Privacy and data processing
This page explains what Eir stores, where it is processed and how long it is kept.
Updated 14 October 2026
Who handles your information
Eir is operated by Eir Tech: EIR TEC LTD (England and Wales, company number 15309722) and Eir Tech AS (Norway, organisation number 936876242). Your service agreement identifies the relevant contracting and processing entity. For account and website enquiries contact [email protected]. Where a clinic determines how patient records are used, that clinic remains the data controller and Eir Tech processes records under its instructions and a written agreement.
What we process and why
Account information includes your name, email, authentication details, preferences and trial or plan dates. It supports account access, service delivery and administration. Security records include sign-in and operational events. The workspace stores clinical content you choose to save, such as patient references, consultation sources, notes and signed versions, to provide the requested documentation service.
Messages sent through the contact and community forms, and webinar registrations, are stored so that a named person can reply. They are not used for advertising.
Audio and AI processing
When you request transcription, audio is sent to the configured transcription provider. The documentation workflow uses the OpenAI API for transcription and source-linked drafts. Eir Tech does not keep the uploaded audio after processing; the provider's processing and retention are governed by the applicable provider agreement and configuration. The transcript stays with the note as its source, and the source text and notes that you save remain in the workspace. Research tools may use a separately configured EEG processing service.
Infrastructure and international processing
The application runs on Eir Tech's managed server infrastructure. Do not assume that all storage and processing takes place in a single UK or EU region. Before using patient information, confirm the current subprocessor list, locations, safeguards for international transfers and retention arrangements in your clinic's agreement. US protected health information requires a suitable BAA and processing setup before use.
Access, security and retention
Record access is checked against the authorised clinician and patient. Consultation text and notes are encrypted in application storage. Operational API logging excludes request and response bodies. Signed note versions are preserved for record history. Ending a free trial does not delete records. Account closure, correction, export and retention requests are handled with the clinic's obligations and applicable law in mind; backups follow the agreed operational retention process.
Research contributions
Notes and audio are not automatically submitted for research. The voluntary proposal workflow submits only a rounded count of signed consultations for internal review. Any later clinical research data collection requires a separate protocol, lawful basis, appropriate permissions and disclosure-risk review. Removing direct identifiers does not by itself establish anonymity.
Your choices and rights
You can request access, correction, deletion, restriction or other rights available under applicable law. Contact your clinic for patient-record requests and Eir Tech for account data. You can also contact the UK Information Commissioner's Office or Datatilsynet in Norway. Some requests are subject to clinical record obligations or other lawful retention requirements.
Cookies
The workspace uses cookies needed for sessions and CSRF protection. The public pages do not add advertising trackers; where analytics is enabled it is configured to run without advertising features. Fonts are served from this site, not from a third party. External identity or processing providers may apply their own policies when you use those services.