Patient and citizen data privacy policy

Aire Innovate Limited (‘we’ ‘us’) is a privately owned company and not part of any other group of companies.

Our privacy policy pertains only to Aire Innovate Limited and explains what we do with personal information we process or collect about you when you use one of our products.

We operate a range of products under a range of titles. These include but are not limited to forms4health, AireForms, AireSuite, AireConsult and AireFrame.

Please email compliance@aireinnovate.com for more information on the solution used to manage your data or the full functionality of our products. 

There are laws allowing us to collect and keep personal information to:

• meet our contractual obligations
• provide products to you
• protect our systems
• detect and prevent fraud

The law also gives you certain rights relating to the information we collect and use. See this guidance (UK residents) or this guidance (US residents) for more information.

We provide IT Solutions to customers. Our customers will have their own privacy policies in relation to their use of your data, which should be read alongside this policy.

For the purpose of the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Data Protection Act 1998 2018 (the Act), our customers are the 'data controller' as they determine the purposes of 'why' and 'how' your personal data should be processed. We are the 'data processor' as your personal data will pass through or be stored in our systems.

As the data processor we adhere to the following principles:

• Unless the law requires it, the controller’s documented instructions are the only instructions the processor must act on.
• The processor must ensure that the people processing the data are subject to a duty of confidentiality.
• Appropriate measures need to be taken to ensure the security of the processing.
• Under a written contract, the processor must only engage a sub-processor with the controller’s prior approval.
• Appropriate measures must be taken to help the controller respond to requests from individuals to exercise their rights.
• The data controller needs the help of the processor in meeting its obligations concerning security of processing, declaration of personal data breaches and data protection impact assessments.
• At the end of the contract, the processor must return all personal data to the controller. If the law requires it, the processor must also destroy existing personal data unless stated explicitly that data needs to be held in storage.
• The processor is required to submit audits and inspections. The processor needs to give the controller all the information to ensure they meet their obligations in line with their GDPR Article 28 obligations.

If you have any questions about how Aire Innovate uses your information please email compliance@aireinnovate.com.

Why we use your personal information

We process your personal information for the purposes set out in this privacy notice. We have also set out some legal reasons why we may process your personal information (these depend on what category of personal information we are processing).

We normally process standard personal information if this is necessary to provide the services set out in a contract, it is in our or a third party’s legitimate interests or it is required or allowed by any law that applies.

Please see below for more information about this and the reasons why we may need to process special category information. By law, we must have a lawful reason for processing your personal information.

We process standard personal information about you if this is:

• necessary to provide the services set out in a contract
• in our or a third party’s legitimate interests, or
• required or allowed by law.

We process special category information about you because:

• it is necessary to provide a medical diagnosis, to provide health or social care or treatment, or to manage health-care or social-care systems
  
• it is necessary for reasons of public interest in the area of public health, or
• we have your permission.

How we handle your data

When you use a service that one of our products is integrated with, we process your data in line with our customer’s requirements. The processing is completed securely, in line with internal and external data security requirements.

Reporting year:2025/26

Protection of information

Aire Innovate is committed to ensuring the security of your personal information. We use commercially reasonable technological, physical, and administrative security safeguards, such as firewalls and carefully developed security features, to protect the confidentiality and security of your personal information within our products, services, and sites.

When you enter confidential information (such as login credentials or information submitted from within the Service), we encrypt the transmission of that information using secure socket layer technology (SSL).

These technologies, procedures, and other measures are used in an effort to ensure that your data is safe, secure, and only available to you and to those you authorised to access your data.

However, no internet, email, or other electronic transmission is ever fully secure or error-free, so you should take care in deciding what information you send to us in this way.

Aire Innovate is not responsible for the functionality or security measures of any third party.

NHS login

Please note that if you access our service using your NHS login details, the identity verification services are managed by NHS England. NHS England is the controller for any personal information you provide to NHS England to get an NHS login account and verify your identity and uses that personal information solely for that single purpose. For this personal information, our role is a “processor” only and we must act under the instructions provided by NHS England (as the “controller”) when verifying your identity. To see NHS login’s Privacy Notice and Terms and Conditions, please click here. This restriction does not apply to the personal information you provide to us separately.

‍Other websites

Our products may be contained within other systems, apps, or websites. This privacy policy only applies to our products alone, so when you link to other systems, apps, or websites you should read their privacy policies.

Aire Innovate does not endorse and is not responsible for the practices of third parties or their websites or applications. We do not determine and are not responsible for the privacy practices or the content of websites or applications operated by third parties.

Your browsing and interaction on any third-party website or service, including those that have a link on our website, are subject to that third party’s own rules and policies.

We are not responsible for and do not control any third parties that you authorise to access your user content. If you are using a third-party website or service and you allow such a third-party access to your user content, you do so at your own risk.

