Short answer: treat a healthtech account shutdown as two explicit, auditable state transitions: first make the profile ineligible for authentication, then revoke every session tied to that user, while retaining only the relationship data your security and privacy policies require.
The bill for this workflow isn't mainly the two API calls. It is the cost of retaining searchable user-to-session relationships, checking state during authentication, writing audit evidence, and operating the retry path when a request is interrupted. Before selecting a provider, estimate that dominant term as active sessions x relationship-retention time, then add the request volume generated by verification, refresh, and revocation. If nobody can supply those inputs, a vendor price table gives false precision.
For a GDPR deletion request, the security goal is immediate loss of access; the privacy goal is deletion according to policy; and the product goal is avoiding needless sign-ins for unaffected patients. Those goals pull in different directions. The useful design boundary is one user, not one browser: a current-device logout is a local action, while an account shutdown must invalidate the renewal path across every device.
