Merit Occupational Health is committed to protecting your privacy and handling personal information securely, lawfully and transparently.
This Privacy Policy explains how Merit Occupational Health collects, uses, stores, shares and protects personal data when you visit our website, contact us, use our occupational health services or interact with us on behalf of an employer or organisation.
Because occupational health services can involve medical and health information, some of the information we process may constitute special category data under UK data protection law. We apply additional safeguards to this information because health data requires a higher level of protection.
We process personal data in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and other applicable UK data protection legislation.
1. Who We Are
Merit Occupational Health provides occupational health services to employers, organisations and individuals.
Our services may include occupational health assessments, management referrals, health surveillance, workplace health advice, fitness-for-work assessments and other occupational health services.
For the purposes of UK data protection law, the organisation responsible for your personal data may depend on the service being provided and the circumstances in which your information is collected.
Where Merit Occupational Health determines how and why personal information is processed, we act as a data controller. In some circumstances, we may process information on behalf of an employer or another organisation.
If you have questions about how your information is processed, please contact Merit Occupational Health using the contact details provided on our website.
2. Personal Information We May Collect
The personal information we collect depends on your relationship with us and the occupational health service being provided.
We may collect:
Name
Date of birth
Address
Email address
Telephone number
Job title
Employer or organisation
Employee or personnel reference information
Employment information
Details about your role and workplace
Referral information
Appointment information
Relevant absence information
Information about workplace adjustments
Information supplied through enquiries and correspondence
Information required to provide occupational health services
Where necessary, we may also process health and medical information.
3. Health and Special Category Data
Occupational health services can require us to process information concerning your physical or mental health.
This may include:
Relevant medical history
Current health conditions
Symptoms
Medication information
Treatment information
Disability information
Vaccination or immunisation information
Workplace exposure information
Health surveillance results
Occupational health assessment information
Fitness-for-work information
Relevant clinical correspondence
Recommendations concerning workplace adjustments or restrictions
Health information is classified as special category personal data under UK GDPR.
We only process health information where we have both a lawful basis for processing personal data and an appropriate condition for processing special category data.
Depending on the circumstances, this may include processing necessary for occupational medicine, assessment of an employee's working capacity, medical diagnosis, provision of healthcare or management of health services.
4. How We Collect Personal Information
We may collect personal information directly from you when you:
Contact Merit Occupational Health
Complete an online form
Make an enquiry
Book or attend an appointment
Complete an occupational health questionnaire
Participate in an assessment
Provide information to an occupational health professional
Communicate with us by telephone or email
Use our website
Where appropriate and lawful, we may also receive information from:
Your employer
A prospective employer
Human resources departments
Managers
Healthcare professionals
General practitioners
Specialists
Other occupational health providers
Insurers or other relevant organisations
We will only obtain information from third parties where there is an appropriate legal basis or other valid authority to do so.
5. Employer Referrals
An employer may refer an employee to Merit Occupational Health for an occupational health assessment.
The employer may provide information relevant to the referral, including your job role, workplace requirements, absence information and the reason for requesting an occupational health opinion.
We use this information because understanding the workplace context helps the occupational health professional provide appropriate advice.
The occupational health assessment remains focused on relevant workplace health matters.
6. How We Use Personal Information
We may use personal information to:
Provide occupational health services
Manage appointments
Conduct occupational health assessments
Respond to management referrals
Conduct health surveillance
Assess fitness for work
Provide workplace health advice
Recommend workplace adjustments
Prepare occupational health reports
Communicate with individuals and employers
Maintain appropriate clinical records
Manage customer and employer relationships
Respond to enquiries
Process invoices and payments
Maintain business records
Manage complaints
Protect our systems and services
Comply with professional obligations
Comply with legal and regulatory requirements
Establish, exercise or defend legal claims
We only process information where we have an appropriate lawful basis.
7. Lawful Bases for Processing
Depending on the circumstances, we may rely on one or more lawful bases under UK GDPR.
Contract
We may process personal information where it is necessary to provide services under a contract or take steps before entering into a contract.
