Evidence storage and privacy

Clinical evidence (uploaded treatment notes, photos and documents) is sensitive health information. This guide explains where the plugin keeps evidence files, who can open them, how the built-in storage security check works, how to answer export and erasure requests, what happens when you delete or merge a student’s account, and what is removed when you uninstall.

It is written for site administrators. Students and trainers do not need to configure anything described here.

At a glance

Topic	What the plugin does by default
Where files live	A private folder outside your public website files, on your own server
Who can open a file	The student who uploaded it, administrators, and (with Pro) trainers for students in their cohorts
Security check	Runs automatically about once a day and warns administrators only if the evidence folder can be reached from the web
Export and erasure	Built into Tools → Export Personal Data and Tools → Erase Personal Data
Deleting a student’s account	Lets you move their logbook data to another account, or delete it
Uninstalling	Keeps all clinical data and evidence unless you opt in to deletion; credentials are always removed

Cloud storage (Bunny Storage or Google Drive) is a Pro feature with its own guide: Cloud storage.

How evidence files are protected

Where files are stored

When a student uploads treatment notes on the entry form (see Logging treatments), the file is moved into a private evidence folder called dclb-evidence. The plugin chooses the location in this order:

1. A folder you specify with the DCLB_EVIDENCE_PRIVATE_DIR constant in wp-config.php (see below).
2. One level above your WordPress folder — for example, if WordPress is installed in /home/clinic/public_html, evidence is stored in /home/clinic/dclb-evidence. This is the preferred location because no web server serves files from there.
3. A fallback inside your uploads folder — wp-content/uploads/dclb-evidence — used only when the location above cannot be created or written to on your host. The plugin places deny-access files (.htaccess, web.config and a blank index.php) in the folder, and the storage security check watches it.

Inside the folder, files are grouped by year and month and renamed to a long random name, so a file’s name gives nothing away. Evidence is never added to the WordPress Media Library and never has a public web address.

Files are only accepted if their type is on the Allowed file types list (Plugin Settings → Evidence Defaults) and their content matches the file extension. Files stored on your server are limited to 25 MB or your server’s upload limit, whichever is smaller.

Choosing your own storage folder

If your host gives you a private folder outside the web root, you can point the plugin at it by adding this line to wp-config.php, above the line that says “That’s all, stop editing”:

define( 'DCLB_EVIDENCE_PRIVATE_DIR', '/home/clinic/private/dclb-evidence' );

Use an absolute path that the web server can write to but does not serve to visitors.

Moving an existing store: the plugin finds existing files relative to the evidence folder. If students have already uploaded evidence, copy the contents of the old dclb-evidence folder (keeping the year and month subfolders) into the new folder at the same time as you add the constant, then test that an existing file still opens.

Who can open an evidence file

Every evidence file is opened through a secure link that the plugin creates fresh each time a page is shown. When someone follows the link, the plugin checks, in order, that:

1. the link is genuine and was created for the person using it,
2. the person is logged in, and
3. the person is allowed to see that particular entry.

People who pass the third check:

• The student who owns the entry.
• Administrators (users who can manage site options).

🔒 Pro feature — requires the Pro plugin.

• Trainers — a user with trainer access can open evidence for students in the cohorts they are assigned to. See the Trainer workspace guide for how trainers are assigned.
• Files held in Bunny Storage or Google Drive are fetched by your server and passed through the same secure link, so the browser never sees the cloud storage address.

Anyone else — including a logged-in student trying to open another student’s file — sees “File not found.” The plugin gives the same answer whether the file does not exist or belongs to someone else, so the link cannot be used to discover which entries exist. A visitor who is not logged in cannot open evidence at all.

PDFs and images open in the browser; other types (such as Word documents) download. The plugin tells browsers not to cache evidence files.

Links are tied to the logged-in user and expire after about a day. A copied link will not work for anyone else, and an old link will stop working — reopen the entry to get a fresh one.

When evidence is deleted

• Deleting an entry removes its evidence file from your server.
• Replacing the file on an existing entry removes the previous file from your server.
• An erasure request or deleting a student’s account without attributing their content deletes their entries, and with them their files (see the sections below).

🔒 Pro feature — requires the Pro plugin.

Cloud-stored evidence follows different rules — Google Drive files from deleted entries are removed by a scheduled sweep rather than straight away. See Cloud storage › Cleaning up orphaned files.

Storage security check

The plugin regularly checks that the evidence folder cannot be downloaded from the web.

How the check works

• When an administrator opens any wp-admin page and there is no recent result, the plugin schedules a check to run about 30 seconds later in the background (through WordPress’s scheduled tasks). It never slows down the page you are on.
• If the evidence folder is outside the web root (the default), the check records it as protected without doing anything else — nothing on the web can map to that folder.
• If the plugin is using the uploads fallback, it writes a small test file into the folder and tries to download it from your site’s public address. If the download succeeds, the folder is exposed.
• The result is remembered for 24 hours (one hour if the plugin could not tell what web server you use), after which the check runs again.

