Running a compliant aeromedical centre
An AeMC combines aviation requirements (Part-ORA, Part-MED) with health-data protection requirements. These points help structure the approach; they replace neither the texts nor your DPO's advice.
Record keeping
Part-MED and Part-ORA require examination records to be kept, the required reports to be sent to the licensing authority and confidentiality to be ensured.
- Complete, dated, signed and retrievable records.
- Retention periods in line with European and national requirements.
- Traceability of transmissions to the authority.
- Procedures documented in the organisation's manual.
GDPR and health data
Health data are a special category under Article 9 GDPR. Processing them requires an appropriate legal basis, reinforced security measures and clear information for data subjects.
- Record of processing activities and DPIA where required.
- Access control, logging, encryption.
- National health-data hosting requirements (for example HDS certification in France).
- Handling of data-subject rights and data breaches.
Preparing for authority oversight
The competent authority oversees AeMCs under an oversight programme (Part-ARA). Continuous preparation reduces findings.
- Up-to-date manual and procedures.
- Staff qualifications and training kept current.
- Equipment and calibration tracking.
- Handling findings: root-cause analysis and corrective actions on time.
Frequently asked questions
- Do an AeMC's data fall under Article 9 GDPR?
- Yes, data relating to medical fitness are health data, a special category under Article 9.