Privacy Notice
Who We Are
Medwyn Occupational Health is an Occupational Health service providing a range of health services including:
- Management referrals
- Health Surveillance
- Immunisations
- Workplace assessments
- Medicals
Medwyn Occupational Health is registered with the Information Commissioner's Office (ICO) as a data controller. Our ICO registration number is ZB185290, registered 1 September 2021. Medwyn Occupational Health is the trading name of Medwyn Occupational Health Limited, a company registered in England and Wales (company number 12465471).
What Is a Privacy Notice?
A Privacy Notice is a statement by the organisation to service users, visitors, carers, the public and staff that describes how we collect, use, retain and disclose personal information we hold. This privacy notice is part of our commitment to ensure that we process your personal information/data fairly and lawfully.
Why Issue a Privacy Notice?
Medwyn Occupational Health recognises the importance of protecting personal and confidential information in all that we do and takes care to meet its legal and regulatory duties. This notice is one of the ways in which we can demonstrate our commitment to our values of being transparent and open, respecting diversity, acting with integrity and striving for excellence. This notice also explains what rights you have to control how we use your information.
What Are We Governed By?
The key pieces of legislation and guidance we are governed by are:
- Data Protection Act 2018
- UK General Data Protection Regulation (UK GDPR) – retained in UK law by the European Union (Withdrawal) Act 2018
- Human Rights Act 1998 (Article 8)
- Computer Misuse Act 1990
- The Common Law Duty of Confidentiality
- International Organisation for Standardisation (ISO) – Information Security Management Standards (ISMS)
Who Are We Governed By?
Medwyn Occupational Health is accredited by SEQOHS (Safe Effective Quality Occupational Health Service). Our doctors, occupational health advisors and registered support staff are also regulated and governed by their respective professional bodies.
Our Role as Data Controller and Data Processor
Depending on the context, Medwyn Occupational Health acts in different capacities under UK GDPR:
As Data Processor: Where an employer (our client) refers their employee to us, the employer is the Data Controller and Medwyn Occupational Health acts as a Data Processor, processing personal data on the employer's behalf in accordance with a written data processing agreement.
As Data Controller: Where we process personal data for our own clinical purposes – such as maintaining clinical records, fulfilling our obligations under health and safety legislation (e.g. COSHH, ionising radiation regulations), or where we provide services directly to individuals – Medwyn Occupational Health acts as an independent Data Controller.
This privacy notice is addressed to you as an individual whose data we process, regardless of which capacity applies.
Our Website and Online Bookings
When you book and pay for a medical through our website, we act as Data Controller for the information you provide, and we process it as follows.
Booking details. To arrange your appointment and take payment, we collect your name, date of birth, contact details (email and mobile number) and address. For taxi and private hire medicals we also collect your licensing council. This information is used to administer your booking, take payment, communicate with you about your appointment, and prepare the correct paperwork. Providing these details is necessary to make a booking – without them, we are unable to arrange your appointment.
No health information is collected on the website. The booking process asks only for the details above. Any health questionnaire is provided to you as a separate document to complete and either bring to your appointment or return to us by email; your answers are held in medical confidence by our clinical team and are not entered into or stored on the website.
Card payments. Payment is taken securely by our payment provider, Stripe. Your full card details are entered directly into Stripe's secure payment form and are not seen or stored by Medwyn Occupational Health.
Booking confirmations and reminders. We use an email provider (Resend) to send your booking confirmation, receipt and any reminders. These emails contain your booking details but never your health information.
Enquiry forms. Where you contact us through a form on the website, we use the details you provide to respond to your enquiry.
How long we keep booking information. Our booking records are retained for 6 years, in line with financial record-keeping requirements, after which they are securely deleted. Our payment provider, Stripe, retains payment transaction records separately under its own legal and regulatory obligations as a financial services provider.
Third Parties Who Process Data for Us
We use a small number of providers to operate our website and bookings. Each processes personal data only on our instructions, under a data processing agreement, and in accordance with UK GDPR:
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Stripe | Secure card payment | Payment and card data (entered directly with Stripe) | UK / EU, with UK-approved safeguards |
| Resend | Booking confirmations, receipts, reminders, and our newsletter where you have subscribed | Name, email, booking details, newsletter subscription | UK / EU, with UK-approved safeguards |
| Google (analytics and advertising measurement) | Understanding how our website is used and measuring advertising – only where you consent through the cookie banner | Usage data (see Cookies page) | UK / EU / US, with UK-approved safeguards |
| Clinical software & IT providers | Clinical record keeping and IT services | As required to deliver care and support systems | UK |
We do not sell your personal data, and we do not share it for marketing purposes.
