We hold and process your information in accordance with the General Data Protection Regulation 2018 and the Data Protection Act 2018.
Data Privacy Notice
How City, University of London Occupational Health Service uses your information
We keep your occupational health (OH) records confidential and will use your personal information in accordance with the General Data Protection Regulation 2018 and the Data Protection Act 2018.
We hold your OH record so that we can provide occupational health advice.
- We provide reports to your manager (employer) and HR about your fitness to work including results of statutory health surveillance relevant to your job e.g. hearing tests and of any adjustments required to support you in work. We also provide advice on adjustments to accommodate a disability or health condition. This is only done with your explicit informed consent.
- The staff counselling service provides professional psychological support.
- We will share relevant information from your occupational health record with other service providers when making a referral e.g. for physiotherapy. This will be with your explicit informed consent.
- You have the right to object to information being shared. You also have the right to have any mistakes or errors corrected.
- Where an external provider is used to provide some aspect of Occupational Health care to the University there will be a contract between the Data Controller (the University) and the Data Processor (the external Occupational Health Service provider).
Other important information about how your information is used
Governance
- We will also use your information so that we can check and review the quality of service we provide. This helps us to improve our services to you.
- We use your anonymized data to provide reports on service activity to Audit and Risk Committee
Confidentiality
We respect your right to confidentiality and have both a legal and professional obligation to protect your information. The exception is if there is public interest or a legal obligation to disclose information.
- Sometimes we need to share information so that other people, including healthcare staff, children or others with safeguarding needs, are protected from risk of harm.
- These circumstances are rare.
- We do not need your consent or agreement to do this.
- We may also be required to disclose information by a court of law
How we handle your information
We are required by law to provide you with the following information about how we handle your information.
Data Controller contact details
City, University of London
10 Northampton Square, London, EC1V 0H
Data Protection Officer contact details
William Jordan: DPO@city.ac.uk
Purpose of the processing
- To undertake occupational health assessments and advise on fitness to work.
- To advise on adjustments to accommodate a disability or health condition
- Referral to a third party, treatments and/or care e.g. physiotherapy treatment.
- Provide counselling support
- To check and review the quality of care. (This is called audit and clinical governance).
Lawful basis for processing
- Legitimate interest
- These purposes are supported under the following section of the GDPR:
- Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services...”
- OH staff will also respect and comply with their obligations under the common law duty of confidence.
What data do we hold?
We collect a range of information in order to accurately identify you and undertake an occupational health assessment including health information.
Recipient or categories of recipients of the processed data
The data will be shared with:
- healthcare professionals and administrative staff at City’s occupational health service
- Staff Counselling records are only accessible to the staff counsellors and no other members of the OH team. These records are stored separately from OH records.
- HR and line managers with informed explicit consent
- Physio solutions physiotherapy service if referral required.
- USS or the LGPS pension scheme in relation to ill health retirement applications.
Rights to object
- You have the right to object to information being shared.
- This may affect the assessment of your fitness to work and employment.
- You are not able to object when information is legitimately shared for safeguarding reasons.
- In appropriate circumstances it is a legal and professional requirement to share information for safeguarding reasons. This is to protect people from harm.
Right to access and correct
- You have the right to access your medical record and have any errors or mistakes corrected. As a data subject, you have a number of rights. Anyone wishing to access Personal Data about themselves should complete the Data Protection Subject Access Request Form (PDF).
- We are not aware of any circumstances in which you will have the right to delete correct information from your medical record; although you are free to obtain your own legal advice if you believe there is no lawful purpose for which we hold the information and contact us if you hold a different view.
Retention period
The occupational health service has a record retention policy. Records will normally be deleted 6 years after you cease employment with City. However, if your role involved exposure to substances hazardous to health and we have undertaken health surveillance we are required to store them for 40 years and 30 years in the case of radiation exposure.
Right to complain
You have the right to complain to the Information Commissioner’s Office. If you wish you may complain via the ICO website or call the helpline 0303 123 1113.