Legitimate Interests
We may process personal information where necessary for legitimate business or organisational interests, provided those interests do not override your rights and freedoms.
Legal Obligation
We may process information where necessary to comply with a legal or regulatory obligation.
Consent
In circumstances where consent provides the appropriate lawful basis, we will seek valid consent before processing the relevant information.
Consent is not necessarily the lawful basis for all occupational health processing.
8. Special Category Processing
Where we process health or other special category information, we must satisfy an additional condition under UK data protection law.
Depending on the circumstances, processing may be necessary for:
Occupational medicine
Assessing an employee's working capacity
Medical diagnosis
Provision of healthcare
Management of healthcare services
Employment and social protection obligations
Establishing, exercising or defending legal claims
Substantial public interest where an appropriate legal condition applies
We only process special category information where the relevant legal requirements are satisfied.
9. Occupational Health Reports
Following an occupational health assessment, Merit Occupational Health may prepare a report for an employer or referring organisation.
The report will normally focus on information relevant to the workplace and the questions raised by the referral.
Depending on the circumstances, a report may address:
Fitness for work
Functional limitations
Potential workplace adjustments
Likely timescales
Rehabilitation considerations
Relevant restrictions
Whether further occupational health review may be appropriate
We aim to avoid unnecessary disclosure of detailed clinical information because employers generally require occupational advice rather than unrestricted access to an individual's medical information.
Information will be disclosed in accordance with applicable law, professional standards and the circumstances of the referral.
10. Medical Confidentiality
Health information provided during an occupational health assessment is treated confidentially.
Access to clinical information is restricted to appropriately authorised individuals who require access for legitimate purposes.
We do not routinely disclose detailed medical information to employers.
Where information needs to be shared, we consider confidentiality, applicable law, professional obligations and the purpose for which the information is required.
There may be limited circumstances where information can or must be disclosed without consent, such as where disclosure is required by law or necessary to address a serious risk of harm.
11. Data Minimisation
We aim to collect only the information necessary for the occupational health service or other legitimate purpose.
We avoid collecting excessive or irrelevant personal information because limiting data collection reduces privacy and security risks.
12. Accuracy
We take reasonable steps to ensure personal information and occupational health records are accurate.
You should tell us if you believe factual information we hold about you is inaccurate.
Clinical opinions may not necessarily be altered simply because an individual disagrees with them, although relevant comments or corrections may be recorded where appropriate.
13. Sharing Personal Information
We do not sell personal or medical information.
Depending on the service and circumstances, we may share relevant information with:
Employers or referring organisations
Healthcare professionals
Specialist clinicians
Laboratories or diagnostic providers
IT and secure technology providers
Appointment and communications providers
Professional advisers
Accountants
Regulators
Government authorities
Courts or law enforcement agencies
We only share information where there is a lawful and legitimate reason to do so.
Where possible, we limit information to what the recipient reasonably requires for the relevant purpose.
14. Sharing Information With Employers
Occupational health involves balancing medical confidentiality with the employer's legitimate need for appropriate workplace advice.
An employer will not normally receive unrestricted access to your medical records.
Reports provided to employers should contain information relevant to workplace decisions, such as fitness for work, functional capability, adjustments or occupational health recommendations.
Detailed medical information will only be disclosed where there is an appropriate basis for doing so.
15. Service Providers and Data Processors
We may use trusted service providers to support our business and occupational health services.
These providers may include:
Secure IT providers
Website hosting providers
Clinical software providers
Communications providers
Appointment systems
Secure document storage providers
Professional advisers
Payment providers
Where an organisation processes personal data on our behalf, we take reasonable steps to ensure appropriate contractual, confidentiality and security arrangements are in place.
16. International Data Transfers
Some technology providers may process or store information outside the United Kingdom.
Where personal information is transferred internationally, we take appropriate steps to ensure that the transfer complies with UK data protection law.
Safeguards may include UK adequacy regulations, approved contractual safeguards or another legally recognised transfer mechanism.
17. How Long We Keep Personal Information
We retain personal information only for as long as necessary for the purpose for which it was collected and to meet applicable clinical, professional, legal and regulatory requirements.
