GDPR Compliance and AI Notes

Privacy should not become another piece of clinical administration.

AI scribes process deeply sensitive information. GDPR therefore requires a lawful purpose, additional protection for health data, clear client information, data minimisation, appropriate security, controlled retention, processor agreements, rights support and—where risk is high—a Data Protection Impact Assessment.

AirNote is designed to turn those obligations into a guided workflow.

During setup, AirNote helps the practice document its legal grounds, configure retention and generate tailored privacy and DPIA records. Its Data Processing Agreement, subprocessor safeguards and international-transfer documentation are built into the service.

Before recording, AirNote provides documentation to assist the therapist in procuring client consent easily.

AirNote then goes further technically. Audio is transcribed locally and never sent to cloud providers. It is deleted automatically after successful transcription. Only the relevant text required for a defined AI task leaves the Mac, using a controlled environment configured for Zero Data Retention.

Clinical records can remain local-first. Retention is automated, Cloud Backup excludes raw audio, and Data Access Requests guide the practitioner through reviewing, exporting or deleting the appropriate information.

Every generated note remains a draft requiring clinical approval.

The result is not merely a compliant AI provider, but a product that makes good information governance feel like part of ordinary clinical practice.