1. Introduction

Bristol Aviation Medicals Ltd) is authorised to provide regulatory aviation medical assessment services on behalf of the UK Civil Aviation Authority and the US Federal Aviation Administration for pilots, air traffic control officers and cabin crew.

When you register as a client with us. we gain a legitimate interest in storing and using your information in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

Under GDPR, health information has a higher degree of protection than general personal data. We hold your health information with your explicit consent, and for regulatory purposes only.

If we carry out an aviation medical for you and your medical records are held by the UK Civil Aviation Authority (CAA), the CAA is the Data Controller for your personal information, and we act as Data Processors. The CAA Data Protection Officer can be contacted via email at FOI.requests@caa.co.uk

For all other services, Bristol Aviation Medicals Ltd can be considered as the Data Controller. We are registered with the Information Commissioners Office (ICO), registration number ZA078115

2. What personal information do we hold about you?

Personal data	Source
Name, email address and phone number	You
Residential and postal address	You and your regulator
Doctor’s name and address	You and your regulator
Employer and employment details	You and your regulator
Photo ID document	You
Details of booked appointments	You and Setmore booking software
National Aviation Identifiers	You and your regulator
Specific sensitive health and medical data	You, your regulator and other specialist health professionals authorised by you

3. How do we store your personal information?

Any hardcopies of your information are stored in locked metal filing cabinets

Electronic copies of your information are stored on password protected computers using full disk encryption

For CAA and FAA medicals, an electronic copy of your information is stored on the medical records database at the CAA or FAA respectively

4. How do we use/share your personal information?

Your personal information is used for the sole purpose of determining your medical status, issuing medical certificates and maintaining a full and complete medical history as required by the relevant regulating bodies such as the CAA and the FAA. We will also use it to contact you on matters pertaining to your medical certification.

For aviation medical clients we will also share your information with the CAA (or the FAA if your state of licence issue is the USA) to be used solely for regulatory purposes.

Your personal information will not be shared with any other person or official body without your express permission, unless we are required to do so by law.

5. How long do we hold your personal information for?

For all services we will normally retain your personal information at least until such time as you advise us that you no longer wish to be registered with our practice.

For aviation medical clients, we are required by the CAA to hold your medical records until such time as we cease providing aeromedical services due to retirement or closure of the business.

When we cease providing aeromedical services all hardcopy records will be returned to the CAA and all electronic copies will be deleted.

The CAA Medical Records Retention Schedule (2018) can be found here

6. What right of access and control do you have over your personal information?

At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:

• Right of access – you have the right to request a copy of the information that we hold about you. Requests for CAA or FAA-held medical records must be made to the relevant Aviation Authority.
• Right of rectification – you have the right to correct data that we hold about you that is inaccurate or incomplete.
• Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
• Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
• Right of portability – you have the right to have the data we hold about you transferred to another organisation.
• Right to object – you have the right to object to certain types of processing such as direct marketing.
• Right to object to automated processing, including profiling – you also have the right to be subject to the legal effects of automated processing or profiling.
• Right to judicial review: in the event that Bristol Aviation Medicals Ltd refuses your request under rights of access, we will provide you with a reason as to why. You have the right to complain as outlined below.

All of the above requests will be forwarded on should there be a third party involved in the processing of your personal data.

We are obliged to confirm your identity before providing, amending or deleting any of your personal information at your request. This is done in person with either a current passport or photo driving licence.

In the event that you wish to make a complaint about how your personal data is being processed by Bristol Aviation Medicals Ltd, or how your complaint has been handled, you have the right to lodge a complaint directly with the supervisory authority and the Bristol Aviation Medicals Ltd Data Protection Officer.