Merit Occupational Health is committed to protecting personal data and maintaining the confidentiality of the health information entrusted to us.
This GDPR Policy explains how we collect, process, store, share and protect personal data in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and other applicable UK data protection legislation.
Because we provide occupational health services, we may process health and medical information. Health information is special category personal data and receives additional protection under UK data protection law.
This policy applies to personal data processed through our website and during the provision of our occupational health services.
1. Our Data Protection Principles
Merit Occupational Health processes personal data in accordance with the principles of UK GDPR.
We aim to ensure personal data is:
Processed lawfully, fairly and transparently
Collected for specified, explicit and legitimate purposes
Adequate, relevant and limited to what is necessary
Accurate and kept up to date where necessary
Retained only for as long as necessary
Processed securely
Protected against unauthorised access, disclosure, loss, destruction or damage
We maintain appropriate data protection procedures because occupational health information can contain sensitive medical and employment information.
2. Personal Data We May Process
The information we process depends on the occupational health service being provided.
We may process:
Name
Date of birth
Address
Email address
Telephone number
Job title
Employer or organisation
Employee or personnel reference information
Employment history
Job requirements
Workplace information
Absence information
Referral information
Appointment information
Occupational health records
Correspondence
Information about workplace adjustments
Invoice and payment information
Website usage information
IP address and device information
We aim to collect only information relevant to the purpose for which it is required.
3. Special Category Health Data
Occupational health services may require us to process information about an individual's physical or mental health.
This may include:
Medical history
Current health conditions
Symptoms
Medication
Treatment information
Disability information
Vaccination or immunisation information
Workplace exposure information
Health surveillance results
Fitness-for-work information
Occupational health assessment findings
Relevant clinical correspondence
Functional limitations
Workplace adjustment recommendations
Health information is classified as special category data under UK GDPR.
We only process special category information where both an appropriate lawful basis and an additional special category condition apply.
4. How We Collect Personal Data
We may collect information directly from an individual when they:
Contact Merit Occupational Health
Complete a form or questionnaire
Make an enquiry
Attend an appointment
Participate in an occupational health assessment
Undertake health surveillance
Communicate with an occupational health professional
Contact us by telephone or email
Use our website
Where appropriate and lawful, information may also be received from:
Employers
Prospective employers
Human resources departments
Managers
General practitioners
Healthcare professionals
Medical specialists
Laboratories
Other occupational health providers
Other authorised organisations
We only obtain third-party information where there is an appropriate basis for doing so.
5. Why We Process Personal Data
We may process personal information to:
Provide occupational health services
Manage appointments
Conduct occupational health assessments
Respond to management referrals
Assess fitness for work
Conduct health surveillance
Provide workplace health advice
Recommend workplace adjustments
Support return-to-work planning
Prepare occupational health reports
Maintain clinical records
Communicate with individuals and employers
Manage employer relationships
Respond to enquiries
Manage invoices and payments
Handle complaints
Maintain service quality
Protect our systems
Meet professional obligations
Comply with legal and regulatory requirements
Establish, exercise or defend legal claims
We do not process personal information for purposes that are incompatible with the reason it was collected unless permitted by law.
6. Lawful Bases for Processing
UK GDPR requires an appropriate lawful basis for processing personal data.
Depending on the circumstances, we may rely on:
Contract
Processing may be necessary to provide an agreed service or take steps before entering into a contract.
Legal Obligation
Processing may be necessary to comply with legal, regulatory, employment, health and safety or other statutory obligations.
Legitimate Interests
We may process personal information where necessary for legitimate interests, provided those interests do not override the individual's rights and freedoms.
Legitimate interests may include operating our occupational health service, maintaining appropriate records, managing customer relationships, protecting our systems and resolving disputes.
Consent
We may rely on consent where it provides the appropriate lawful basis for a specific processing activity.
Consent is not necessarily the lawful basis for routine occupational health processing.
7. Conditions for Processing Health Data
Processing health information requires an additional condition under UK GDPR.
Depending on the circumstances, we may process health data where necessary for:
Occupational medicine
Assessment of an employee's working capacity
Medical diagnosis
Provision of healthcare
Management of health services
Employment and social protection obligations
Establishing, exercising or defending legal claims
Substantial public interest where an appropriate legal condition applies
Where required, processing will be carried out by or under the responsibility of a professional subject to appropriate confidentiality obligations.
