Last updated: 2026-08-07

This notice explains how Nomad Apps Ltd, trading as AirNote ("AirNote", "we", "us"), handles personal data when you use the AirNote macOS application, website and related services.

Nomad Apps Ltd is registered in England and Wales under company number 10131056. Our registered office is Pilgrims Nook, Bench Manor Crescent, Chalfont St. Peter, Gerrards Cross, England, SL9 9HL. Contact: support@airnote.health.

1. Our role

For account, subscription, website, security and business-administration data, AirNote normally acts as controller.

If a professional or organisation uses AirNote to handle information about its clients, that customer normally decides why and how the client information is used. The customer is the controller and AirNote acts as processor for client or session content sent through AirNote cloud services. The AirNote Data Processing Agreement applies to that processing.

If you are a client of an AirNote user, contact that professional or organisation first about your records or privacy rights.

2. Information we handle

Depending on the features used, we may handle:

• account and profile information, such as name, email address, sign-in provider, provider account identifier, profile image where supplied, and practitioner type;

• subscription and billing information, such as plan, payment status, invoices and transaction references (payment-card details are handled by Stripe);

• client and session content, such as names or labels, dates, transcripts, notes, context, questions, templates and generated documents;

• calendar information where an optional integration is enabled;

• settings and optional cloud-backup content;

• service and security data, such as request identifiers, app version, Mac hardware model, device or installation identifiers, remote/in-person/dictated usage mode, event timing, error information and diagnostic reports; and

• communications and support correspondence.

Client and session content may include health or mental-health information and other special category data. Users should submit only information they are authorised to process and that is relevant to the feature being used.

AirNote records and transcribes audio on the user's Mac. Audio is intended to remain local and is deleted after successful transcription. Temporary retry audio may be kept on the Mac if transcription is interrupted.

3. How and why we use information

We use personal data to:

• provide requested app features, account access, subscriptions, cloud backup and AI-assisted drafts;

• authenticate users and confirm service entitlement;

• process payments and administer subscriptions;

• maintain, troubleshoot and improve reliability and usability;

• protect users, investigate misuse and respond to security incidents;

• respond to support requests and service communications;

• comply with legal, tax, accounting and regulatory obligations; and

• establish, exercise or defend legal claims.

Where AirNote acts as controller, our lawful bases may include performance of a contract, compliance with a legal obligation, our legitimate interests in operating and protecting the service, and consent where the law requires it. Where we process special category data as controller, we rely on an applicable condition under data-protection law. Customer-controlled clinical content is processed on the customer's documented instructions under the DPA.

AirNote does not sell personal data. We do not use client or session content for advertising or to train general-purpose AI models.

Product usage analytics are limited to metadata such as app/build/OS information, Mac hardware model, remote/in-person/dictated usage mode, event timing and a hashed random installation identifier. During a limited beta, an approved operator can explicitly join that identifier to the available customer profile name for feedback analysis; the name and email address are not added to product event records. Product analytics must not contain client/session clinical content and expire after 90 days by default.

AirNote may also keep private practice totals separately from session content. Users can clear them in Practice Analytics.

4. AI-assisted features

When a user requests a note, document or answer, AirNote sends relevant text and instructions through AirNote's cloud service to an AI provider and returns a draft. Raw audio is not sent for AI generation. Users decide when to request generation and must review outputs before use.

AirNote does not make solely automated decisions that produce legal or similarly significant effects about clients. Generated material is a drafting aid and does not replace professional judgement.

5. Cloud Backup

If Cloud Backup is enabled, AirNote stores an encrypted cloud copy of eligible app records so the user can recover the library. Audio is excluded. The user can turn Cloud Backup off and request deletion of the cloud copy from within the app. Local records and external exports remain under the user's control.

6. Account sign-in and calendar integrations

Account sign-in

AirNote may allow users to sign in using a third-party account, including Apple or Google. When a user chooses Google sign-in, Google may provide AirNote with a Google account identifier and basic profile information, such as the user's name, email address and profile image. AirNote uses this information to create, authenticate, secure and administer the user's AirNote account and to provide support.

