Nonimo for UK firms and practices
The NI number stays in the office. The AI still drafts the letter.
Nonimo replaces the reference numbers British paperwork carries with placeholders, right there on the desk, so what ChatGPT, Claude or Copilot receives has none of them; then it puts the originals back into the answer.
For accountants, solicitors and GP practices.
Mac with Apple silicon and macOS 14 or later · Windows 10 or later, 64-bit (x64) · under 2 MB.
The first time you open Nonimo, Windows may show a SmartScreen notice because the app is new: click “More info”, then “Run anyway”.
The 18 UK identifiers it takes out
Each one is swapped for its own placeholder while the passage is still on your desk, and the original comes back in the reply.
| Identifier | Where it turns up | What the AI reads |
|---|---|---|
| NHS number | GP letters, referrals, discharge summaries | [NHS_NUMBER_1] |
| National Insurance number | Payslips, P60s, HMRC letters | [NINO_1] |
| Unique Taxpayer Reference (UTR) | Self Assessment returns, HMRC correspondence | [UTR_1] |
| VAT registration number | Invoices, VAT returns | [VAT_NUMBER_GB_1] |
| Company registration number | Letterhead footers, email signatures, contracts | [COMPANY_NUMBER_GB_1] |
| Bank account number | Completion statements, payment instructions | [REFERENCE_1] |
| CHI number (Scotland) | NHS Scotland referrals, prescriptions, hospital letters | [CHI_NUMBER_1] |
| H&C number (Northern Ireland) | HSC referrals, GP records, prescriptions | [HC_NUMBER_1] |
| County Court claim number (online money claims) | Claim forms, defences, directions questionnaires | [COUNTY_COURT_CLAIM_1] |
| High Court claim number | Claim forms, sealed orders, witness statements | [HIGH_COURT_CLAIM_1] |
| Unique pupil number (UPN) | Pupil records, common transfer files, SEND referrals | [UPN_1] |
| DBS certificate number | Personnel files, single central records, onboarding checklists | [DBS_CERTIFICATE_1] |
| DBS Update Service ID | Job applications, staff files, status check records | [DBS_UPDATE_ID_1] |
| Immigration Health Surcharge (IHS) reference | Visa applications, surcharge payment receipts | [IHS_REFERENCE_1] |
| Asylum support reference | Home Office support letters, ASF1 applications, appeal bundles | [ASYLUM_SUPPORT_REF_1] |
| Driving licence number | Hire agreements, insurance claims | [DRIVING_LICENCE_1] |
| Postcode | GP registration forms, claim forms, KYC checklists | [POSTCODE_1] |
| Full postal address | Letterheads, client care letters, tenancy agreements | [ADDRESS_1] |
Alongside these, it catches client names, dates of birth, passports, IBANs, card numbers, emails and phone numbers, wherever they turn up.
What UK GDPR expects before anyone pastes
Neither the UK GDPR nor the Data Protection Act 2018 mentions chatbots, and neither needs to. Four duties decide whether a paste into one can be defended, and the ICO enforces every one of them.
Article 28
A contract with the processor
Business and enterprise plans can come with terms that satisfy Article 28. A personal account runs on consumer terms of use, which is a different document and gives the firm no processor contract at all.
Transfers
Data leaving the UK
Every major provider processes abroad, so a paste is usually a restricted transfer. The UK-US data bridge only helps where the US company is actively certified under the Data Privacy Framework, and that is worth checking rather than assuming.
Article 4(1)(5)
Pseudonymised is still personal
Replacing names and numbers with placeholders is pseudonymisation, and the result remains personal data. The ICO is plain that stripping direct identifiers does not make a file anonymous.
Article 33
Seventy-two hours to report
When personal data ends up where it should not and the people concerned are at risk, the ICO has to hear about it within 72 hours of the firm becoming aware.
That is data minimisation, the step the regulator puts first, and Nonimo turns it into a habit: the identifiers come out on the desk, before anything is sent. What is left is still personal data, so your lawful basis, contract and records all still apply. Tool by tool, the checks are in our checklist for UK firms choosing an AI tool.
A summary, not legal advice. Solicitors also answer to the SRA, whose August 2026 warning notice says paid and free AI tools alike may lack the safeguards client confidentiality needs, and accountants to the ICAEW Code.
