Add data retention and export policy doc for hackathon-to-pilot transition

[inteee]

Description

A healthcare-adjacent MVP should state how data is retained, exported, and handled, even if implementation remains simple.

Scope

• Document retention assumptions for audit logs, notes, and uploads
• Define manual export and deletion limitations
• Add operator notes for demo vs pilot environments
• Keep content practical, not legal boilerplate

Acceptance Criteria

• Repository contains an operator-facing data policy note
• Retention limitations are explicit
• Data export paths referenced in docs are current

Dependencies

Blocked by #207

Stack

Docs / Next.js / Express