Privacy notice

Introduction

AIRAdoc GmbH, Am Biopark 13, 93053 Regensburg, including its subsidiaries (collectively referred to below as the "Company", "we" and "us"), gives the protection of your personal data the highest priority.

Where we act as controller within the meaning of the GDPR, this privacy notice is intended to provide comprehensive information about our data protection practices in accordance with Article 13 GDPR. This covers all processing of personal data on our marketing websites and the processing of user data within our product AIRAdoc. These processing activities are detailed in Parts B and C. For processing activities in which we act solely as a processor, the data processing agreement concluded with the customer under Article 28 GDPR applies.

The implementation of the EU General Data Protection Regulation (Regulation (EU) 2016/679; referred to below as the "GDPR") imposed additional obligations on us as data controller to ensure the protection of data subjects' personal data. Below, we also refer to you as the data subject as "user", "customer", "you" or "data subject". We are also subject to the further provisions of the German Federal Data Protection Act ("BDSG"), which specifies and extends the requirements of the GDPR.

Where we determine the purposes and means of data processing alone or jointly with others, we are required in particular to inform you transparently about the nature, scope, purpose, duration and legal basis of processing (under Articles 13 and 14 GDPR). This notice (referred to below as the "privacy notice") explains how we process your personal data.

This privacy notice is divided into three parts. Part A (General provisions) explains the legal foundations of data protection. Part B (Marketing websites) provides specific information about data protection issues relevant to the use of our marketing websites. Part C (AIRAdoc) provides specific information about data protection issues relevant to the use of the AIRAdoc software we provide. Annex 1 provides information about the processors used for certain processing activities.

A. General provisions

1. Definitions

The following definitions under Article 4 GDPR apply to this privacy notice:

"Personal data" (Article 4(1) GDPR) means any information relating to an identified or identifiable natural person ("data subject"). A person is identifiable if they can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to that person's physical, physiological, genetic, mental, economic, cultural or social identity. Identifiability may also result from linking different information or from additional knowledge. The form of the information (photographs, videos, audio recordings, etc.) is irrelevant.

"Processing" (Article 4(2) GDPR) means any operation involving personal data, whether or not by automated means. This includes collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data, and a change to its original purpose.

"Controller" (Article 4(7) GDPR) means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data.

"Processor" (Article 4(8) GDPR) means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller, in particular in accordance with its instructions (for example, an IT service provider). In the data protection context, a processor is not a third party.

"Third party" (Article 4(10) GDPR) means a natural or legal person, public authority, agency or other body other than the data subject, the controller, the processor and persons authorised to process personal data under the direct authority of the controller or processor. This includes other legal entities within the same group.

"Consent" of the data subject (Article 4(11) GDPR) means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they signify agreement to the processing of their personal data, by a statement or a clear affirmative action.

"Special categories of personal data" (Article 9(1) GDPR) are data revealing, for example, racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership. They also include genetic data, biometric data used to uniquely identify a natural person, health data and data concerning sex life or sexual orientation. Special statutory requirements apply to the processing of this data and are indicated where relevant.

2. Details of the controller

The controller responsible for processing your personal data within the meaning of Article 4(7) GDPR is AIRAdoc GmbH:

AIRAdoc GmbH, Am Biopark 13, 93053 Regensburg

Management: Prof. Dr. Thomas Bolz

Email: info@airadoc.com

Further information about our company is available in the legal notice on our website.

3. Data Protection Officer

Our Data Protection Officer is available at any time to answer questions about data protection:

Jonathan Bollig, Am Biopark 13, 93053 Regensburg

Email: datenschutz@airadoc.com

4. Legal bases for data processing

As a general rule, processing personal data is lawful only where a statutory legal basis exists. Such a legal basis may include, in particular:

• Article 6(1), first sentence, point (a) GDPR ("consent"): The data subject has freely, knowingly and unambiguously consented to specific processing.
• Article 6(1), first sentence, point (b) GDPR: Processing is necessary for the performance of a contract or steps prior to entering into a contract.
• Article 6(1), first sentence, point (c) GDPR: Processing is necessary to comply with a legal obligation of the controller.
• Article 6(1), first sentence, point (d) GDPR: Processing is necessary to protect vital interests.
• Article 6(1), first sentence, point (e) GDPR: Processing is necessary for a task carried out in the public interest or in the exercise of official authority.
• Article 6(1), first sentence, point (f) GDPR ("legitimate interests"): Processing is necessary for the legitimate interests of the controller or a third party, unless the data subject's interests or fundamental rights override those interests.

