Privacy Policy for airGP

Last updated: 25 June 2026

This Privacy Policy explains how airGP LTD ("airGP", "we", "us", or "our") collects, uses, stores, shares, and protects personal data when you use the airGP website at airgp.co.uk, the airGP platform, and related support, billing, subscription, and communication services.

It also explains how we process data for airGP's HMRC Making Tax Digital ("MTD") for Income Tax functionality. MTD submissions may be offered as an optional paid subscription add-on.

1. Who We Are And What airGP Does

For UK data protection law, airGP LTD is normally the data controller for the personal data we process about users of the service.

airGP provides software for GP locums and related healthcare professionals to manage work records, invoices, expenses, mileage, pension records, tax records, subscriptions, and related administrative tasks. Where enabled by the user, airGP may also connect to HMRC to help prepare and submit MTD for Income Tax updates.

2. Information We Collect

The personal data we collect depends on how you use airGP. It may include the following categories.

Account and profile details

• name, email address, telephone number, and postal address;
• account login details and authentication information;
• professional details such as GMC number, performer list information, qualifications, and CV data;
• organisation affiliations, work preferences, and account settings;
• communications with airGP support.

Service records

• session and booking records;
• invoices, invoice line items, invoice status, and payment records;
• expenses, receipts, categories, notes, and supporting files;
• mileage records, travel details, rates, and related notes;
• pension records and related administrative information;
• tax records, tax reports, MTD-related records, and exported documents;
• uploaded documents and clinical document type records where you use those features.

Subscription and billing details

• subscription plan, trial status, add-ons, renewal dates, and cancellation status;
• billing name, billing address, invoice details, and tax-related details where applicable;
• Stripe customer, subscription, invoice, and payment identifiers;
• limited payment method information returned by Stripe, such as brand and last four digits.

Technical and log data

• IP address, browser type, device information, operating system, and approximate location from IP;
• login records, session identifiers, authentication events, and security logs;
• page visits, feature use, request logs, error logs, and performance data;
• cookie identifiers and other data needed to operate the service securely.

3. HMRC And MTD Data

If you choose to use airGP's MTD for Income Tax functionality, we may process HMRC-related data so that we can provide the feature and submit updates when you request it.

This may include:

• HMRC authorisation tokens and token expiry information;
• business identifiers, taxpayer references, National Insurance number, and other identifiers needed by HMRC;
• HMRC obligations, obligation periods, due dates, and status information;
• income, expense, allowance, adjustment, and tax calculation data prepared in airGP;
• MTD submission data sent to HMRC when you ask us to submit it;
• HMRC responses, receipts, correlation identifiers, and confirmation details;
• submission history, including timestamps, status, errors, and audit records.

airGP only accesses HMRC data after you authorise access through HMRC's authorisation process. We do not ask for, receive, or store your HMRC password. HMRC login details are entered with HMRC, not with airGP.

You are responsible for checking that the information you enter, import, categorise, approve, or submit through airGP is complete and accurate. airGP provides software tools, but does not provide tax, legal, accounting, or financial advice.

4. How We Collect Information

We collect personal data:

• directly from you when you register, update your profile, or use the platform;
• when you create invoices, expenses, mileage, pension, tax, or MTD records;
• when you contact us for support or send feedback;
• automatically through your use of the website and platform;
• from Stripe when subscription and payment events occur;
• from HMRC where you have authorised airGP to connect to HMRC services;
• from organisations or professionals interacting with you through airGP, where relevant.

5. How We Use Your Data

We use personal data to:

• create, authenticate, and manage your airGP account;
• provide the airGP platform and the features you choose to use;
• manage invoices, expenses, mileage, pension records, tax records, documents, and reports;
• manage subscriptions, trials, paid add-ons, renewals, cancellations, billing, and receipts;
• process subscription payments and billing events through Stripe;
• provide customer support and respond to enquiries;
• maintain service availability, security, audit records, and fraud prevention controls;
• investigate errors, troubleshoot problems, and improve the service;
• send service messages about your account, subscription, billing, security, or platform changes;
• prepare, view, retrieve, and submit MTD updates to HMRC when you request this;
• keep records needed for legal, accounting, tax, regulatory, and dispute purposes.

6. Legal Basis For Processing

We process personal data only where we have a lawful basis under UK GDPR. Depending on the purpose, we may rely on one or more of the following bases.

Contract

We process data where it is necessary to provide airGP, manage your account, deliver subscribed features, provide support, and administer billing.

Legal obligation

We process data where we need to comply with laws that apply to us, including tax, accounting, company record, regulatory, and lawful authority requirements.

Legitimate interests

We process data where it is necessary for our legitimate interests and those interests are not overridden by your rights. This includes operating and improving airGP, securing the platform, preventing misuse, maintaining logs, handling support, enforcing terms, and managing business risk.

Consent

We rely on consent where required, such as for certain optional communications, non-essential cookies if introduced, and HMRC authorisation flows where you choose to connect airGP to HMRC. You may withdraw consent where processing is based on consent, but this may limit access to the relevant feature.

7. Stripe Billing

airGP uses Stripe to process subscription payments, paid add-ons, invoices, and related billing activity. Payment card details are handled by Stripe and are not stored by airGP.