Retention periods may differ depending on the type of occupational health record and the service provided.
When determining an appropriate retention period, we may consider:
Clinical requirements
Professional guidance
Legal obligations
Contractual requirements
Regulatory requirements
The nature of the occupational health service
Potential complaints or legal claims
When information no longer needs to be retained, we will securely delete, destroy or anonymise it where appropriate.
18. How We Protect Personal Information
We take appropriate technical and organisational measures to protect personal and health information.
These measures are designed to reduce the risk of:
Unauthorised access
Accidental disclosure
Unlawful processing
Loss
Destruction
Alteration
Theft
Misuse
Additional care is applied to health information because medical information is particularly sensitive.
Access to personal information is restricted according to legitimate business and clinical requirements.
19. Website Information
When you visit our website, we may collect technical information such as:
IP address
Browser type
Device type
Operating system
Pages visited
Referral source
Website interactions
We may use this information to maintain website security, understand website performance and improve the user experience.
20. Cookies
Our website may use cookies and similar technologies.
Some cookies may be necessary for the website to function correctly. Other cookies may support analytics, functionality or marketing.
Where UK law requires consent, non-essential cookies should only operate after appropriate consent has been obtained.
Further information should be available in our Cookie Policy.
21. Marketing
We may send business marketing communications where we have a lawful basis to do so.
Where consent is required, we will obtain consent before sending the relevant electronic marketing communications.
You can opt out of marketing communications at any time.
Medical and occupational health information will not be used for unrelated marketing purposes.
22. Your Data Protection Rights
Depending on the circumstances, UK data protection law may give you the right to:
Be informed about how your personal information is processed
Request access to personal information held about you
Request correction of inaccurate information
Request completion of incomplete information
Request deletion of personal information in certain circumstances
Request restriction of processing
Object to certain processing
Request data portability where applicable
Withdraw consent where processing relies on consent
Object to direct marketing
These rights are subject to applicable legal conditions and exemptions.
23. Accessing Your Occupational Health Records
You may have the right to request access to personal information and occupational health records held about you.
We may need to verify your identity before providing information because medical records contain confidential information.
Certain information may be withheld or restricted where permitted or required by law, including information relating to another individual or information where disclosure would conflict with an applicable legal exemption.
24. Right to Rectification
You can ask us to correct personal information that is factually inaccurate or complete information that is incomplete.
We will consider reasonable requests and make corrections where appropriate.
25. Right to Erasure
You may have the right to request deletion of personal information in certain circumstances.
This right is not absolute.
Occupational health records may need to be retained because of legal, clinical, regulatory or professional requirements. We will consider each valid request in accordance with applicable data protection law.
26. Personal Data Breaches
A personal data breach may include accidental or unlawful loss, destruction, alteration, disclosure of or access to personal information.
If we become aware of a personal data breach, we will assess:
The nature of the incident
The information involved
The individuals affected
The potential consequences
The steps required to contain and address the incident
Where required by law, we will report qualifying breaches to the Information Commissioner's Office within the applicable timeframe.
Where a breach is likely to create a high risk to affected individuals, we will notify those individuals where required by law.
27. Children's Data
Our occupational health services are primarily intended for employers and working-age individuals.
If we process information relating to a person under 18 as part of a legitimate occupational health service, we will apply appropriate safeguards and comply with applicable legal and professional requirements.
28. Complaints
If you have concerns about how Merit Occupational Health handles your personal information, please contact us so we can investigate the matter.
You also have the right to complain to the Information Commissioner's Office, which is the UK's independent regulator for data protection and information rights.
29. Changes to This Privacy Policy
We may update this Privacy Policy when our services, systems, business practices or legal obligations change.
The latest version will be published on our website.
The date at the top of this policy indicates when it was last updated.
30. Contact Merit Occupational Health
If you have questions about this Privacy Policy, want to exercise your data protection rights, request access to your occupational health records or raise a concern about how your information is handled, please contact Merit Occupational Health using the contact details provided on our website.