Privacy Policy
How Medical Cert UK collects, uses and protects your personal and health data under the UK GDPR and the Data Protection Act 2018.
This notice explains how Medical Cert UK handles personal data, including health information, when you use FitToFlyCertificate.co.uk. It is written to meet the UK GDPR and the Data Protection Act 2018.
Last updated: 19 August 2026
Who is responsible for your data
The data controller is Nobel Medical LLC, trading as Medical Cert UK, a company established in Delaware, United States. The service is offered to people in the United Kingdom, so the UK GDPR applies to this processing under Article 3(2). We are registered with the Information Commissioner's Office (ICO) under registration number ZC112101.
- Email: [email protected]
- Telephone: +44 131 270 3762 for pre-purchase queries, or +44 161 391 0155 about a consultation already in review
- Registered office: Nobel Medical LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, USA
UK Representative
As Nobel Medical LLC is established outside the United Kingdom, we have appointed a UK Representative under Article 27 of the UK GDPR. People in the UK and the Information Commissioner's Office may contact our UK Representative directly about any matter relating to the processing of their personal data.
GDPRLocal Ltd
Attn: Adam Brogden
1st Floor Front Suite, 27-29 North Street
Brighton, England, BN1 1EB, United Kingdom
- Email: [email protected]
- Privacy request submission page: nobelmedicalllc.gdprlocal.com/uk
You may contact our UK Representative instead of contacting us directly. They will forward your enquiry to us and we will respond as required by law.
What information we collect
| Category | Examples |
|---|---|
| Identity and contact | Name, date of birth, email address, telephone number |
| Health information | Medical history, current medication, declared conditions, symptoms during exercise, and any test results or event forms you upload |
| Event information | The event or activity you need a certificate for, and any organiser template you supply |
| Transaction | Records of certificates requested and issued, and payment confirmation. Card details are handled by our payment provider and are not stored by us |
| Technical and usage | IP address, device and browser type, and pages visited, collected through our analytics tool |
Health data and why we are allowed to process it
Health information is special category data under Article 9 of the UK GDPR and carries additional protection. Processing it lawfully requires both an Article 6 lawful basis and a separate Article 9 condition.
- Article 9(2)(h) UK GDPR, processing necessary for preventive or occupational medicine and for the provision of health care or treatment.
- Paragraph 2 of Part 1 of Schedule 1 to the Data Protection Act 2018, the health or social care purposes condition, which is the domestic law basis Article 9(2)(h) requires.
- Article 9(3) UK GDPR and section 11(1) of the Data Protection Act 2018, which require the processing to be carried out by or under the responsibility of a person owing a duty of confidentiality. Our reviewing clinicians are registered with the General Medical Council and are bound by professional confidentiality.
Where we ask for your explicit consent to a specific additional use, we rely on Article 9(2)(a). You can withdraw that consent at any time, which does not affect processing carried out before you withdrew it.
Our lawful bases
| Purpose | Lawful basis (Article 6) |
|---|---|
| Assessing your request and issuing or declining a certificate | Performance of a contract |
| Taking payment and issuing refunds | Performance of a contract |
| Responding to enquiries | Legitimate interests, namely answering people who contact us |
| Keeping clinical records | Legal obligation, and legitimate interests in defending clinical decisions |
| Website analytics | Consent |
Who we share information with
We do not sell personal data. We share it only where necessary, with:
- the GMC-registered clinicians who review your submission;
- our payment provider, to take payment and process refunds;
- our hosting and email providers, acting on our instructions as processors;
- our analytics provider, as described in our cookie policy;
- regulators, insurers or legal advisers where we are required or permitted to do so by law.
We do not send your certificate or health information to an event organiser. You decide whether to submit it.
International transfers
Our service is provided to people in the United Kingdom, but the controller is established in the United States, so your information is transferred outside the UK as part of normal operation. Clinical review is carried out by doctors on the UK General Medical Council register.
For that transfer, and for any provider processing data outside the UK, we rely on UK adequacy regulations where they apply, including the UK Extension to the EU to US Data Privacy Framework where the receiving organisation is certified under it. Where no adequacy route applies we rely on the International Data Transfer Agreement, or the UK Addendum to the European Commission standard contractual clauses, together with a transfer risk assessment. You can ask us which route applies to your data using the contact details above.
How long we keep it
The General Medical Council directs doctors to follow the UK health departments' guidance on record retention even when they are not working in the NHS. We therefore apply the periods in the NHS Records Management Code of Practice 2021.
| Record | Retention period |
|---|---|
| Clinical record of an adult assessment | 8 years from the date of the assessment |
| Clinical record where the patient was under 18 | Until their 25th birthday, or their 26th birthday if they were 17 when the record was made |
| Enquiries that do not lead to an application | 12 months, then deleted |
| Payment and transaction records | 6 years, to meet tax and accounting obligations |
These are minimum periods. A record may be kept for longer where there is a specific justification, such as an ongoing complaint or claim. When a retention period ends the record is securely deleted or destroyed.
Your rights
Under the UK GDPR you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- ask us to erase data, where no overriding reason to keep it applies;
- ask us to restrict processing while a query is resolved;
- object to processing carried out on the basis of legitimate interests;
- receive certain data in a portable format;
- withdraw consent where consent is the basis we rely on.
Clinical records cannot always be erased on request, because a record of a clinical decision may need to be retained. If that applies we will explain why.
To exercise any right, email [email protected], or use our UK Representative's privacy request page. We respond within one month.
Do you have to give us this information
You do not have to give us anything. If you want a certificate, we need the health information described above in order to assess your request, so a decision not to provide it means we cannot carry out the assessment. There is no other consequence.
Automated decisions
We do not make decisions about you by automated means alone, and we do not carry out profiling. Every certificate decision is made by a GMC-registered doctor who reviews your submission individually.
Data protection officer
We are not required to appoint a statutory data protection officer and have not appointed one. Data protection queries are handled through the contact details above.
Complaints
If you are unhappy with how we have handled your data, please contact us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or in writing to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Security
We use encryption in transit, access controls, and restrict access to health information to the clinicians and staff who need it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we take reasonable steps to protect your information and will notify you and the ICO of a qualifying personal data breach where the law requires it.
Children
This service is intended for adults. Where a certificate is sought for someone under 18, it must be requested by a parent or legal guardian.
Changes
We may update this notice. The date at the top shows when it was last changed, and material changes will be highlighted on this page.
Need a fit to fly certificate?
Complete the online consultation. A GMC-registered UK doctor reviews every request individually.
Get startedReviewed by a GMC-registered GP. Full refund if a certificate cannot be issued on clinical grounds.