Last updated: 23 September 2026
Aerinva (“we”, “us”) provides an AI documentation assistant for the UK health and social care workforce, at app.aerinva.com. This policy explains how we handle personal data when you visit aerinva.com, contact us, or use the product as part of an organisation’s pilot or subscription.
Who we are. Aerinva is operated by Richard Cunningham, trading as Aerinva (limited company registration pending — see “Our legal status” below). Contact: hello@aerinva.com.
Our legal status. Aerinva is not yet a registered company. Registration is planned once early groundwork is complete. This page will be updated with our registered company name and number at that point.
The marketing website (aerinva.com). If you fill in our contact form, we collect your name, email address and message content solely to reply to your enquiry. We do not use tracking cookies or third-party advertising scripts on this site. Submissions are sent to our hello@aerinva.com mailbox (hosted by Hostinger) and are not shared with anyone else.
The product (app.aerinva.com)
If your organisation uses Aerinva, the following applies to the case documentation processed through the product:
- Controller and processor. For the core documentation product, the organisation that commissions Aerinva (for example, a local authority or care provider) is the data controller. Aerinva acts as a data processor, handling data only on that organisation’s instructions, under a written Data Processing Agreement. Aerinva does not decide what data is collected or why — the commissioning organisation does.
- What is processed. Practitioners’ raw case notes, AI-drafted structured records, service user identifying details (as entered by the practitioner), and account/audit data (login activity, who reviewed and approved each record).
- How AI is used. Draft text is generated using Anthropic’s Claude API. Anthropic does not use this data to train its models, retains API data for a default of 30 days for abuse-monitoring purposes only, and Aerinva’s system prompt restricts the model to drafting only — every draft must be reviewed and approved by a human practitioner before it becomes part of the record. Aerinva never allows AI output to be saved without that human review step.
- Retention. Case records are retained for 8 years from case closure for adults, until the service user’s 25th birthday for children’s cases, and under a 75-year review date (from date of birth) for any safeguarding-linked record, in line with NHS and local authority records-management guidance. Records are never deleted automatically without a human reviewing and confirming the deletion.
- Your rights. If you are a service user (or represent one) whose data has been processed through Aerinva by an organisation using our product, your data protection rights (access, correction, erasure, objection) are exercised through that organisation, as the data controller. Aerinva provides the organisation with tools to fulfil those requests promptly.
- International transfers. Where data is processed by Anthropic’s API, transfers are covered by Anthropic’s Data Processing Agreement, which incorporates the UK’s International Data Transfer Addendum.
- Security. Data is stored in Supabase (hosted in the eu-west-2 / London region), protected by row-level security so organisations’ data is kept isolated from one another, with admin-only audit logging of exports and deletions, and a password policy that includes a leaked-password check.
Sub-processors we use. Anthropic (AI drafting), Supabase (database and authentication, London region), Vercel (application hosting), Hostinger (marketing site hosting and email).
Complaints. If you have a concern about how your data has been handled, contact us at hello@aerinva.com, or the Information Commissioner’s Office (ico.org.uk) if you are a UK resident and remain unsatisfied.
Changes to this policy. We will update this page as the product and our legal status change, and will note the date of the most recent update above.