Privacy Policy
NOTICE TO EEA RESIDENTS
This section provides additional information for individuals located in the European Economic Area (EEA), in accordance with the EU General Data Protection Regulation (GDPR).
DATA CONTROLLER
For processing activities related to the EEA, the data controller is:
- AIRS Medical Europe GmbH
- Postal Address: Oskar-von-Miller-Ring 2080333 Munich, Germany
AIRS Medical Europe GmbH is a subsidiary of AIRS Medical Inc. and is responsible for determining the purposes and means of processing personal data of individuals in the EEA.
For inquiries regarding personal data processing that fall outside the scope of the EEA operations, please refer to the global contact information provided in Privacy Policy.
Legal Basis for Processing Personal Data
AIRS Medical collects and processes personal data for the following reasons.
(a) Employment
For processing the personal data of our employees, applicants, and contractors, we rely on:
- Performance of a Contract (Article 6(1)(b)): To manage the recruitment process, establish the employment relationship, administer payroll, and provide employee benefits.
- Legal Obligation (Article 6(1)(c)): To comply with applicable labor, health and safety, tax, and social security laws.
- Legitimate Interest (Article 6(1)(f)): To manage IT infrastructure, ensure network security, conduct performance evaluations, and maintain internal directories.
(b) Customer (e.g., Healthcare Institutions)
For processing the personal data of healthcare professionals and administrative staff at the healthcare institutions we serve, we rely on:
- Performance of a Contract (Article 6(1)(b)): To set up user accounts, deliver our software services, provide technical support, and manage billing and invoicing.
- Legitimate Interest (Article 6(1)(f)): To manage our client relationships, improve the user experience of our products, conduct security monitoring, and send service updates.
- Consent (Article 6(1)(a)): To send promotional materials or newsletters, where explicit consent is required by applicable electronic marketing laws.
(c) Business Partners / Vendors
For processing the personal data of our suppliers, consultants, and business partners, we rely on:
- Performance of a Contract (Article 6(1)(b)): To manage procurement, negotiate and execute agreements, and process payments.
- Legal Obligation (Article 6(1)(c)): To maintain accurate corporate accounting, audit, and tax records.
- Legitimate Interest (Article 6(1)(f)): To conduct due diligence, assess vendor performance, and manage our general business operations and communications.
(d) Health Data
Health data constitutes a special category of personal data under Article 9 of the GDPR. AIRS Medical processes health data in the course of the usage of AI-powered solutions on the following legal bases, as applicable:
Where AIRS Medical acts as a Data Processor: In most cases, AIRS Medical processes patient data on behalf of healthcare institutions under a Data Processing Agreement. The healthcare institution is responsible for establishing the appropriate legal basis for the initial collection and processing of patient data, which may include:
- Explicit consent of the data subject (Article 9(2)(a)); or
- Necessity for the provision of healthcare under Article 9(2)(h), where processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, or the management of health systems and services.
Where AIRS Medical acts as a Data Controller: For activities where AIRS Medical determines the purposes and means of processing (e.g., product improvement, algorithm training using pseudonymised data), the applicable legal bases may include:
- Explicit consent of the data subject (Article 9(2)(a)); or
- Legitimate interest (Article 6(1)(f)) & Scientific research purposes (Article 9(2)(j)) : We may rely on our legitimate interest to improve and develop our medical AI software (Article 6(1)(f)), paired with the condition that processing is necessary for scientific research purposes (Article 9(2)(j)).This processing is subject to a legitimate interest assessment (balancing test) and strict technical safeguards, including data minimisation and pseudonymisation.
Cross-border Transfers of Personal Data
As the nature of our business aims to operate globally, your personal data may be transferred to, stored, and processed in countries outside the European Economic Area (EEA), including to our headquarters in the Republic of Korea and other subsidiaries of AIRS Medical, and to our trusted third-party service providers (e.g., AWS).
When we transfer your personal data outside the EEA, we ensure that a similar degree of protection is afforded to it by ensuring at least one of the following legal safeguards is implemented in accordance with GDPR requirements:
- Adequacy Decisions: We may transfer personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission. Transfers to our headquarters in the Republic of Korea are based on the European Commission’s Adequacy Decision for the Republic of Korea as of December 2021.
