in either direction
the client has an upcoming appointment
You can also leave whole patient types out of a run, so that clients with an equine patient are never anonymized, for example. Patient types are excluded in the Bulk anonymization view, as part of setting up the run.
Preview and Run a Bulk Anonymization
Select Bulk anonymization in the top right of Data retention settings to open the run settings. The view lists what a run anonymizes and what it preserves, holds the two inactivity periods and the patient-type exclusions, and carries the control that starts the run. The number of client records a run affects is shown in the confirmation dialog, not on this page.
Note: You cannot start a run if "Delete client" action only available in home clinic location is enabled in Settings > Organization. Starting a run returns the message 'Bulk anonymisation is unavailable while client deletion is restricted to a home department.'
To run a bulk anonymization:
Go to Settings > Organization > GDPR & data retention.
Select Bulk anonymization.
Set Retention period for inactive clients and New client inactivity period. Each can be set in months or years.
To leave whole patient types out of the run, select Exclude clients by patient type and choose the patient types from the drop-down list: Small animal, Farm/production, Equine, or Exotic/other. You can select more than one. Clients with a patient of a selected type are not anonymized.
Select Run anonymization. The Confirmation required dialog opens and states how many client records the run anonymizes. This is your last chance to check the number before anything is removed.
Type the confirmation word exactly as the dialog shows it. The entry is case-sensitive.
Select Confirm and anonymize.
The run starts in the background. While it runs, the footer shows 'An anonymization run is in progress for this organization.' and Run anonymization is unavailable, so you cannot start a second run at the same time. When the run finishes, the view shows Last anonymization done on with the date of the run.
To close the dialog without anonymizing anything, select Cancel.
To leave the view without running anything, select Back.
Data Removed and Data Kept
Anonymization removes:
client names and contact details
addresses and identification numbers
payment and billing information
notes containing personal data
reminders and revision logs
all client and patient attachments, but only if Delete attachments connected to client and patient is selected in Data retention settings
Anonymization keeps:
anonymized transaction records
aggregate statistics
non-personal medical data
audit trail references
Check the Anonymization Log
Select View log in the Bulk anonymization view to open the Bulk anonymization log. The log holds one row per run, recording:
the date and the user who performed the run
the Retention period for inactive clients and New client inactivity period that were in force
the patient types excluded
how many clients were anonymized, and how many were skipped
The log does not list the individual clients a run affected. If you need a record of which clients were removed, produce it before you run the anonymization.
Select Close to leave the log.
Anonymized Clients in Reporting
Anonymized clients still appear in your reports, shown as Anonymised alongside your real client figures.
A first run usually covers a large number of clients, so expect a visible change on your dashboards the following day. Your reporting figures are not lost. The transactions remain, without the personal data attached.