Applicant Privacy Notice
How Altitude Aeromedical uses personal information when you enquire about or attend for a UK CAA medical assessment. Class 2 medical appointments are not offered until the required CAA approval is in place.
Document: AA-GOV-03 | Version 1.0
Owner: Dr Simon John Forrington
Effective date: 16 September 2026
Review due: 16 September 2027 or earlier after a material change
Who is responsible
Altitude Aeromedical is the trading name of Altitude Aeromedical Group Limited. We control our own booking, billing, correspondence, complaints and clinical information processed for our own practice purposes.
Our privacy contact is Dr Simon John Forrington. You may also speak to him privately at the clinic or write to him at Altitude Aeromedical, North Camp Pharmacy, 39–41 Camp Road, Farnborough, Hampshire GU14 6EN.
The UK Civil Aviation Authority (CAA) is the data controller for regulatory medical information it processes for aviation medical certification, including records in Cellma. It decides how that information is used for its regulatory functions. This does not make the CAA controller of all Altitude business information. Its separate Cellma privacy notice explains its processing and your rights.
What we collect and why
We use identity and contact details, CAA reference and relevant licence information, appointment and payment records, correspondence, medical history, examination findings, test results and specialist reports.
We collect information from you, our assessments and, where appropriate, your CAA record and treating or assessing professionals. We use it to organise appointments, assess medical fitness, communicate results, arrange relevant investigations and referrals, maintain accurate records and meet our professional and regulatory responsibilities.
We also use the minimum information needed to manage payments, resolve complaints, improve service safety and handle legal matters.
Please do not enter medical details in a public website enquiry or booking notes field. Ask us how to send sensitive information securely.
Choices and assessment
We explain and record your consent before accessing Cellma and before relevant specialist record review. We also seek consent for examination and explain sharing under medical confidentiality.
If you decline information or access needed for a safe regulatory assessment, we may be unable to complete it or issue a certificate. Withdrawing a permission does not automatically require lawful historical records to be erased.
Legal grounds and sharing
Our legal grounds
For our own processing, necessary appointment and contracted assessment information is used under UK GDPR Article 6(1)(b). We use Article 6(1)(c) where a specific legal obligation applies. Necessary administration, complaints and legal defence may rely on Article 6(1)(f): our legitimate interests in running a safe service and addressing concerns, balanced against your rights.
For medical assessment and healthcare information we also rely on Article 9(2)(h), with the applicable Data Protection Act 2018 condition and professional confidentiality safeguards. For necessary legal claims, Article 9(2)(f) may apply. We do not treat consent to examination as blanket consent to every use of your information.
The CAA’s published Cellma notice identifies Article 6(1)(e), public task or official authority, and Article 9(2)(g), substantial public interest, for its processing. Those are the CAA’s stated grounds, not a claim that every activity of this private practice is a public task.
Who may receive information
Information relevant to certification is shared with the CAA. Relevant doctors, laboratories and other health professionals may receive what is needed for an assessment or referral, with appropriate confidentiality permissions.
Authorised staff and contracted providers may handle limited information needed for their roles, such as secure IT, appointment administration and payment services. We require appropriate safeguards and restrict access.
We may disclose information when law requires it, or where another lawful and justified confidentiality exception applies.
We do not routinely send your detailed medical record to an employer, flying school, family member or premises provider. Sara Walsh is our contingency contact to arrange secure return of CAA records if Dr Forrington is unavailable; access is limited to what is authorised and necessary.
Storage and international access
Our electronic working documents use Apple iCloud; any paper records are kept in secure, locked storage at Dr Forrington’s home. We do not use portable USB storage. Access is restricted to authorised people.
iCloud may involve processing outside the UK. Before collecting medical information into this service, we assess the applicable account terms, access controls and international transfer safeguards and make the relevant details available.
CAA separately describes UK Cellma storage and safeguarded technical support access from India. Ask our privacy contact for details of the safeguards applicable to your information.
We do not make medical certification decisions solely by automated processing. A clinician assesses your case.
This notice covers applicant information; any website cookies, analytics or additional online services require their own accurate information and choices.
Retention and your rights
How long information is kept
We follow the applicable CAA medical retention arrangements. The published AME schedule gives minimum periods of ten years for private-pilot records and seventy years for commercial, ATCO and denied or deferred cases, measured from the last application or certificate.
We seek CAA direction before disposal or transfer where the category or status is unclear. Uploading a record does not itself authorise destruction of an original.
CAA’s own notice describes private-pilot records being archived after ten years following the last certificate’s expiry and a seventy-year period for Class 1, Class 3 or anyone who has flown commercially. The CAA manages those records under its own schedule.
Our local policy keeps routine enquiries not leading to an appointment for 12 months after closure; booking and financial administration for six years after the relevant financial year; and separate complaint files for six years after closure.
We review records then and retain them longer only where justified, for example by an unresolved claim or investigation. Clinical material is governed by the clinical schedule. We remove unnecessary duplicate working copies securely when permitted.
Access and other rights
You can ask for access to and correction of your personal information and, where applicable, erasure, restriction, portability or an objection to processing.
These rights depend on the purpose and legal basis; a request cannot always override regulatory or legal retention. Where we rely on consent as the data protection basis, you may withdraw it without affecting the lawfulness of earlier processing.
Contact Dr Forrington for information held by the practice. We normally respond within one month and explain any lawful extension or restriction.
For CAA-held information, you can view your medical record in Cellma and use the CAA information-rights route. We will help direct a request without ignoring our own responsibilities.
Concerns about privacy
Please raise a concern with Dr Forrington so that we can investigate.
You can also complain to the Information Commissioner’s Office (ICO) at ICO — Make a complaint.
For CAA processing, its published information-rights contact is FOI.requests@caa.co.uk. You do not need to complete our service complaints procedure before contacting the ICO.
Further information
- CAA — How we use your information stored in Cellma
- CAA — Personal data and information rights
- ICO — Make a complaint
- Apple — Privacy Policy