The applicable legal basis for each processing activity we carry out is stated below. Processing may be based on several legal bases.

5. Data deletion and storage duration

Unless a storage period is expressly stated, your personal data will be deleted or blocked as soon as the purpose or legal basis for storage ceases to apply. Storage beyond the purposes and legal bases set out in this privacy notice may be necessary in the event of actual or threatened litigation or where required by statutory provisions (for example, section 257 of the German Commercial Code (HGB) or section 147 of the German Fiscal Code (AO)). In that case, the legal basis for processing is Article 6(1), first sentence, point (f) GDPR or Article 6(1), first sentence, point (c) GDPR, respectively.

6. Data security

We implement appropriate technical and organisational security measures to protect your data against accidental or deliberate manipulation, loss, destruction or unauthorised access (for example, TLS encryption for our website). In accordance with Article 25(1) GDPR, we consider the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the varying likelihood and severity of risks to the rights and freedoms of natural persons. Our security measures are continuously adapted to technological progress. Further information is available on request from our Data Protection Officer (A.3) or in the document on our technical and organisational measures on the marketing websites.

7. Working with processors

Like any larger company, we use external service providers in Germany and abroad (for example, in IT, logistics, telecommunications and marketing). They act solely on our instructions and are contractually required to comply with data protection provisions under Article 28 GDPR.

8. Transfers of data to third countries

As part of our business relationships, your personal data may be transferred to third-party companies which may be located outside the European Economic Area (EEA), that is, in third countries. Such processing takes place exclusively to fulfil contractual and business obligations and maintain our business relationship. Details of each transfer are explained in the relevant sections of this notice.

The European Commission has adopted adequacy decisions under Article 45 GDPR for some third countries. A list of these countries and copies of the decisions are available at http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.html. Other third countries to which personal data is transferred may not provide a comparable level of data protection. In such cases, we ensure appropriate data protection, for example through binding corporate rules, EU Standard Contractual Clauses, certificates or recognised codes of conduct. For further information, please contact our Data Protection Officer (A.3).

9. Automated decision-making and profiling

If we carry out automated decision-making, including profiling, we will inform you separately about this and about the underlying logic, significance and intended consequences for the data subject.

As a general rule, we do not use your personal data for automated decision-making or profiling.

10. No obligation to provide personal data

We do not make entering into contracts conditional on you first providing us with personal data. As a general rule, there is no statutory or contractual obligation to provide us with your personal data. However, we may be unable to provide certain offerings, or may be able to provide them only to a limited extent, if you do not provide the necessary data.

11. Statutory disclosure obligations

We may be legally required to disclose lawfully processed personal data to third parties, in particular public authorities (under Article 6(1), first sentence, point (c) GDPR).

12. Your rights

As a data subject, you have the following rights in particular in relation to your personal data. You may exercise them at any time using the contact details in section A.2:

• Right of access (Article 15 GDPR): You may request information about the data processed concerning you, the purposes of processing, data categories, recipients, storage duration, your rights, etc.
• Right to rectification (Article 16 GDPR): You may request the rectification of inaccurate data or completion of incomplete data without undue delay.
• Right to erasure (Article 17 GDPR): You may request the deletion of your data under certain conditions.
• Right to restriction of processing (Article 18 GDPR): You may request restriction of the processing of your data under certain conditions.
• Right to data portability (Article 20 GDPR): You may request to receive your data in a structured, commonly used and machine-readable format or to have it transmitted to another controller.
• Right to object (Article 21 GDPR): You may object to the processing of your data where it is based on Article 6(1), first sentence, point (e) or (f) GDPR.
• Right to withdraw consent (Article 7(3) GDPR): You may withdraw consent at any time, prohibiting future processing based on that consent. This does not affect the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint (Article 77 GDPR): You may lodge a complaint with a data protection supervisory authority, for example the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, email: poststelle@datenschutz-bayern.de.

13. Cookies

Cookies are small text files that your browser stores on your device. The party setting a cookie can thereby obtain certain information. Cookies cannot run programs or transfer malware to your device. They are used to improve the user-friendliness and efficiency of our online offering. Cookies may contain information that enables the device used to be identified. Other cookies store only configuration settings that cannot be linked to a person. Cookies cannot directly identify a user.