Why and How We Collect Information
We may ask for or hold personal confidential information about you which will be used to support delivery of appropriate care and treatment. This is to support the provision of high-quality care.
These records may include:
- Basic details such as name, address and date of birth
- Contact we have had, such as appointments
- Details and records of treatment and care, including notes and reports about your health
- Results of investigations such as blood tests or audiometry
- Information from people who know you well, such as other health professionals
It may also include special category information such as sexuality, race, your religion or beliefs and whether you have a disability, allergies or other health conditions. It is important for us to have a complete picture, as this information assists staff involved in your care to deliver and provide improved care and treatment plans.
Information is collected in several ways: via the employer, healthcare professionals, hospital letters or directly from you.
How We Use Information
- To help inform decisions that we make about your care
- To ensure that your treatment is safe and effective
- To work effectively with other organisations that may be involved in your care
- To ensure our services can meet future needs
- To review care provided to ensure it is of the highest standard possible
- For research and audit
The Lawful Basis of Processing
Medwyn Occupational Health processes personal and special category (sensitive) data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
The lawful basis for processing personal data under Article 6 of the UK GDPR will typically be one or more of the following:
Article 6(1)(b) – processing is necessary for the performance of a contract with the data subject (for example, where we are contracted by an employer to provide services to you as an employee, or where you book a medical with us directly).
Article 6(1)(c) – processing is necessary for compliance with a legal obligation (for example, statutory health surveillance required under COSHH, the Noise at Work Regulations, or the Ionising Radiations Regulations).
Article 6(1)(f) – legitimate interests pursued by the employer or Medwyn Occupational Health, where the processing is necessary and proportionate. Our legitimate interests include providing occupational health services that protect employee health and workplace safety, and maintaining clinical records in accordance with professional obligations.
For special category (health) data, the additional condition under Article 9 of the UK GDPR is:
Article 9(2)(h) – necessary for the purposes of occupational medicine, including the assessment of the working capacity of the employee and the provision of health care or treatment.
Article 9(2)(b) – necessary for the purposes of carrying out obligations and exercising specific rights in the field of employment and social security law, where such processing is authorised by UK law.
We also observe the Common Law Duty of Confidentiality, which means that identifiable health information is only shared with your consent, unless there is a clear legal justification to do so.
If consent is the basis for any specific aspect of data processing or information sharing, this will be clearly explained, and you have the right to withdraw your consent at any time.
Three circumstances making disclosure of confidential information lawful are:
- Where the individual to whom the information relates has consented
- Where disclosure is in the public interest
- Where there is a legal duty to do so, for example a court order
International Data Transfers
Medwyn Occupational Health processes all personal data within the United Kingdom. We do not routinely transfer your personal data to countries outside the UK. Where any transfer outside the UK is necessary (for example, in connection with travel health services), we will only do so where an appropriate safeguard is in place, such as the UK Government having made an adequacy decision in respect of that country, or where a UK-approved International Data Transfer Agreement (IDTA) is in place.
Automated Decision-Making and Profiling
Medwyn Occupational Health does not make decisions about you based solely on automated processing (including profiling) that produce legal or similarly significant effects on you. All clinical and occupational health recommendations are made by qualified health professionals.
How Information Is Retained and Kept Safe
Information is retained in secure electronic and paper records and access is restricted to only those who need to know. We follow guidance published by the Information Commissioner's Office on storage limitation.
Technology allows us to protect information in a number of ways, primarily by restricting access. Our guiding principle is that we hold your information in strict confidence.
Retention periods for different categories of record are set out below, in accordance with our internal Records Retention Policy (MOH2108) and applicable legal requirements:
| Type of Record | Retention Period | Legal Basis / Reason |
|---|---|---|
| General health records | Duration of employment | Management of Health & Safety at Work Regulations 1999 |
| OH medical records (unrelated to specific H&S regulation) | Duration of contract or 6 years after end of employment | Management of Health & Safety at Work Regulations 1999 |
| Records relating to accidents/incidents | 3 years from last entry | Social Security (Claims and Payments) Regulations 1987; RIDDOR 2013 |
| Records where termination of employment is connected with health (including stress) | 3 years | Limitation period for personal injury claims |
| COSHH medical records | 40 years | Control of Substances Hazardous to Health Regulations 2002 |
| Ionising radiation health records | Until the individual is, or would have been, 75 years of age, and in any event at least 30 years from the date of the last entry | Ionising Radiations Regulations 2017, regulation 25 |
| Online booking records | 6 years | Financial record-keeping requirements |
How Do We Keep Information Confidential?
Everyone working for Medwyn Occupational Health is subject to the Common Law Duty of Confidentiality and the Data Protection Act 2018. Information provided in confidence will only be used for the purposes to which you consent, unless there are circumstances covered by the law.
