Consumer Health Data Privacy Notice

1. Scope

This notice supplements our Privacy Policy and applies to consumer health data processed through AME Foresight. It is intended to describe information covered by laws such as Washington's My Health My Data Act. AME Foresight is not a medical provider and does not provide medical advice.

2. Consumer Health Data We Collect

The FAA Medical Prep tool does not transmit the conditions, certificate selections, planned examination date, FAA-history selections, condition-specific answers, or checklist progress you enter. The website stores those entries only in session storage for the current browser tab so a refresh or return to the page in that tab does not erase your work. They are cleared when you choose Reset or close the tab. AME Foresight does not receive those entries, so they are not part of the consumer health data we collect.

Like any website or in-app web request, opening the Medical Prep page requires DigitalOcean and Cloudflare to process limited technical request information such as IP address, browser or app user-agent, request path, and timestamps for delivery and security. AME Foresight excludes the Medical Prep route from its first-party website page-view measurement. The mobile app separately records only that the Medical Advisor screen was opened, not the conditions or answers entered in the tool.

If you voluntarily submit a Medical Prep guidance-accuracy report, we collect the selected condition topic, the report text, review status, and timestamps. The form does not request a name, contact information, account, or medical history and is submitted without account credentials. Do not include personal health details; if you include them despite that instruction, they will be contained in the report we receive.

When you choose to send an AME scheduling request, we may collect:

• Your name, email address, and required phone number
• The AME and office you selected
• The requested exam type, such as first, second, or third class, or BasicMed
• Whether you are a new or returning pilot and your requested timing or date
• Optional scheduling and office-logistics notes
• Limited security information, including IP address and browser user-agent

Do not submit diagnoses, medications, medical history, medical records, Social Security numbers, or other clinical information. The form does not accept document uploads.

3. Sources and Purposes

Scheduling-request and guidance-report content comes directly from you. Technical request information comes from your browser or app and our delivery and security providers. We use these categories only to provide the feature or request you chose, deliver and secure the service, prevent abuse, review and correct FAA guidance, respond to support or rights requests, and comply with legal obligations.

4. How We Share Consumer Health Data

Depending on the feature you choose, consumer health data may be processed by or shared with:

• The AME or AME office you selected, only for a scheduling request so the office can respond
• DigitalOcean, which hosts the application and database, including scheduling requests and guidance-accuracy reports
• SendGrid, which delivers scheduling-request notification email
• Cloudflare, which provides website delivery and security and processes limited request information
• Authorities or other parties when required by law or necessary to protect rights and safety

We do not sell consumer health data, use it for targeted advertising, or share it with data brokers. We have no affiliates that receive this information for their own purposes. We do not use geofencing around healthcare facilities to identify or track people, collect consumer health data, or send health-related advertising.

5. Your Choices and Rights

Depending on applicable law, you may ask us to:

• Confirm whether we collect, share, or sell your consumer health data
• Provide access to the consumer health data associated with your request
• Delete consumer health data held by us and notify applicable service providers
• Withdraw consent for future collection or sharing
• Provide a list of the third parties and affiliates with whom your data was shared

Submit a request through our contact form. You do not need an account. We may need to verify your identity before acting on a request. If we deny a request, you may appeal by replying to our decision or submitting another contact form marked as an appeal. Where Washington's My Health My Data Act applies, we will respond within the time required by law and provide the Attorney General complaint mechanism if an appeal is denied.

6. Retention

AME scheduling requests and their security metadata are normally retained for no more than 24 months. We may retain a record longer when reasonably necessary for an active dispute, fraud or security investigation, legal hold, or other legal obligation. A verified deletion request may require earlier deletion under applicable law.

Guidance-accuracy reports are retained while reasonably needed to investigate the report, correct or document the guidance, prevent repeated abuse, and maintain an accountable source-review history. AME Foresight-controlled technical records are normally retained for no more than 24 months before deletion or aggregation, subject to the exceptions above.

7. Changes and Contact

We may update this notice as our practices or legal obligations change. Questions and rights requests may be submitted through the AME Foresight contact form.