- Standard Contractual Clauses (SCCs): Where we transfer data to countries that do not have an adequacy decision, we rely on the approved Standard Contractual Clauses adopted by the European Commission.
- EU-US Data Privacy Framework: For certain transfers to the United States, we may rely on service providers who are certified under the EU-US Data Privacy Framework.
Health data processed through our products for European customers is primarily processed and stored within the EEA. Where strictly necessary for product development or technical support, health data may be transferred to our headquarters under strict technical measures, including pseudonymisation and encryption, to ensure the security of your data.
| Destination Country | Purposes | Legal Safeguard |
|---|---|---|
| Republic of Korea (HQ) | Group-internal administration, product development | Adequacy Decision |
| Japan | Group-internal administration | Adequacy Decision |
| United States | Group-internal administration, customer support,SaaS service providers (CRM tool) | SCCs / EU-US DPF |
Retention Period
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:
- Employment data: For the duration of the employment relationship, and thereafter as required by applicable labor, tax, and social security laws of the Member states where the European employees reside.
- Customer and business partner data: For the duration of the contractual relationship. Plus, any applicable statutory limitation period under the relevant Member State laws.
- Health data processed as a Data Processor: In accordance with the retention schedule defined by the relevant healthcare institution (Data Controller). AIRS Medical does not independently determine retention periods for data processed on behalf of its customers. (Healthcare Institutions)
- Health data processed as a Data Controller (e.g., for product improvement or research): Retained in pseudonymised or anonymised form only for as long as necessary to achieve the stated research or development purpose, subject to periodic review.
- Marketing and consent records: Until consent is withdrawn, or as otherwise required to demonstrate compliance.
When personal data is no longer required, it is securely deleted or anonymised in accordance with our internal data retention and disposal procedures.
Data Breach Notification
Where AIRS Medical acts as a Data Controller
In the event of a personal data breach, we will notify the competent supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. Where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, which may include, for example, unauthorised access to medical imaging data or health records, we will also notify the affected data subjects without undue delay, providing clear information about the nature of the breach, the likely consequences, and the measures taken or proposed to address it.
Where AIRS Medical acts as a Data Processor
We will notify the relevant data controller without undue delay upon becoming aware of a personal data breach, providing sufficient information to enable the controller to fulfil its notification obligations under Articles 33 and 34 of the GDPR.
In all cases, we document the facts of any personal data breach, its effects, and the remedial actions taken, in accordance with Article 33(5) of the GDPR.
AI-Assisted Processing
1. How Our AI-powered Products Work
AIRS Medical develops AI-powered software solutions designed to assist healthcare professionals in their clinical workflows, including medical image analysis and enhancement (e.g., MRI reconstruction) and generating patient-friendly reports.
Our AI products function as clinical decision-support tools and they do not make autonomous diagnostic or treatment decisions.
Our AI systems process the following categories of health-related data:
- MRI Scans provided by healthcare institutions
- Associated metadata: Patient identifiers (as provided by the healthcare institution), imaging parameters, scan dates, and device information necessary for processing.
Our AI algorithms analyse this data to generate enhanced or reconstructed images, annotations, or other outputs intended solely to support the clinical judgment of a qualified healthcare professional.
2. Human Oversight and the Role of Healthcare Professionals
AIRS Medical does not engage in solely automated decision-making as defined under Article 22 of the GDPR. All AI-generated outputs are designed to be reviewed and validated by a qualified healthcare professional before any clinical action is taken. This means:
- Clinical authority remains with the healthcare professional. The treating physician or radiologist retains full authority to accept, modify, or disregard any AI-generated output based on their independent clinical judgment and the patient's individual circumstances.
- AI outputs are recommendations, not decisions. Our products present findings or enhanced images as supplementary information. They do not issue diagnoses, prescribe treatments, or trigger clinical actions without human intervention.
- Healthcare professionals using our products are expected to exercise genuine clinical judgment. Healthcare professionals retain full clinical authority over all AI-generated outputs, including the ability to: (i) access the underlying source data alongside AI outputs; (ii) override, modify, or disregard any AI-generated result; (iii) consider additional clinical information not processed by the AI system; and (iv) discontinue use of the AI system entirely in any particular case.
