Consumer Health Data Privacy Notice

1. Scope

This notice supplements our Privacy Policy and applies to consumer health data processed through AME Foresight. It is intended to describe information covered by laws such as Washington's My Health My Data Act. AME Foresight is not a medical provider and does not provide medical advice.

2. Consumer Health Data We Collect

When you choose to send an AME scheduling request, we may collect:

• Your name, email address, and required phone number
• The AME and office you selected
• The requested exam type, such as first, second, or third class, or BasicMed
• Whether you are a new or returning pilot and your requested timing or date
• Optional scheduling and office-logistics notes
• Limited security information, including IP address and browser user-agent

Do not submit diagnoses, medications, medical history, medical records, Social Security numbers, or other clinical information. The form does not accept document uploads.

3. Sources and Purposes

We collect this information directly from you after you affirmatively consent. We use it only to route and administer the scheduling request you asked us to send, prevent abuse, secure the service, respond to support requests, and comply with legal obligations.

4. How We Share Consumer Health Data

We may share the request with:

• The AME or AME office you selected, so the office can respond
• DigitalOcean, which hosts the application and database
• SendGrid, which delivers the request notification email
• Cloudflare, which provides website delivery and security services
• Authorities or other parties when required by law or necessary to protect rights and safety

We do not sell consumer health data, use it for targeted advertising, or share it with data brokers. We have no affiliates that receive this information for their own marketing purposes.

5. Your Choices and Rights

Depending on applicable law, you may ask us to:

• Confirm whether we collect, share, or sell your consumer health data
• Provide access to the consumer health data associated with your request
• Delete consumer health data held by us and notify applicable service providers
• Withdraw consent for future collection or sharing
• Provide a list of the third parties and affiliates with whom your data was shared

Submit a request through our contact form. You do not need an account. We may need to verify your identity before acting on a request. If we deny a request, you may appeal by replying to our decision or submitting another contact form marked as an appeal.

6. Retention

AME scheduling requests and their security metadata are normally retained for no more than 24 months. We may retain a record longer when reasonably necessary for an active dispute, fraud or security investigation, legal hold, or other legal obligation. A verified deletion request may require earlier deletion under applicable law.

7. Changes and Contact

We may update this notice as our practices or legal obligations change. Questions and rights requests may be submitted through the AME Foresight contact form.