Practice archive

Settings → Practice archive produces the whole record of the practice for a closure or a change of software: every table as JSON Lines parts, an index listing every part and every original document with its size and SHA-256 digest, a manifest that names the index, and a validation report that recounts every table after the export. Owners and anyone allowed to export data can request, download and acknowledge an archive.

Request an archive

Click Request archive. Smileline produces the archive in the background in short steps, each writing a few parts to the practice's clinical storage, and it usually finishes within a few minutes. You can close the page: closing it does not pause the archive. While the page is open it shows the progress as the number of tables checked out of the total, and it also drives the steps, which makes the archive a little faster. One archive is produced at a time. Earlier completed archives stay listed and downloadable in full.

If a step fails, the page shows when it failed and the archive retries on its own a few minutes later, from where it stopped. To stop an archive that cannot finish, for example because the practice has no location yet, click Cancel on it. The cancelled archive stays listed, and you can then request a new one.

When a patient is erased during an archive

An archive never holds a half-erased patient. While a patient erasure is running, the archive waits before writing its next part; an erasure that is waiting, for a call or the phone provider say, does not hold it back. If an erasure still changes the practice's data while the archive is being produced, the archive stops as Superseded, with the note Restarted because a patient erasure progressed while it was being produced. Smileline then requests a fresh archive straight away, on behalf of whoever asked for the first. Each erasure makes only so many changes, so the restarts end.

Archives completed before an erasure are kept as they are: they are the practice's record, and they still include the erased patient. The erase dialog lists them among the copies made before the erasure.

Parts are sized by bytes, not by rows: a part closes at 8 MiB, and a single row wider than that — a long clinical note, say — makes a part of its own. No table, note or number of parts is too large for an archive to finish.

Download

Click Download archive on a completed archive to take the whole of it out: the manifest, the index, every table part and every original document. In Chrome, Edge, Arc and Brave you pick a folder, and the archive is saved into a practice-archive-<generation> folder inside it: manifest.json, index/, tables/<table>/<part>.jsonl and documents/<id>.<type>. The card counts the files as they arrive. If the download stops, click Download archive again and pick the same folder: files already saved at their full size are kept, and it carries on from there.

Safari and Firefox cannot write into a folder, so there each file downloads on its own, one after another, named practice-archive-<generation>-…. The browser may ask once whether the site can download several files.

To take a single file, use Manifest and validation report, an Index file, or open Parts to read the index: every table part with its row count, size and digest, then every original document of the practice — radiographs, consents, letters, invoices and the rest — with its id, type, size, owner and digest, each with its own Download. Every file is fetched through a one-minute signed link, and every download is written to the activity log.

The manifest (format: smileline-practice-archive/2) names the practice, the generation, the cut-off time, every table with its row and part counts, the index files with their digests, and the total number and size of original documents. It also lists the tables it leaves out under omitted: platform machinery such as delivery lanes, work leases, budgets and payment-provider receipts, which the practice's own role cannot read, and the archive's own bookkeeping. Each index file and each part is one JSON object per line; parts use the database's own column names. A reader verifies an archive from the outside in: the manifest's digest, then each index file against the manifest, then each part and each original against the index.

The validation report lists for each table the rows exported and the rows live when the archive closed, flags any table that moved in between, and records the practice's lifecycle when the archive was requested and when it completed.

Kept records in archives

When an erasure keeps a patient's clinical or payment records under a restricted identity, every archive includes those records together with the restricted identity they belong to, so the record still says whose they are once it has left Smileline.

Besides the owner's Download kept record, archives are the only way to reach a kept record. Unlike that download, they are open to everyone who can export data: owners, managers and agency staff. Every archive request and download is recorded.

Acknowledge

Acknowledge as received is offered only for the closure record: an archive whose every table recounted complete, requested and completed while the practice was in its closing period — when the app refuses new writes, so nothing can change underneath it. An archive produced while the practice was still active, or during which a table changed, stays a downloadable snapshot and says so; request a new one once the practice is closing. The acknowledgement records who confirmed receipt and when; it is the practice's evidence that the record left in full.

When the practice starts closing — the owner closes it, or Stripe reports the subscription cancelled or unpaid — Smileline requests the closure record straight away, and an archive still being produced at that moment stops as Superseded. You don't need to request it, but someone has to acknowledge it: the practice's data is never purged until an archive of the current closing has been acknowledged. If the closing deadline passes first, the practice stays in its closing period, with nothing deleted, until one is. See Payment retries, pauses and closure.

Work arriving from a connected system while the practice is closing — a change from the practice software, a remittance or an acknowledgement from the insurance clearinghouse — waits in the review queue instead of posting, and posts by itself if the practice is reopened.

After closure

When the closing period ends and the practice moves to purging, every clinical document it still holds — patient files, staff records, account statements, the archives themselves, and documents already deleted — enters custody. A document in custody keeps its own retention date and the identity of its owner (the patient's name, date of birth and chart number, the account or staff member's name), so the practice's other records can be purged around it. The acknowledged archive's generation is stamped on every document at that moment: it records which archive the practice closed under.

Custody is not a copy of the archive. A document is deleted only after its own retention date, with no legal hold on it and with both its copies verified, and a legal hold on a patient keeps matching that patient's documents after the patient's own record is gone.

Custody ends when the last document has been deleted. Each document in custody is deleted only under a disposition reference from counsel, recorded by Smileline on the practice's behalf once its retention date has passed; the documents are then removed from both the primary and the backup copy. When none remains, Smileline writes a permanent record of the closure — when custody began and ended, how many documents it held, the archive generations the practice acknowledged, the reference, and a digest of every deletion and copy record — and removes the practice entirely. That record is what an enquiry about the closed practice can be answered from. A practice that holds no clinical file at all finishes custody on its own, with a count of nought and no disposition reference: there was nothing to dispose of.