8. Medical Confidentiality
Merit Occupational Health treats medical information as confidential.
Access to clinical information is restricted to appropriately authorised individuals who require access for legitimate professional purposes.
Employers do not normally receive unrestricted access to an individual's medical records.
Occupational health reports generally focus on relevant workplace information rather than providing detailed clinical histories.
There may be exceptional circumstances where information can or must be disclosed without consent, including where required by law or where disclosure is necessary to address a serious risk of harm.
9. Employer Referrals
An employer may provide personal information when referring an employee for an occupational health assessment.
Referral information may include:
Employee identification information
Job role
Job requirements
Relevant absence information
Workplace concerns
Reason for referral
Questions the employer would like occupational health to address
We use this information because understanding the workplace context allows us to provide relevant occupational health advice.
10. Occupational Health Reports
Following an assessment, an occupational health professional may prepare a report for the referring employer or organisation.
Depending on the circumstances, a report may address:
Fitness for work
Functional capability
Workplace adjustments
Restrictions
Rehabilitation
Return-to-work planning
Likely timescales
Further occupational health review
Reports should contain information relevant to the occupational health purpose.
We aim to minimise unnecessary disclosure of detailed medical information because employers generally need functional workplace advice rather than full clinical information.
11. Data Minimisation
We collect and process only personal information that is reasonably necessary for the relevant occupational health or business purpose.
We avoid unnecessary collection of medical information because reducing the amount of sensitive information processed reduces privacy and security risks.
12. Accuracy
We take reasonable steps to maintain accurate personal and occupational health records.
Individuals should inform us if factual personal information is incorrect or has changed.
Clinical opinions represent professional judgement based on the information available at the time and are not necessarily considered inaccurate simply because an individual disagrees with the opinion.
13. Data Security
We take appropriate technical and organisational measures to protect personal information.
Security measures are designed to reduce the risk of:
Unauthorised access
Accidental disclosure
Unlawful processing
Loss
Destruction
Alteration
Theft
Misuse
Health information receives additional care because it is particularly sensitive.
Access to personal data is restricted according to legitimate professional and business requirements.
14. Sharing Personal Data
Merit Occupational Health does not sell personal or health information.
Where there is an appropriate legal and professional basis, we may share relevant information with:
Employers or referring organisations
Healthcare professionals
Specialist clinicians
Laboratories or diagnostic providers
Other occupational health providers
Secure IT providers
Clinical software providers
Communications providers
Professional advisers
Regulators
Government authorities
Courts
Law enforcement agencies
We aim to disclose only information reasonably necessary for the relevant purpose.
15. Sharing Information With Employers
An employer will not normally receive unrestricted access to an employee's medical information.
Occupational health reports generally provide information relevant to workplace management, such as:
Whether an individual is fit for work
Functional limitations
Recommended workplace adjustments
Potential restrictions
Return-to-work recommendations
Relevant occupational health review periods
Detailed medical information will only be disclosed where there is an appropriate basis for doing so.
16. Data Processors and Service Providers
We may use trusted service providers to support our occupational health services and business operations.
These may include:
Clinical software providers
Secure document storage providers
IT support providers
Website hosting providers
Appointment systems
Communications providers
Payment providers
Professional advisers
Where another organisation processes personal information on our behalf, we take reasonable steps to ensure appropriate contractual, confidentiality and security arrangements are in place.
17. International Data Transfers
Some technology providers may process or store information outside the United Kingdom.
Where personal information is transferred internationally, we take appropriate steps to ensure the transfer complies with UK data protection requirements.
Safeguards may include UK adequacy regulations, approved contractual safeguards or another legally recognised transfer mechanism.
18. Data Retention
We retain personal information only for as long as necessary for the purpose for which it was collected and to meet applicable professional, clinical, contractual, regulatory and legal requirements.
Different records may have different retention periods.
When determining retention periods, we consider:
The nature of the occupational health service
Clinical requirements
Professional guidance
Legal obligations
Regulatory requirements
Contractual requirements
Potential complaints
Potential legal claims
When personal information no longer needs to be retained, we will securely delete, destroy or anonymise it where appropriate.