Stripe may provide airGP with limited billing information, including:

• customer, subscription, payment, invoice, and checkout identifiers;
• payment status, subscription status, billing address, and tax information where applicable;
• partial payment method details, such as card brand and last four digits.

Stripe processes payment data under its own privacy and security arrangements. You can read Stripe's privacy policy at https://stripe.com/privacy.

8. Sharing Personal Data With Third Parties

We do not sell personal data. We may share personal data where needed to provide the service, comply with the law, or protect airGP and its users. Recipients may include:

• HMRC, where you authorise us to retrieve obligations, submit MTD updates, or receive HMRC responses;
• Stripe, for payment processing, subscription management, fraud checks, and billing records;
• our hosting provider, for secure storage, application hosting, backups, and operational logging;
• our email provider, for service emails, support messages, and account communications;
• professional advisers, insurers, auditors, or legal representatives where necessary;
• courts, regulators, law enforcement, HMRC, the ICO, or other authorities where legally required.

Third-party providers may process data under their own privacy notices where they act as independent controllers, or under our instructions where they act as processors.

9. Data Storage Location And International Transfers

airGP stores platform data in: London, England, United Kingdom.

Some service providers, including payment, email, support, or infrastructure providers, may process personal data outside the United Kingdom. Where this happens, we take reasonable steps to use appropriate safeguards required by UK data protection law.

10. Data Retention

We keep personal data only for as long as reasonably needed for the purposes described in this policy, unless a longer period is required for legal, tax, accounting, regulatory, security, or dispute reasons.

• Account records are usually kept while your account is active and for a reasonable period after closure.
• Invoices, expenses, mileage, pension records, tax records, and related reports may be kept for periods needed for tax, accounting, audit, and user record purposes.
• HMRC authorisation tokens are kept only while needed to provide the authorised HMRC connection, unless earlier revoked or expired.
• HMRC obligations, submission data, receipts, and submission history may be kept as part of your tax and audit records.
• Subscription, billing, and Stripe event records may be kept for accounting, tax, fraud prevention, chargeback, and dispute purposes.
• Technical logs, security logs, and error logs are kept for limited periods unless needed to investigate security, fraud, support, or legal issues.
• Backups may retain data for a limited period after deletion until backup cycles complete.
• Deleted accounts may be removed or anonymised after a reasonable retention period, subject to records we need to keep for lawful reasons.

You should export any records you need before closing your account, including invoices, expenses, mileage, pension records, tax records, HMRC receipts, and submission history.

11. Security

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures include:

• HTTPS/TLS for data transmitted between your browser and airGP;
• authentication controls for account access;
• access controls for airGP systems and administrative tools;
• secure hosting and infrastructure controls;
• logging and monitoring to help detect errors, abuse, and security issues;
• protections for HMRC tokens, application secrets, and other sensitive credentials;
• operational processes for backups, incident response, and system maintenance.

No online service can be guaranteed to be completely secure. You should keep your login details safe, use a strong password, and contact us promptly if you suspect unauthorised access to your account.

12. Cookies

airGP primarily uses strictly necessary cookies and similar technologies needed for login, security, session management, billing flows, and operation of the service.

We do not currently use marketing or behavioural tracking cookies. If we introduce non-essential cookies in future, we will update our cookie information and obtain consent where required.

You can manage cookies in your browser settings. Blocking strictly necessary cookies may stop parts of airGP from working properly.

13. Your UK GDPR Rights

Subject to UK data protection law and any applicable exemptions, you may have the right to:

• request access to the personal data we hold about you;
• ask us to rectify inaccurate or incomplete personal data;
• ask us to erase personal data in certain circumstances;
• ask us to restrict processing in certain circumstances;
• object to processing in certain circumstances;
• request portability of personal data you have provided to us;
• withdraw consent where processing is based on consent.

To exercise your rights, contact contact@airgp.co.uk. We may need to verify your identity before responding.

You also have the right to complain to the UK Information Commissioner's Office (ICO). The ICO website is https://ico.org.uk.

14. Security Breach Handling

If we become aware of a personal data breach, we will assess what happened, take steps to contain and investigate it, keep appropriate internal records, and take action to reduce the risk of harm.

Where UK GDPR requires notification, we will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to affected individuals, we will also notify those individuals without undue delay where required.

15. Service Communications And Marketing

We may send service communications about your account, billing, subscription, security, support, MTD functionality, or important platform changes. These are part of operating the service.

We will only send marketing communications where we have a lawful basis to do so. You can unsubscribe from non-essential marketing communications at any time.

16. Third-Party Links

airGP may link to third-party websites or services, including HMRC and Stripe. Those third parties are responsible for their own websites, services, and privacy practices.

17. Children

airGP is not intended for children or individuals under the age of 18.

18. Changes To This Privacy Policy

We may update this Privacy Policy from time to time, including when we change our services, providers, HMRC or MTD functionality, legal requirements, or security practices.

The latest version will be published at https://airgp.co.uk/privacy-policy with an updated "Last updated" date.

19. Contact Us

If you have questions about this Privacy Policy or how airGP handles personal data, contact:

contact@airgp.co.uk