Cookies

Cookies are text files placed on your computer to collect standard internet log information and visitor behaviour information. This information is used to track visitor use of the website and to compile statistical reports on website activity.

Aire Innovate products that collect patient/citizen data do not use cookies.

Who we share your information with

Your data will be shared with the Data Controller. The Data Controller is the organisation deploying Aire Innovate’s products to provide you with a service. This may be your local health or social care provider or a provider of other services (e.g. education).

If Aire Innovate (or substantially all of its assets) is sold to another organisation, the information we hold about our users and customers will become one of the transferred assets. We may share your information if we are under a duty to disclose or share your personal data to:

• comply with a legal obligation
• apply or enforce our terms and conditions of supply and other agreements
• protect the rights, property or safety of Aire Innovate, our customers or others, this includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction

We will never sell your information to other organisations.

Where we store your information

We use a number of cloud-based products to help us process the information we collect. By submitting your personal information, you agree for it to be transferred to, stored in or processed by these products. All of our data processing takes place within Amazon Web Services (AWS) in the ‘eu-west-2 region (London)’ in multiple availability zones.

We review what information is being processed and ensure your information is treated securely and in accordance with our privacy policy.

‍How long we keep your information

The Data Controller typically determines the length of data retention and this will be specified through contracts or other documentation. Aire Innovate maintains a Data and Record Management Policy that outlines how we manage the data we process.

We comply with our legal obligations in relation to the retention and deletion of data.

We store personal information and medical information only for as long as is necessary, for the purpose the data was collected or to comply with applicable legal, tax, or regulatory requirements.

Please email compliance@aireinnovate.com with any queries regarding this.

Your rights

We are committed to protecting your personal information and respecting your rights under applicable data protection laws. The rights available to you will depend on where you live and the legal basis under which your information is processed.

Individual Rights Under UK GDPR

If your information is processed under the UK General Data Protection Regulation (UK GDPR), you have the following rights:

Right of access: You can request a copy of the personal information we hold about you.

Right to rectification: You can ask us to correct inaccurate or incomplete information.

Right to erasure: You can ask us to delete your information in certain circumstances.

Right to restrict processing: You can ask us to limit how we use your data in specific situations.

Right to data portability: You can request that we transfer your information to another organisation.

Right to object: You can object to the use of your data for particular purposes.

Rights in relation to automated decision-making: You have the right not to be subject to decisions made solely by automated means, including profiling, if those decisions have legal or similarly significant effects on you.

To exercise any of these rights, please contact our Compliance Team at compliance@aireinnovate.com. We will acknowledge your request within two working days and aim to respond within one calendar month. If your request is complex, we may take up to three calendar months, but we will inform you of this within the initial month.

Additional Rights Under HIPAA (for US Residents)

If your healthcare provider is based in the United States and Aire Innovate or Aire Logic handles your information as a Business Associate, you may have rights under the Health Insurance Portability and Accountability Act (HIPAA). These include:

Access: You can request a copy of your health information. We will respond within 30 days, with a possible 30-day extension if needed.

Amendment: You can ask for your information to be corrected if you believe it is wrong or incomplete. We will respond within 60 days.

Accounting of disclosures: You can request a list of who your information has been shared with over the past six years (excluding routine care and payment). The first request each year is free.

Restrictions: You can ask us to limit how your information is used or shared. We are not required to agree but will review all requests.

Confidential communications: You can request to be contacted in a specific way (e.g. by post instead of phone). We will honour reasonable requests.

Complaints: You can contact us or the US Department of Health and Human Services if you believe your rights have been violated. We will not retaliate against you for raising a concern.

To make a HIPAA-related request, please email compliance@aireinnovate.com. Where needed, we will forward your request to the relevant healthcare provider and support their response.

How to complain

If you are unhappy about how your information has been handled by Aire Innovate or an organisation involved in how we use your information, you can make a complaint to our Data Protection Officer or the Information Commissioner’s Office:

‍Aire Innovate Limited Data Protection Officer

‍Andrew Martin
Aire Innovate Limited
Aireside House
24-26 Aire Street
Leeds
LS1 4HT

Email: compliance@aireinnovate.com

‍Information Commissioner's Office
‍Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Web: ico.org.uk/make-a-complaint‍

Telephone: 0303 123 1113

‍Changes to this policy

This policy was last updated on 04 Jun 2026.

We will post any future changes on this page and, where appropriate, notify you by email. Please check this page frequently for updates.‍

Contact us‍

Please contact us if you have any questions, comments or requests in relation to this privacy policy or information we hold about you by emailing compliance@aireinnovate.com or in writing to:

Compliance Team
Aire Innovate Limited
Aireside House
24-26 Aire Street
Leeds
LS1 4HT