Data Protection and Medical Records

Operational requirements for CAA applicant information and associated practice records at Altitude Aeromedical. Applies to Dr Forrington and anyone authorised to handle these records.

Document: AA-GOV-02 | Version 1.0
Owner: Dr Simon John Forrington
Effective date: 16 September 2026
Review due: 16 September 2027 or earlier after a material change

Responsibilities and controller roles

The UK Civil Aviation Authority is the data controller for the regulatory medical records it processes for aviation medical certification, including its Cellma system. Altitude Aeromedical Group Limited, trading as Altitude Aeromedical, is responsible as controller for its own booking, billing, correspondence, complaints and any clinical records processed for its own purposes. The CAA’s role does not make it controller of every practice business record.

Dr Forrington leads local information governance. Record the purpose, controller role, lawful basis, recipients, storage and retention of each data flow. Apply CAA instructions when handling CAA records. Do not assert a blanket processor or joint-controller relationship: document the actual arrangement and obtain clarification from CAA where needed.

Before handling applicant information

  • Maintain a processing register, ICO fee registration or documented exemption, staff confidentiality undertakings and appropriate supplier contracts. Assess security, overseas access and any need for a data protection impact assessment before using a new service.
  • Provide AA-GOV-03 at collection, through the website or booking information and as a clinic copy. Collect only necessary details; public booking notes must ask applicants not to enter medical information.
  • Identify authorised users and limit access by role. Verify staff training and any CAA approval for Cellma access; nomination as chaperone or contingency contact does not itself confer access.

Lawful use and confidentiality

Use Article 6(1)(b) for necessary booking and contracted clinical services; Article 6(1)(c) for identified legal duties; and Article 6(1)(f), with a recorded balancing assessment, for necessary practice administration, complaint handling and legal defence.

For the practice’s medical assessment and care use Article 9(2)(h) with the relevant DPA 2018 Schedule 1 condition and professional secrecy safeguards; Article 9(2)(f) applies where necessary for legal claims. Record the basis by purpose, not as a list of interchangeable grounds.

Collecting and securing records

Consent and record quality

Explain Cellma use and document the applicant’s consent before accessing their record; obtain the required consent before specialist record review. Clinical consent and confidentiality permissions are distinct from the UK GDPR lawful basis. Check identity, CAA reference and source of incoming information, use dated attributable entries, and preserve an audit trail when correcting errors.

Working standard for temporary storage

Electronic working documents will be stored using Apple iCloud, with password protection; portable USB storage will not be used. Before clinical use, Dr Forrington must verify a dedicated practice-controlled account or an equivalently segregated arrangement, two-factor authentication, encryption and locking of every synchronised device, restricted sharing, supported software and security updates.

Prevent access through household accounts, shared folders and unmanaged devices. Password protection alone does not establish that these controls are in place. Keep a tested recovery arrangement for pending records.

Any paper records will be kept in secure, locked storage at Dr Forrington’s home address, held in the restricted practice continuity record. Restrict key access to authorised people. At the clinic and in transit, keep papers in a closed, locked records case under personal control; do not leave them in an unattended vehicle.

Clear desks and printers and prevent viewing or overhearing by other premises users. Record key custody, the home storage location and authorised recovery arrangements before use.

The owner must assess and record Apple’s service terms, controller/processor roles, any required processing contract and transfer safeguards before storing applicant health data in iCloud. Check actual encryption settings; do not claim end-to-end encryption merely because a password is used.

iCloud synchronisation alone is not an independent backup. If the account arrangement cannot meet the required confidentiality, recovery and supplier safeguards, do not use it for medical records until an appropriate arrangement is established.

Upload and reconciliation

Maintain a pending-records log with applicant identifier, document date, receipt date, upload status and reviewer. Upload promptly, check the correct applicant and every page for legibility, then record successful reconciliation.

Do not treat a failed upload as completion. CAA terms normally require submission within 14 days of assessment; changes in fitness status require entry as soon as possible and no later than three working days.

During an outage, preserve records securely, log pending actions and reconcile when access returns. Contact CAA for case handling where an outage prevents a required action. Do not certify without the information and authority required for the assessment.

Sharing and access control

Use Cellma or a suitably secured transfer route agreed with the recipient. Verify address, identity, purpose and attachments before sending; send only what is needed. Record significant disclosures and the confidentiality justification.

