Privacy Notice

1. Introduction

Welcome to Aviation Mental Health. We are committed to protecting your privacy and handling your personal data in an open and transparent manner. This Privacy Notice explains how we collect, use, store, share, and protect your personal information, particularly the sensitive mental health data you provide through our questionnaire for aviation licence applicants.

This notice is designed to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

4. What Personal Data We Collect

We collect the following categories of personal data from you:

• Identity Data: Your full name, date of birth, applicant identification numbers, and contact details (e.g., email address, phone number, postal address).
• Special Category Health Data: Information you provide in response to the mental health symptom questionnaire. This includes details about your mental health status, history, symptoms, and any related conditions or treatments. This is "special category data" under UK GDPR and is treated with the highest level of care and security.

6. Who We Share Your Personal Data With

To facilitate the assessment of your medical fitness for an aviation licence, we will share your personal data, including your mental health questionnaire responses, with the following parties:

• The UK Civil Aviation Authority (CAA): As the regulatory body for aviation safety in the UK, the CAA requires this information to make decisions regarding your medical certification. The CAA may act as a separate data controller for the data it receives.
• Authorised Aeromedical Examiners (AMEs): AMEs who are involved in assessing your medical application will have access to your information to perform their duties.

We do not sell your personal data to third parties. We will only disclose your personal data to other third parties if required by law, or with your further explicit consent.

7. International Data Transfers

Your personal data collected through this website is primarily stored and processed within the United Kingdom (UK).

If any transfer of your data outside the UK or the European Economic Area (EEA) by Aviation Mental Health becomes necessary, we will ensure that such transfers are lawful and that your data is protected by appropriate safeguards as required by the UK GDPR (e.g., through an adequacy decision, or by implementing Standard Contractual Clauses with a supplementary Transfer Risk Assessment).

Please note that once your data is shared with the UK Civil Aviation Authority (CAA), the CAA is responsible for its own data handling practices, including any international transfers they may undertake. You should refer to the CAA's privacy information for details on their data processing.

10. Your Data Protection Rights

Under the UK GDPR, you have several rights concerning your personal data. These include:

• Right to be Informed: You have the right to be informed about how we collect and use your personal data. This Privacy Notice fulfils that right.
• Right of Access: You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You have the right to have inaccurate personal data corrected, or completed if it is incomplete.
• Right to Erasure (Right to be Forgotten): You have the right to request the deletion or removal of your personal data in certain circumstances. However, this right is not absolute and may be overridden by legal obligations. For example, due to the CAA's mandated retention periods for aviation medical records, we may be legally required to retain your data even if you request its erasure. We will inform you if this is the case.
• Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data in certain situations.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit this data to another controller, where processing is based on your consent and carried out by automated means.
• Right to Object: You have the right to object to the processing of your personal data in certain circumstances, for example, for direct marketing purposes (which we do not do with this data).
• Right to Withdraw Consent: As our processing of your mental health data is based on your explicit consent, you have the right to withdraw this consent at any time. Withdrawing consent will not affect the lawfulness of any processing carried out before you withdrew your consent. If you withdraw consent, we will no longer be able to process your mental health questionnaire for your aviation licence application, which may mean your application cannot proceed.
• Rights Related to Automated Decision-Making and Profiling: We do not currently use your mental health data for solely automated decision-making that has legal or similarly significant effects on you. If this changes, we will update this notice and ensure appropriate safeguards are in place.

How to Exercise Your Rights:

To exercise any of these rights, please contact our Data Protection Officer using the details provided in Section 3. We will respond to your request within one month, although this period may be extended by a further two months if the request is complex or we receive a number of requests. We will inform you of any such extension.

We do not usually charge a fee to exercise your rights, unless your request is manifestly unfounded, repetitive, or excessive.