The warning notice

If the check finds the folder exposed, administrators see a red notice on every admin page:

Clinical Training Logbook: private evidence storage is publicly accessible. A test file in the private evidence directory was readable over HTTP. Uploaded clinical evidence can be downloaded without authentication until this is fixed.

The notice includes a fix suited to your server:

• Nginx: the notice shows a short configuration block that blocks the /wp-content/uploads/dclb-evidence/ path. Add it to your site’s Nginx configuration and reload Nginx. (Nginx ignores the .htaccess files the plugin creates, which is why this is needed.)
• Other servers: the notice asks you to have your host deny all web access to /wp-content/uploads/dclb-evidence/.

The most complete fix is to move evidence outside the web root using DCLB_EVIDENCE_PRIVATE_DIR (see above).

After you fix the problem, the notice clears when the next check runs (within 24 hours). Only administrators see the notice. Students and trainers are never shown it.

If your site has WordPress’s built-in scheduled tasks turned off (DISABLE_WP_CRON), make sure a server cron job calls wp-cron.php, or the check will not run.

Personal data export and erasure

The plugin connects to WordPress’s own privacy tools, so you handle logbook data the same way as any other personal data on your site.

Exporting a student’s data

1. Go to Tools → Export Personal Data.
2. Enter the student’s email address and send the request (WordPress asks the student to confirm by email unless you choose to skip confirmation).
3. Once confirmed, download or email the export from the same screen.

The export includes a Treatment Records group (from “Clinical Training Logbook — Treatment Records”) with, for each entry, any of the following that have a value: treatment date, client first name, client age, client sex, chronic health, mental health, reflection and treatment notes.

🔒 Pro feature — requires the Pro plugin.

With Pro, the export also includes:

• Review flag reason and Notes-incomplete reason on each treatment record, where a reviewer has flagged the entry (see Evidence review).
• A Cohort & Level Allocations group (from “Clinical Training Logbook Pro — Allocations & Feedback”) listing the level, cohort, action and date of each allocation change.
• A Reflection Feedback group with trainer feedback written on the student’s reflections, and its date.

The export lists the data recorded about each entry. It does not attach the uploaded evidence files themselves. If a student asks for copies of their files, an administrator can open each entry and download them.

Erasing a student’s data

1. Go to Tools → Erase Personal Data.
2. Enter the student’s email address and send the request, then confirm it as WordPress prompts.
3. Click Erase personal data on the confirmed request.

Erasure is immediate and is not affected by the uninstall settings described below. It:

• permanently deletes every logbook entry belonging to that student, including client details, reflections and treatment notes, and
• deletes the student’s evidence files stored on your server.

🔒 Pro feature — requires the Pro plugin.

With Pro, erasure also removes the student’s reflection feedback and cohort and level allocation history.

• Treatment audit log: the log of administrative actions involving the student is kept for record-keeping and accountability. WordPress shows the message “A treatment audit log of administrative actions involving this user has been retained for record-keeping and accountability.” when this applies.
• Google Drive evidence is removed by the scheduled cleanup sweep, which runs twice a day, so files are removed within about 12 hours. If your service account can only move files to Trash, they stay in Google Drive Trash until Google empties it (about 30 days). See Cloud storage › Google Drive.
• Bunny Storage evidence: the scheduled sweep does not currently pick up Bunny files from erased entries. After an erasure, delete the student’s folder in your Bunny storage zone (files are stored under cohort/<cohort number>/student/<user ID>/) from the Bunny dashboard.

Erasure does not delete the student’s WordPress user account. Delete the account separately if required (see the next section).

Privacy policy text

The plugin adds suggested wording to Settings → Privacy → Policy guide describing what it stores, how long it is kept and how it is removed. With Pro, a second section covers allocations, feedback and cloud storage providers. Review and adapt the wording for your organisation before you publish it — it describes what the software does, not your organisation’s legal obligations.

Deleting or merging user accounts

WordPress’s own “delete user” screen only moves posts and pages. The plugin extends it so logbook data is not left behind or silently lost.

What you see

When you delete one or more users at Users → All Users → Delete, and any of them has logbook data, a warning appears inside the confirmation form:

Clinical Training Logbook data is attached to this deletion.

It lists each affected user with a count — for example “Jordan Lee: 42 logbook entries”. With Pro, the count also includes active allocations (for example “2 active allocations”). The note under the list reads: Choose “Attribute all content” to move this logbook data to another user. If you delete all content instead, the logbook data (including evidence files) is permanently deleted.

Option 1 — Attribute all content to another user (merge)

Choose Attribute all content to: and select the account that should keep the data. The plugin moves every logbook entry from the deleted account to the chosen account. Evidence files stay where they are and open normally for the new owner.

🔒 Pro feature — requires the Pro plugin.

Pro also moves the student’s allocations, allocation history, evidence index records and treatment audit log entries to the chosen account. If the surviving account already has an active allocation for the same level, the incoming allocation is moved but set to archived, so the student never ends up with two active allocations for one level. Each move is recorded in the allocation history.

The move is recorded in the Activity Log.