Cookies are classified by storage duration (temporary session cookies versus persistent cookies) and functionality:

• Technical cookies: These are essential for navigation and basic functions of our web presence and ensure its security. They neither collect marketing information nor record your browsing history.
• Performance cookies: These collect pseudonymous data about your use of our website, pages visited and any malfunctions. They are used solely to optimise our offering and analyse users' interests.
• Advertising and targeting cookies: These enable personalised advertising on our website or by third parties and measurement of the success of such offerings. The maximum storage period is 13 months.
• Interaction cookies: These improve communication between our website and external services, such as social networks. The maximum storage period is also 13 months.

Any use of cookies that is not technically essential constitutes processing relevant to data protection law and is permitted only with your express and active consent under Article 6(1), first sentence, point (a) GDPR. This applies in particular to advertising, targeting and interaction cookies. Personal data processed through cookies is also disclosed to third parties only with your express consent under Article 6(1), first sentence, point (a) GDPR. You may withdraw this consent at any time through our cookie management system.

For certain cookies, the legal basis may also arise from Article 6(1), first sentence, points (b) to (f) GDPR.

14. Updates to this privacy notice

We review this privacy notice regularly and adapt it to changes in data protection law and technical or organisational developments. We publish changes in particular on our website at www.airadoc.com. This privacy notice is dated September 2025.

B. Marketing websites

1. Functional description

Information about our company and the services we offer is available in particular at www.airadoc.com and its associated subpages (collectively referred to below as the "marketing websites"). When you visit our marketing websites, your personal data may be processed.

2. Personal data processed

Where the processing described below is based on Article 6(1), first sentence, point (f) GDPR, the purposes stated also constitute our legitimate interests.

a. Informational use

When our marketing websites are used solely for information, we process the following personal data in particular.

Log data

Context and scope

Each time our marketing websites are accessed, a temporary, pseudonymised log record (known as server log files) is stored containing the following information:

• Referrer URL (the page from which the request originated);
• Name and URL of the requested page;
• Date and time of access;
• Description of the type, language and version of the browser used;
• Truncated IP address of the requesting computer (pseudonymised);
• Amount of data transferred;
• Operating system;
• Access status / HTTP status code;
• GMT time zone difference.

Purpose and legal basis

Log data is processed for statistical purposes and to improve our website, particularly its stability and security (legal basis: Article 6(1), first sentence, point (f) GDPR).

Duration of processing

A.5 applies.

Categories of recipients

Service providers for operating our website and processing stored data (for example, data centres and IT security).

Transfers to third countries

Transfers may occur to subprocessors of the service providers used for analytics and hosting. Further information and the legal assessment of transfers are available in Annex 1.

Cookies

Context and scope

Purpose and legal basis

See the "Description" column in the overview above. A.13 also applies.

Duration of processing

A.5 and A.12 apply.

Categories of recipients

Recipients of data from performance cookies are our processors for analytics purposes. For the cookies "_ga" and "_ga_<property_id>", these are Google and its processors. Further information and the legal assessment of transfers are available in Annex 1.

Transfers to third countries

Personal data is transferred to third countries for the cookies "_ga" and "_ga_<property_id>" to Google (Analytics). Further information and the legal assessment of transfers are available in Annex 1. Data may also be transferred to processors for analytics and hosting.

b. Contacting us

When you use our contact form, we process the personal data described below.

Contact form data

Context and scope

When you use our contact forms, we process the data submitted, such as surname, first name, email address and time of submission. We also process personal data that you optionally include in your message.

Purpose and legal basis

Contact form data is processed to handle your enquiries (legal basis: Article 6(1), first sentence, point (b) or (f) GDPR). All optional (special categories of) personal data included in your message is processed on the basis of implied consent under Article 6(1), first sentence, point (a) GDPR or Article 9(2), first sentence, point (a) GDPR, respectively.

Duration of processing

A.5 applies.

Categories of recipients

Processors for providing the form, transmitting the message, processing stored data and performing tasks arising for us from your enquiry (for example, data centres and IT security).

Transfers to third countries

Data may be transferred to processors for hosting. Data is also transferred to Google (email correspondence) and its processors. Further information and the legal assessment of transfers are available in Annex 1.

3. Concluding remarks

a. Use of social media

We do not implement direct social media plugins on our websites. Where icons of social media platforms (such as Facebook, Instagram or similar services) appear on our web presence, they serve solely as passive links to the respective providers' pages.