3. Data Protection Impact Assessments
Where our AI-powered products process health data or other special categories of personal data in a manner that is likely to result in a high risk to the rights and freedoms of individuals, we conduct Data Protection Impact Assessments (DPIAs) in accordance with Article 35 of the GDPR. Our DPIAs evaluate the necessity and proportionality of the processing, assess risks to data subjects, and identify measures to mitigate those risks. We review and update our DPIAs on an ongoing basis to reflect changes in our processing activities or risk profile.
Compliance with the EU Artificial Intelligence Act
Regulatory Classification
AIRS Medical manufactures AI-powered products, some of which are regulated as medical devices under the EU Medical Devices Regulation (“MDR”, Regulation (EU) 2017/745). As the MDR is listed in Annex I of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689) ("AI Act"), such products are classified as high-risk AI systems under Article 6(1) of the AI Act. As the provider of these products, AIRS Medical is subject to the obligations set out in Chapter III of the AI Act.
Human Oversight and Transparency
In accordance with Articles 13, 14, and 50 of the AI Act, our products are designed to ensure sufficient transparency and effective human oversight. Where our products generate or modify content (e.g., including enhanced medical images or AI-translated reports) we implement measures to ensure that such outputs are identifiable as AI-generated or AI-modified. All AI-generated outputs are subject to review and validation by qualified healthcare professionals, as described in the "AI-Assisted Processing" section above.
Post-Market Monitoring
AIRS Medical operates a post-market monitoring system in accordance with the AI Act and the MDR, actively collecting and analysing relevant data to evaluate the continued compliance and performance of our AI systems throughout their lifecycle.
Your Rights
Under the Article 85 and 86 of the AI Act, individuals affected by high-risk AI systems may lodge a complaint with a national market surveillance authority and request a meaningful explanation of the role of the AI system in a decision-making procedure. For inquiries, please contact us at: [email protected] or [email protected] (DPO)
Your Rights
In addition to the rights described in our Global Privacy Policy, you have the following rights under the GDPR:
(a) Rights in relation to AI-assisted processing (Article 22 GDPR) As described in the "AI-Assisted Processing" section above, our products do not engage in solely automated decision-making. Should you believe that a decision affecting you has been made without meaningful human involvement, you have the right to request human intervention, express your point of view, and contest the decision. Because clinical decisions are ultimately made by your healthcare provider (the Data Controller), requests regarding specific medical outcomes will be directed to the relevant healthcare institution.
(b) Right to lodge a complaint You may lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement.
How to Exercise Your Rights
If you wish to exercise any of the above rights, or if you have questions about how our AI systems process your data, you may contact us at:
- Data Protection Officer: Jan Boennighaus
- Email: [email protected]
If your data has been provided to AIRS Medical by a healthcare institution, we may direct your request to the relevant Data Controller, as they are responsible for managing your rights in respect of the data they have collected.
We will respond to your request without undue delay and in any event within one (1) month of receipt, in accordance with Article 12 of the GDPR.
DATA PROTECTION OFFICER (DPO)
AIRS Medical Europe GmbH has designated a Data Protection Officer (DPO) for the European Economic Area.
If you are located in the European Economic Area and have questions or concerns regarding the processing of your personal data, or wish to exercise your rights under the GDPR, you may contact our DPO directly:
- Attn: Data Protection Officer
- Email Address: [email protected]
- Postal Address: Oskar-von-Miller-Ring 20, 80333 Munich, Germany
SUPERVISORY AUTHORITY
The competent data protection authority for AIRS Medical Europe GmbH is the Bavarian State Commissioner for Data Protection (Bayerischer Landesbeauftragter für den Datenschutz). Data subjects in the EEA have the right to lodge a complaint with this authority or with the supervisory authority in their country of residence.
- Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
- Postal Address: Promenade 18, 91522 Ansbach, Germany
- Telephone: +49 (0) 981 180093-0
- Email: [email protected]
- Website: https://www.lda.bayern.de
| Date | Version | Description of Change(s) | Reason for Change(s) | Change(s) Made by |
|---|---|---|---|---|
| May 14, 2026 | 2.0 | Comprehensive update including GDPR-compliant sections | Specific obligations under GDPR | Hyejun Yoon |
| November 07, 2025 | 1.0 | Initial Release | Enactment | HaeRi Lee |