Google sign-in does not give AirNote access to the user's Gmail, Google Drive, Google Calendar, contacts or other Google content. Any optional Google Calendar connection is requested and authorised separately. AirNote does not sell sign-in information, use it for advertising, or use it to train general-purpose AI models.

Users can manage AirNote's access through their Google or Apple account settings. The provider also processes information for authentication under its own privacy terms.

Calendar integrations

Apple Calendar, Google Calendar and Outlook Calendar integrations are optional and are used to help users view upcoming appointments and create or match local AirNote sessions. AirNote accesses only the information needed for those functions.

For Google Calendar, AirNote requests read-only access to authorised calendars. Depending on the event, this may include the Google account email, calendar identifiers and names, and event identifiers, titles, dates, times, locations and meeting links. AirNote does not request permission to create, edit or delete Google Calendar events.

Google authorisation credentials are stored on the user's Mac using system-protected storage. Calendar preferences may be stored locally and backed up as part of AirNote settings if Cloud Backup is enabled. Event lists are fetched as needed; AirNote does not route Google Calendar event content through its servers for AI generation unless the user separately includes relevant information in an AirNote request.

AirNote's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google Calendar data is not sold, used for advertising, or used to train general-purpose AI models. It is disclosed only as needed to provide the user-requested integration, comply with law, protect against security threats, or with the user's affirmative agreement.

Users can disconnect Google Calendar in AirNote or revoke access in their Google Account. Disconnecting removes AirNote's locally stored Google authorisation credentials and calendar preferences. Revocation does not delete information a user has independently copied into AirNote records.

The optional Outlook Calendar integration similarly uses the customer's Microsoft authorisation to read selected calendar information. Authorisation credentials are stored on the user's Mac using system-protected storage and can be removed by disconnecting the integration or revoking access through Microsoft. Microsoft processes the request under its own privacy terms.

7. Who receives information

We disclose personal data only as needed to provide and protect the service, comply with law, or complete a business transaction subject to appropriate safeguards. Recipients may include:

• Amazon Web Services, for AirNote cloud hosting and optional backup;

• OpenAI, for user-requested AI generation;

• Stripe, for payments and subscription administration;

• Apple, Google and Microsoft, when users choose their sign-in, platform or calendar services;

• website and communication providers; and

• professional advisers, regulators, law-enforcement bodies or a buyer of the business where disclosure is lawful and necessary.

The current AirNote Subprocessor List provides more information about processors used for customer content.

8. International transfers

Some providers may process personal data outside the United Kingdom or the country in which the user is located. Where required, we use recognised safeguards such as adequacy regulations, standard contractual clauses or the UK International Data Transfer Addendum. Information about relevant safeguards is available on request.

9. Retention

We keep personal data only for as long as reasonably needed for the purposes described above. The AirNote Data Retention Summary describes the principal periods and user controls. The period depends on the type of information, whether the user has deleted it, contractual and legal requirements, security needs and the status of backups.

10. Security

AirNote uses technical and organisational measures appropriate to the risk, including local-first processing, access controls, encryption in transit, protection for cloud-stored data, restricted administration, service monitoring and incident-response procedures. No service can guarantee absolute security. Users are responsible for securing their Mac, account, connected systems and exported files.

11. Your rights

Depending on applicable law, you may have rights to:

• access personal data and receive a copy;

• correct inaccurate or incomplete data;

• request deletion or restriction;

• object to processing based on legitimate interests;

• receive certain data in a portable format;

• withdraw consent, without affecting earlier lawful processing; and

• complain to a supervisory authority.

In the UK, the supervisory authority is the Information Commissioner's Office at ico.org.uk.

To exercise rights concerning an AirNote account or other data we control, contact support@airnote.health. We may need to verify identity and may retain information where an exemption or legal obligation applies. For client records controlled by an AirNote customer, contact that customer first.

12. Children

AirNote is provided to professionals and organisations, not directly to children. Professionals remain responsible for the lawful handling of information about children or other vulnerable people in their care.

13. Changes

We may update this notice to reflect changes to the service, law or our practices. We will update the date above and give additional notice where a change materially affects users' rights or how we use personal data.