Retention policy is rental_end

The clinical trial runs fourteen weeks. The protocol says the raw data exists for the trial and not after.

You rent a box for ninety days, in the country the ethics board specified, and the trial's containers live on it. Nothing auto-renews. When rental_end passes, the server enters a short hold, the platform raises one notification, and then the machine is deprovisioned and its data deleted, unrecoverably. The docs describe that sequence as the thing to avoid. For this workload it's the point.

Before the hold runs out, the anonymized results get copied to the long-term box with one POST. The raw set stays behind and goes down with the rental. No backup vendor kept a copy, because the snapshots lived on the same disk that's being wiped.

The retention schedule is written in the one place it can't be forgotten: the rental's end date.