Guides for UK firms
Answered against UK GDPR, the ICO and the professional rules that sit on top of them.
Special category personal data in AI: what UK GDPR asks
Special category data under UK GDPR hides in payslips, fit notes and tribunal files. Where it sits, why Article 9 applies, and what to cut before a prompt.
Engagement letter AI clause in England and Wales, ready to copy
Engagement letter AI clause for solicitors and accountants in England and Wales: what the SRA, PCRT and UK GDPR expect, and wording to copy.
Can NHS staff use ChatGPT? The patient details to take out first
Can NHS staff use ChatGPT? Only once the letter stops pointing to a patient. What UK GDPR, Caldicott and the DSPT expect, and what to remove before you paste.
Use of AI in court documents: what you sign in England and Wales
Use of AI in court documents: since 1 July 2026 the TCC Guide says if in doubt, disclose. What you sign, what the CJC proposes, what stays in the firm.
Pseudonymisation under UK GDPR: what to take out of a client file
The ICO says removing names and numbers is not effective anonymisation. What that leaves you holding under the UK GDPR, and how to test a file before it goes.
AI in local government: what council staff can and cannot use
What a council officer can put into ChatGPT or Copilot, what must never leave, and the UK rules that decide it: UK GDPR, the ICO, the ATRS and section 170.
GDPR compliant AI tools: what a UK business has to check
No tool is compliant by itself: your use of it is. The criteria that decide, the four assistants measured against them, and where UK transfers actually stand.
Does ChatGPT share your data, and how long does it keep it?
From OpenAI's pages: who it discloses to, how long a conversation lives, what the training switch does not stop, and whose company answers a UK user.
Does Claude train on your data, and what does it keep?
Anthropic's own pages: the training switch, the 30 days that become five years, the flagged chat kept for two, and where the data actually sits.
Does Gemini use your data, and who reads your chats?
Google's own privacy hub is unusually blunt about human reviewers. Training, the 18 months, the 72 hours, and the three years that survive deletion.
Is Microsoft Copilot safe for confidential information?
Four products share the name, and the answer changes with each. Microsoft's own pages on training, human review, the Bing carve out and the UK's place.
Cyber insurance comparison for UK small businesses
Six UK routes to cyber cover, compared from their own wordings and forms: limits, exclusions, excesses, what they require, and what they say about AI.
Price, and how far along it is
The desktop app is available on both platforms, Mac and Windows; the browser extension and the compliance panel are in development.
Nonimo’s free plan stops at a set number of words each month. Leave an email address on our licence page and a free licence file comes back that removes the cap until 31 January 2027, with no account to set up.
- Free today, on Mac and Windows
- With a monthly word allowance
- The free licence lifts it until 31 January 2027, no account needed
Questions UK firms ask
Does Nonimo send client data to the US, or anywhere else?
No. The passage you select is masked on your own machine, and none of it reaches us. The one thing the app reports home is a daily tally for the free allowance, covering words used this month, the version, the operating system and an install ID among the fields our security page lists in full.
Does Nonimo help a firm meet its UK GDPR obligations?
Nonimo helps a firm meet its UK GDPR obligations, but it cannot meet them for the firm. Pseudonymisation is one of the measures UK GDPR names in Articles 25 and 32(1)(a), and taking identifiers out before a paste reduces what the AI provider receives: that is data minimisation under Article 5(1)(c), and the step the ICO asks for wherever it can be taken. The lawful basis, the Article 28 contract with the provider, the transfer route and the record of processing all remain with the firm.
Does masking a file take it outside UK GDPR?
No. Article 4(1)(5) describes data that can no longer be tied to a person without extra information kept separately, and the ICO treats the result as personal data. Nonimo holds that extra information, the map from each placeholder back to its value, on your computer and nowhere else.
Is a business ChatGPT plan enough on its own?
It changes the contract, not the contents. A business plan can bring an Article 28 processor agreement that a personal account lacks, but the passage still reaches the provider with whatever identifiers it carries. The SRA's warning notice makes the same point for solicitors, and taking identifiers out first is the step the ICO asks for wherever it can be done.
What does Nonimo cost?
The free plan stops at a set number of words each month, and the licence that removes the cap is free until 31 January 2027, with no account to set up.