C. AIRAdoc

1. Functional description

Our AIRAdoc software supports doctors in their day-to-day professional work through AI-assisted functions. The specific range of functions also depends on your configuration. Details are set out in the applicable General Terms and Conditions.

2. Personal data processed

Where the processing described below is based on Article 6(1), first sentence, point (f) GDPR, the purposes stated also constitute our legitimate interests. No special categories of personal data are processed. Usage data may be aggregated in anonymised form for marketing purposes.

a. Basic use

The following personal data may be processed whenever AIRAdoc is used.

Log data

Context and scope

Each time AIRAdoc is accessed, a temporary, anonymised log record (known as server log files) is stored containing the following information:

• Referrer URL (the page from which the request originated);
• Name and URL of the requested page;
• Date and time of access;
• Description of the type, language and version of the browser used;
• Truncated IP address of the requesting computer (anonymised);
• Amount of data transferred;
• Operating system;
• Access status / HTTP status code;
• GMT time zone difference.

Purpose and legal basis

Log data is processed for statistical purposes and to improve our product, particularly its stability and security (legal basis: Article 6(1), first sentence, point (f) GDPR).

Duration of processing

A.5 applies.

Categories of recipients

Service providers for operating our website and processing stored data (for example, data centres and IT security).

Transfers to third countries

None.

Cookies

Context and scope

Purpose and legal basis

See the "Description" column in the overview above. A.13 also applies.

Duration of processing

A.5 and A.12 apply.

Categories of recipients

Processors for hosting.

Transfers to third countries

None.

b. Management of accounts and settings

User profile and user settings

Context and scope

To create and manage your user account, we request some basic information. This includes:

• First name and surname;
• Email address;
• Medical specialty;
• Language preference;
• Sign-off wording for medical letters.

Purpose and legal basis

This data is processed to register users and provide the product's functionality (legal basis: Article 6(1), first sentence, point (b) GDPR).

Duration of processing

A.5 applies.

Categories of recipients

Processors for hosting AIRAdoc.

Transfers to third countries

None.

Advertising and product information

Context and scope

We process certain personal data to send product information, such as usage guidance and tutorials, and for advertising purposes. All or some of the following data may be processed:

• First name and surname;
• Email address;
• Telephone number;
• Medical specialty;
• Language preference.

Purpose and legal basis

This data is processed for advertising purposes and to send optional product information, based on your explicit consent during registration (legal basis: Article 6(1), first sentence, point (a) GDPR).

Duration of processing

A.5 applies.

Categories of recipients

Processors for hosting AIRAdoc.

Transfers to third countries

None.

Payment processing

Context and scope

We require payment information from you to process payments.

Purpose and legal basis

This data is processed exclusively for payment processing (legal basis: Article 6(1), first sentence, point (b) GDPR).

Duration of processing

A.5 applies.

Categories of recipients

Processors for AIRAdoc payment processing.

Transfers to third countries

Transfers to third countries occur exclusively as part of transfers to processors for payment processing. Further information and the legal assessment of transfers are available in Annex 1.

Organisations

Context and scope

To represent organisational structures within AIRAdoc, we process the affiliation of different users to an organisation and identify users as administrators of that organisation.

Purpose and legal basis

This data is processed to provide the product's functionality (legal basis: Article 6(1), first sentence, point (b) GDPR).

Duration of processing

A.5 applies.

Categories of recipients

Processors for hosting AIRAdoc.

Transfers to third countries

None.

c. Use of software functions

Feedback function

Context and scope

You can voluntarily rate the quality of the documentation provided. This includes a simple choice (positive or negative) and the option to enter text.

Purpose and legal basis

This data is processed to improve our product (legal basis: Article 6(1), first sentence, point (f) GDPR).

Duration of processing

A.5 applies.

Categories of recipients

Processors for hosting AIRAdoc.

Transfers to third countries

None.

Creation and use of audio recordings, documents and templates

Context and scope

When using AIRAdoc, users regularly enter or upload personal data required for the product's functions. This includes, among other things:

• Audio recordings;
• Documents;
• Creating, retrieving and sharing templates;
• Information about the use of and access to documents and templates.

This may apply at both user and organisation level.

Purpose and legal basis

This data is processed to provide the product's functionality (legal basis: Article 6(1), first sentence, point (b) GDPR).

Duration of processing

A.5 applies.

Categories of recipients

Processors for hosting AIRAdoc.

