Privacy Policy

The information we hold is kept to a minimum and required for the provision of occupational health services.

Employees name, date of birth, national insurance number, contact details, address

Our clinical staff needs to maintain personal information to meet statutory requirements and guidelines. It also enables us to keep an accurate record of contacts that we have had with you for medical and workplace assessments. Article 9 of the GDPR refers to holding and processing special category data. This includes health data. In Article 9 paragraph 2 (h) processing of occupational health data is stated as being justified.

The GDPR does include a right of the data subject to request erasure. However regarding medical data this right is superseded by other laws and regulations. Therefore the right to be forgotten is limited due to other legal requirements.

Medical records are kept confidential on cloud portal. The information is only accessed by occupational health staff for the provision of the service.

Due to professional requirements data cannot be anonymised for the performance of the medical assessment. We use encryption for safeguarding.

We do share the test results with the Department of Health & Social Care (DHSC) but no other third party organisations have access to your data.

There can be a legal obligation for disclosure due to the power to order a disclosure as it can be exercised by courts, tribunals or regulators or if a disclosure is in the public interest (e.g. if a person is putting others at significant risk).

Due to the sensitive nature of the information we may request additional information to establish your identity.

Medical information has to comply with additional requirements. A healthcare professional can therefore withhold information if it is felt it may cause serious harm to the physical or mental health of the individual if disclosed.

Should any information we hold not be accurate we would expect you to inform us so we can amend your information.