Option 2 — Delete all content

Choose Delete all content. The plugin deletes every logbook entry the user owned, together with their evidence files stored on your server. The deletion is recorded in the Activity Log with the number of entries removed.

🔒 Pro feature — requires the Pro plugin.

Pro also deletes the user’s reflection feedback, allocations and allocation history. The treatment audit log is kept. Google Drive files from the deleted entries are removed by the twice-daily cleanup sweep; Bunny Storage files need to be removed from the Bunny dashboard, as described under erasure above.

Limits

• Only deletions made through WordPress’s normal delete function are detected. This covers the Users screen, most user-merge plugins and WP-CLI’s wp user delete --reassign=. A tool that edits the users table directly in the database is not detected, and its logbook data will be left pointing at a missing user.
• Removing a user from a multisite network (network-level deletion) is not handled. The plugin is designed for single-site installs.
• Choosing an account to attribute content to that is the same account being deleted does nothing to the logbook data.

What happens on uninstall

By default all clinical data and evidence are kept when you delete the plugin, so reinstalling restores everything. Deleting data is an opt-in, irreversible choice, and the options only take effect when you actually delete the plugin from Plugins → Installed Plugins — not when you deactivate it.

The settings

Plugin Settings → Site Setup → Data management → On uninstall (Free):

Setting	Default	What it removes when the plugin is deleted
Delete this plugin’s data — its database tables and settings — when it is uninstalled	Off	All logbook tables (entries, levels, clinic types, catalogue, requirements, Activity Log) and the plugin’s settings
Also delete all uploaded evidence files when the plugin is uninstalled	Off	The entire private evidence folder (wherever it is stored) and any older evidence that was kept in the Media Library

The two settings are independent. You can delete data but keep the evidence files, or the reverse.

🔒 Pro feature — requires the Pro plugin.

Plugin Settings → Licensing → Data management → Delete data on uninstall (Pro), default Off: “On uninstall, permanently delete all Pro tables and settings.” When Pro is deleted with data removal on, it:

1. tries to delete every evidence file held in Bunny Storage and Google Drive (best effort — if a provider cannot be reached, the uninstall still completes), then
2. removes Pro’s tables — cohort profiles, allocations, allocation history, attachments, the treatment audit log, reflection feedback and the evidence index — and Pro’s settings.

Pro also treats the Free Delete this plugin’s data setting as a request to remove Pro data. If either setting is on when Pro is deleted, Pro’s data is removed.

Whatever the settings, deleting Pro always removes the licence key, cached Google Drive sign-in tokens, the Bunny and Google Drive credentials, the Drive folder cache, and Pro’s scheduled tasks.

Always removed

Whatever you choose, deleting the free plugin always removes stored cloud storage credentials (the Bunny API key and token key, and the Google service-account key) and the encryption key that protects them. These are access credentials, not clinical records, so they are never left on a decommissioned site.

Recommended order for a full removal

If you want to remove everything from a site that runs both plugins:

1. Turn on the data-management options you want on Site Setup and, with Pro, on Licensing. Save each tab.
2. Deactivate and delete Pro first, while its cloud storage credentials are still available to delete cloud files.
3. Then deactivate and delete the free plugin.

If you keep credentials in wp-config.php constants (see Cloud storage), remove those lines from wp-config.php afterwards — the plugin cannot edit that file.

Worked example

Riverside College runs the logbook for 60 acupuncture students on a shared host with Nginx.

1. After installing, the administrator sees the red private evidence storage is publicly accessible notice the next day. The host does not allow a folder above the web root, so the plugin used the uploads fallback.
2. The host’s support team adds the location block from the notice to the Nginx configuration. The next day’s check finds the folder protected and the notice disappears.
3. A student who left the course asks for their data. The administrator uses Tools → Export Personal Data, sends the export, then runs Tools → Erase Personal Data. All 38 of the student’s entries and their evidence files are deleted.
4. A different student registered twice by mistake. The administrator deletes the duplicate account at Users → All Users, sees “Sam Chen: 4 logbook entries”, chooses Attribute all content to: the student’s main account, and confirms. The four entries now appear on the main account’s overview.

Troubleshooting

“File not found.” when opening evidence. The person may not be the owner, an administrator or (with Pro) an assigned trainer — the plugin deliberately shows the same message as for a missing file. Otherwise the file may have been removed from disk, or the storage folder changed: if you recently added DCLB_EVIDENCE_PRIVATE_DIR, move the old folder’s contents into the new location.

“Invalid request.” when opening evidence. The secure link has expired or was created for a different user. Reload the page or reopen the entry.

“Private storage is not available on this installation.” The plugin could not create or write to any evidence folder. Check the permissions on the folder above your WordPress folder, or on wp-content/uploads, or set DCLB_EVIDENCE_PRIVATE_DIR to a writable folder.

The security notice keeps coming back. The fallback folder is still reachable. Confirm the server rule was applied and the web server reloaded. The notice can take up to 24 hours to clear after a fix.

More problems and fixes are in Troubleshooting. Roles are explained in User roles and permissions.