According to the Non-Disclosure/Confidentiality Agreement, you must destroy or return all third-party data, as well as any copies made, within 1 year of publishing any work or 3 years after receiving record-level data (whichever comes first). CIHI does not require aggregate data to be returned.