Transfers to third countries

None.

d. Data processing for certification and security review

Context and scope

Certification of AIRAdoc under the Medical Devices Regulation (EU) 2017/745 requires the processing of your personal data. The data processed is:

• Feedback data.

Purpose and legal basis

This data is processed for the certification of AIRAdoc and thus its clinical applicability (legal basis: Article 6(1), first sentence, point (f) GDPR).

Duration of processing

The statutory retention and processing periods required for certification apply.

Categories of recipients

Processors for hosting AIRAdoc.

Transfers to third countries

None.

Annex 1 - Overview of processors

Marketing website

1. Google

Service provider: Google LLC

Registered office: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Contact details: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Processing activities used: Sending emails.

Legal basis: Certification under Article 45(1) GDPR within the Data Privacy Framework. Further information about certification is available on the Data Privacy Framework.

2. Stripe

Service provider: Stripe, Inc.

Registered office: 354 Oyster Point Boulevard, South San Francisco, California 94080, USA

Contact details: dpo@stripe.com

Processing activities used: Payment processing.

Legal basis: Certification under Article 45(1) GDPR within the Data Privacy Framework. Further information about certification is available on the Data Privacy Framework.

3. HubSpot

Service provider: HubSpot, Inc.

Registered office: Two Canal Park, Cambridge, MA 02141 USA

Contact details: Nicholas Knoop, Data Protection Officer, HubSpot, Inc., Two Canal Park, Cambridge, MA 02141, USA; privacy@hubspot.com

Processing activities used: Contacting us.

Legal basis: Certification under Article 45(1) GDPR within the Data Privacy Framework. Further information about certification is available on the Data Privacy Framework.

Product

1. Telekom

Service provider: Telekom Deutschland GmbH

Registered office: Landgrabenweg 149, 53227 Bonn, Germany

Contact details: Dr. Claus D. Ulmer, Friedrich-Ebert-Allee 140, 53113 Bonn, datenschutz@telekom.de

a) Hosting AIRAdoc on the Open Telekom Cloud

Categories of data subjects: As set out in Annex I to the joint controller agreement.

Categories of data processed: As set out in Annex I to the joint controller agreement.

Types of processing: As set out in Annex I to the joint controller agreement, except for use in the form of processing with large language models.

Purposes of processing: As set out in Annex I to the joint controller agreement. This processing occurs whenever AIRAdoc is used.

Duration of processing: As set out in Annex I to the joint controller agreement.

2. Nebius

Service provider: Nebius BV

Registered office: Schiphol Boulevard 165, 1118 BG Schiphol, Netherlands

Contact details: Data Protection Officer, Marina Benassi Coslovi, Schiphol Boulevard 165, 1118 BG Schiphol, the Netherlands. Email: privacy@nebius.com. Telephone: +31 202066970.

a) LLM inference on Nebius Token Factory

Categories of data subjects: As set out in Annex I to the joint controller agreement.

Categories of data processed: As set out in Annex I to the joint controller agreement.

Types of processing: Use in the form of processing with large language models.

Purposes of processing: Generating medical documentation directly based on the content of the data collected and recorded by the controller. This processing occurs only when AIRAdoc's Scribe function is used.

Duration of processing: Until LLM inference is completed.

3. Scaleway

Service provider: Scaleway SAS

Registered office: 8, rue de la Ville-l'Évêque, 75008 Paris, France

Contact details: privacy@scaleway.com

a) LLM inference

Categories of data subjects: As set out in Annex I to the joint controller agreement.

Categories of data processed: As set out in Annex I to the joint controller agreement.

Types of processing: Use in the form of processing with large language models.

Purposes of processing: Generating medical documentation directly based on the content of the data collected and recorded by the controller. This processing occurs only when AIRAdoc's Scribe function is used.

Duration of processing: Until LLM inference is completed.

4. OVH

Service provider: OVH SAS

Registered office: OVH SAS, 2 rue Kellermann, 59100 Roubaix, France

Contact details: OVH SAS, Data Protection Officer, 2 rue Kellermann, 59100 Roubaix, France

a) Transcription

Categories of data subjects: As set out in Annex I to the joint controller agreement.

Categories of data processed: As set out in Annex I to the joint controller agreement.

Types of processing: Transcription of conversation content.

Purposes of processing: Recording conversation content necessary for AIRAdoc's functionality. This processing occurs only when AIRAdoc's Scribe function is used.

Duration of processing: Until transcription is completed.