Do not give employers, flying schools, relatives, pharmacy or Gama staff routine access. Never share a Cellma login; remove access when roles end and notify CAA as required.

Retention and individual rights

Retention and disposal

The owner must maintain a retention log by record category. The CAA’s published AME schedule differentiates private-pilot records (minimum ten years after the last application or certificate) from commercial, ATCO and denied or deferred cases (minimum seventy years).

The schedule predates Cellma: obtain CAA direction before destroying original regulatory records or deciding that an upload replaces a retention obligation. Review records of applicants absent for five years for secure transfer to CAA.

CAA-held retention is separate: its Cellma notice describes ten years after the last certificate expires for private pilots before archiving, and seventy years for Class 1, Class 3 or anyone who has flown commercially. Do not promise deletion of all records after ten years.

Local practice policy: retain routine enquiries that do not become an appointment for 12 months after closure; retain booking and financial administration for six years after the relevant financial year ends; retain separate complaint files for six years after closure.

Review at expiry, minimise duplicates and document any extension for an unresolved claim, investigation, safeguarding issue or legal requirement. Clinical evidence within a complaint remains subject to the clinical record schedule.

Treat temporary files as pending regulatory records until reconciled. After reconciliation, delete only dispensable duplicate working copies under an approved retention decision.

Use confidential shredding for paper and secure electronic disposal, including the managed expiry of backups. Record date, category, authority and method; never destroy material subject to a hold.

Access and other rights

Recognise requests made verbally or in writing; record receipt and verify identity proportionately. Respond to requests about practice-controlled data without undue delay, normally within one month.

If law permits an extension for complexity or multiple requests, explain it within the initial month. Use current ICO rules for any identity or clarification pause; do not delay requests administratively.

Check third-party confidentiality and any applicable health-record exemption before disclosure; obtain clinical review when needed. Explain any restriction and routes to challenge it.

Facilitate CAA record requests through Cellma or the CAA information-rights route while responding for the practice’s own records. Consider rectification, restriction, erasure, objection and portability according to the relevant basis; these rights do not automatically override required retention.

Incidents and continuity

Suspected loss or disclosure

Anyone discovering an incident must alert Dr Forrington immediately, contain it safely and preserve evidence. Record what happened, data and people affected, timing, risk, mitigation and decisions.

Notify CAA-related actual or potential breaches promptly to ameoversight@caa.co.uk. For practice-controlled data, notify ICO without undue delay and within 72 hours of awareness unless risk to individuals is unlikely; inform affected people without undue delay if risk is high. Coordinate with CAA without assuming its notification discharges Altitude’s duties.

Contingency and cessation

Miss Sara Walsh, Clinical Services Manager, Gama Aviation Medical Department, Bournemouth Airport, is the nominated contingency contact to arrange secure return of CAA medical records if Dr Simon John Forrington is unavailable.

Keep her acceptance of the role and a tested access plan in the restricted continuity record. This must include storage locations and an authorised recovery process; it must not contain a shared Cellma password.

Sara must secure pending paper and electronic records, contact the CAA Medical Department, agree an authorised recipient and transfer method, and create an inventory of transferred records with receipt confirmation.

She must not make certificatory decisions or use Simon’s login. If personal access to medical content is unnecessary, arrange transfer without opening it. If Sara is unavailable, seek CAA direction promptly and nominate an authorised replacement; protect records throughout.

For retirement, revocation or death, arrange CAA notification within one week and expeditious return of medical records under CAA procedures. For other cessation or prolonged absence, notify CAA promptly, agree continuity and protect applicants with pending cases.

Keep practice business records under their separate retention arrangements; document closure, access removal and final receipt.

Assurance

Before the first clinic and at least annually, check access permissions, storage, recovery, pending uploads, retention and incident learning. Record owner actions and completion dates.

Review this SOP after a breach, supplier change, material guidance change or change of premises.

Source guidance

Checked 16 September 2026. Read these with the current CAA approval conditions and subsequent updates. Local service targets and working arrangements are practice policy, not CAA statutory deadlines.

  • CAA — AME Terms and Conditions, October 2025, published v6.1 file
  • CAA — How we use your information stored in Cellma
  • CAA — Medical retention periods, January 2018 v4.0, currently linked schedule
  • ICO — Conditions for processing special category data
  • ICO — A guide to subject access, updated 16 July 2026
  • ICO — Personal data breaches guidance
  • Apple — iCloud data security overview
  • Apple — Privacy Policy