Privacy Notice

CORE Occupational Health Privacy Notice

Privacy Notice
CORE Occupational Health (OH) as both the Data Controller and Data Processor are committed to protecting the rights of the individual and acknowledge that any personal data of yours that we handle will be processed in accordance with the Data Protection Act 1998 (DPA) and the General Data Protection Regulations (GDPR) 2018. In addition, our registered health professions will adhere to their professional standards with regards to confidentiality.

What Data will be collected?
The following data maybe collected, held and shared by CORE OH
• Personal information (e.g. name, date of birth, occupational, gender, ethnicity)
• Contact details such as names, addresses, telephone numbers and GP contact(s)Characteristics (ethnicity, gender)
• Past and present occupational job roles and occupational exposure
• Health information that would be classed as ‘special category data’.

Who will it be collected from?
• You (the data subject)
• Your manager and Human Resource
• Occupational Health Practitioners and other clinical staff working for or on behalf of Core O
• With your consent, your GP or other specialist from whom you have received treatment.

How will it be collected?
• Verbally, either via telephone calls or face to face conversations.
• In writing or electronically via forms that you or your manager complete as part of the management referral process or for health surveillance, or via reports sent to us from other parties, e.g. from your GP.

How will this data be used?
We use this data to:
• Identify you and ensure that your medical information is filed correctly
• Assess your health and your fitness to work
• Provide advice to managers on the impact of your health on work and work on your health
• Identify a baseline of your health against which to measure any future changes
• As the basis on which to provide advice to management on fitness for work and any adjustments that would help you to do your work
• Identify any additional support that would help you to improve your help

Why is it collected?
• For the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee. To ensure the health and safety of the employees at work and to allow consideration of any adjustments that may be required to support their ability to work.
• Data may also be used for research, audit or statistics but will be anonymised if this is the case.

Lawful Basis for processing the information
• To comply with the employer legal obligation such as health and safety, Duty of Care (Article 6 (f)
• Additional Special category - Article 9 (2)(h) specifically authorises processing of data as Occupational Medicine is a special category thus “processing is necessary for the purposes of Occupational Medicine” and Article 9 (3) which states that processing is permitted “When these data are processed by a regulated health professional”
• To fulfil the terms of a contract
• In connection with our legitimate interests

How long will data be held for?
• All general health records will be retained for 6 years from final contact, with the exception of Health Surveillance information- see below.  You will need to consult with your employer if the data is kept on site with them or they change OH providers.  
• Pre-placement medicals will be discarded after 2 years if the employee doesn’t take up the offer of the job.
• Health surveillance records will be stored for 40 years to comply with Health and Safety Legislation such as Control of Hazardous Substances at work 2012 (COSHH) or up to 75th Birthday (whichever is sooner) as recommended by British Medical Association (BMA) We will not routinely hold the Statutory Health Record which is an employer record.
• Unwanted records will be destroyed.

How will the data be stored?
• Your records will be stored securely and confidentially in accordance with CORE OH medical records storage policy complying with GDPR regulations and professional regulatory bodies.

Who will my information be shared with
• The information will be received and processed by CORE OH. We will not share personal data about you with anyone who is not involved in your care, including third parties without your explicit consent, unless there is a requirement under the law that allows us to.
What are your rights
• You have the right to see any information we hold about you in your Occupational Health record. The request should be made in writing and should be responded to within 4 weeks without charge.
• You can request that an amendment may be attached to your to your health record if you believe any of the information held by Core OH is inaccurate or misleading.