Under Medwyn Occupational Health's Confidentiality Code of Conduct, all staff are required to protect information, inform you of how your information will be used and allow you to decide if and how your information can be shared. This will be noted in your records.
All Medwyn Occupational Health staff are required to undertake annual training in data protection, confidentiality and IT/cyber security, with additional training for data protection officers and IT staff.
Who Will the Information Be Shared With?
To provide the best possible care, sometimes we will need to share information about you with others. We may share your information with a range of health and social care organisations and regulatory bodies. Categories of recipients may include: your employer (as the referring Data Controller), other treating clinicians or specialists, NHS services where relevant, and regulatory bodies with a lawful basis to receive the information. You may be contacted by any one of these organisations for a specific reason; they will have a duty to tell you why they have contacted you. Information sharing is governed by specific rules and law.
Where we use third-party data processors (such as clinical software providers or IT service providers, our payment provider and our email provider – see "Third Parties Who Process Data for Us" above), we ensure appropriate data processing agreements are in place and that personal data is handled securely and in accordance with UK GDPR.
Your Right to Withdraw Consent
You have the right to refuse or withdraw consent to information sharing at any time. We will fully explain the possible consequences to you, which could include delays in receiving care.
Your Data Subject Rights
Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:
Right of Access (Subject Access Request) – You have the right to request a copy of the personal data we hold about you and information about how it is processed.
Right to Rectification – You have the right to request that inaccurate or incomplete personal data we hold about you is corrected.
Right to Erasure – In certain circumstances, you have the right to request that we delete your personal data. This right may be limited where we are required by law to retain records (for example, statutory health surveillance records).
Right to Restriction of Processing – In certain circumstances, you have the right to request that we restrict the processing of your personal data, for example while the accuracy of data is contested.
Right to Data Portability – Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format.
Right to Object – Where processing is based on legitimate interests (Article 6(1)(f)), you have the right to object to that processing. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or where processing is necessary for the establishment, exercise or defence of legal claims.
To exercise any of these rights, please contact our Data Protection Officer using the details below. We will respond within one calendar month of receiving your request.
Marketing Communications
From time to time we publish a newsletter with occupational health news and practical guidance for employers. We will only send it to you if you have subscribed – your consent is the lawful basis for this processing (UK GDPR Article 6(1)(a)) – and we use only your name and email address to do so.
Your subscription details (name and email address) are held securely by our email provider, Resend, and we keep a record of when and where you subscribed so we can evidence your consent. Every newsletter includes an unsubscribe link, and you can withdraw your consent at any time, either by using that link or by contacting us at admin@medwynoh.co.uk. If you unsubscribe, we stop sending the newsletter and remove you from the mailing list, keeping only a suppression record of your email address so that we do not contact you again. Subscribing to the newsletter is entirely optional and is never a condition of booking or receiving any of our services.
We do not sell or share your details for marketing by anyone else.
Cookies
Our website uses a small number of cookies. Those that are strictly necessary for the site and secure payment to work are always active. Any non-essential cookies – such as those used for analytics or advertising measurement – are only set with your consent, which you give through the cookie banner when you first visit and can change at any time. Full details of the cookies we use are set out on our Cookies page.
Contacting Us About Your Information
Each organisation has a senior person responsible for protecting the confidentiality of your information and enabling appropriate sharing. This person is known as the Caldicott Guardian. The Caldicott Guardian for Medwyn Occupational Health is the Medical Director, Dr Stewart Tomlinson.
Medwyn Occupational Health has also appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with data protection law. You can contact the DPO for any queries or concerns regarding data protection, or to exercise any of your rights:
Data Protection Officer
Medwyn Occupational Health
Medwyn Centre
Reigate Road
Dorking
Surrey RH4 1SD
Email: admin@medwynoh.co.uk
You may also contact the Medical Director, Dr Stewart Tomlinson, at the address above or by email: admin@medwynoh.co.uk
Can I Access My Information?
Under the Data Protection Act 2018 and UK GDPR, you have the right to request access to information held about you by submitting a Subject Access Request. Please use the contact details above. We will respond within one calendar month.
Right to Complain
If you are not satisfied with how we handle your personal data, you have the right to complain to the Information Commissioner's Office (ICO):
- Website: https://ico.org.uk/global/contact-us/
- Telephone: 0303 123 1113 (local rate) or 01625 545 745 (national rate)
There are National Offices for Scotland, Northern Ireland and Wales (see the ICO website for details).
We would, however, appreciate the opportunity to address your concerns before you contact the ICO. Please contact our Data Protection Officer in the first instance.