19. Your Data Protection Rights
Depending on the circumstances, individuals may have the right to:
Be informed about how personal data is processed
Request access to personal data
Request correction of inaccurate information
Request completion of incomplete information
Request deletion in certain circumstances
Request restriction of processing
Object to certain processing
Request data portability where applicable
Withdraw consent where processing relies on consent
Object to direct marketing
These rights are subject to applicable legal conditions and exemptions.
20. Subject Access Requests
You may request access to personal information Merit Occupational Health holds about you.
This is commonly known as a subject access request.
We may ask for information to verify your identity because occupational health records contain confidential and potentially sensitive information.
We will respond to valid requests within the timeframe required by applicable data protection law.
Certain information may be withheld where a legal exemption applies.
21. Right to Rectification
You can ask us to correct personal information that is factually inaccurate or complete information that is incomplete.
We will consider reasonable requests and make appropriate corrections.
22. Right to Erasure
You may have the right to request deletion of personal information in certain circumstances.
This right is not absolute.
We may need to retain occupational health information because of clinical, professional, contractual, regulatory or legal requirements.
Each valid request will be considered in accordance with applicable data protection law.
23. Right to Restrict Processing
You may have the right to ask us to restrict processing in certain circumstances.
Where processing is restricted, we may continue to retain the information while limiting other uses.
24. Right to Object
You may have the right to object where personal information is processed based on legitimate interests.
We will consider valid objections and determine whether there are compelling legitimate grounds to continue processing.
You can object to direct marketing at any time.
25. Data Portability
Where applicable, you may have the right to receive qualifying personal information in a structured, commonly used and machine-readable format.
You may also have the right to request that qualifying information is transferred to another organisation where technically feasible.
26. Automated Decision-Making
Merit Occupational Health does not normally use solely automated decision-making to make decisions that produce legal or similarly significant effects on individuals.
Occupational health opinions are normally based on professional assessment and clinical judgement.
If our use of automated decision-making changes, we will comply with applicable UK data protection requirements.
27. Cookies and Website Data
Our website may use cookies and similar technologies.
Some cookies may be necessary for website operation. Others may support analytics, functionality or marketing.
Where consent is required, non-essential cookies should only operate after the appropriate consent has been obtained.
Further information should be provided in our Cookie Policy.
28. Marketing
We may send business marketing communications where we have an appropriate lawful basis.
Where consent is required, we will obtain consent before sending electronic marketing communications.
Individuals can opt out of marketing communications at any time.
Medical and occupational health information will not be used for unrelated marketing purposes.
29. Personal Data Breaches
A personal data breach may involve accidental or unlawful loss, destruction, alteration, disclosure of or access to personal information.
If a suspected breach occurs, we will assess:
What happened
What information was affected
Which individuals may be affected
The potential consequences
What measures are required to contain the incident
What measures can reduce future risk
Where legally required, qualifying personal data breaches will be reported to the Information Commissioner's Office within the applicable timeframe.
Where a breach is likely to result in a high risk to affected individuals, we will inform those individuals where required by law.
30. Data Protection by Design
We consider data protection when developing or changing systems, processes and occupational health services.
Where processing is likely to create a high risk to individuals, we will consider whether a Data Protection Impact Assessment is required.
This approach helps us identify privacy risks before new processing activities begin.
31. Staff and Professional Responsibilities
Anyone handling personal information on behalf of Merit Occupational Health should:
Maintain confidentiality
Access information only where necessary
Follow appropriate security procedures
Avoid unnecessary disclosure
Protect passwords and access credentials
Store records securely
Report suspected data breaches promptly
Dispose of information securely when appropriate
Clinical staff must also comply with applicable professional confidentiality obligations.
32. Complaints
If you have concerns about how Merit Occupational Health processes your personal data, please contact us so we can investigate your concerns.
You also have the right to complain to the Information Commissioner's Office, which is the UK's independent regulator for data protection and information rights.
33. Changes to This GDPR Policy
We may update this GDPR Policy when our services, systems, business practices, professional requirements or legal obligations change.
The latest version will be published on our website.
The date at the top of this policy shows when it was last updated.
34. Contact Merit Occupational Health
If you have questions about this GDPR Policy, want to exercise your data protection rights, request access to your occupational health information or raise a concern about how your personal data is handled, please contact Merit Occupational Health using the contact details provided on our website.