OHIS Limited is committed to protecting and respecting your privacy. This Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. The rules on processing of personal data are set out in the General Data Protection Regulation (GDPR) 2018. OHIS Limited as both the data controller and data processor acknowledges that any personal data of yours that we handle will be processed in accordance with the Data Protection Act 1998 and the new General Data Protection Regulation (GDPR) 2018. In addition, our clinicians and allied health professionals will adhere to their ethical and professional standards with regards to confidentiality.

Data Controller: A controller determines the purposes and means of processing personal data. Data Processor: A Processor is responsible for processing personal data on behalf of a controller.

Data Subject: A data subject is a natural person. Data Categories: It includes personal data and a special categories of personal data. Personal Data: The GDPR applies to personal data meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier (as explained in Article 6 of GDPR). For example name, passport number, home address, private email address. Online identifiers include IP addresses and cookies.

Special Categories Personal Data: The GDPR refers to sensitive personal data as special categories of personal data (as explained in article 9 of GDPR). The special categories specifically include genetic data, biometric data where processed to uniquely identify an individual. Other examples include racial and ethnic origin, sexual orientation, health data, trade union membership, political opinions, religious or philosophical beliefs.

Processing of Data: Means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Third Party: Means a natural or legal person, public authority, agency or body other than the data subject, controller, processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

Third-Party : Means a natural or legal person, public authority, agency or body other than the data subject, controller, processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

OHIS-Occupational Health & Industrial Services Limited provides occupational health services to its clients.Both as data controller and data processor, we decide how your personal data is processed and for what purposes. Our contact details are as below. For all enquiries related to data privacy and related matters please contact us on: OHIS- Occupational Health & Industrial Services Limited BlueSky BS, Westpoint House, Prospect Road, Arnhall Business Park Weshill, Aberdeenshire AB32 6FJ Scotland U.K.Tel: 01224 766937 Email: info@ohis.org.uk W: www.ohis.org.uk

With reference to the categories of personal data described in the definitions section, we (OHIS) may process the following data:

Name, Date of birth, Address (email, residential & work), Gender, Contact telephone number: We will use all or part of this data in order for us to identify different individual’s (client’s) records from each other. In circumstances where the appointment confirmation is required for billing purposes, only the name and appointment type will be sent to the contract manager. Name, date of birth, job role and address will also be used in the occupational health reports. We would also use this data to communicate with individuals (clients) e.g. to arrange and send appointment letters or occupational health related paperwork including reports.

Current and previous job roles: In order for our clinicians to assess the clients for their fitness for work and to advise on any restrictions, modifications or adjustments require at work, we need an in depth understanding of the client’s job role and any previous adjustments at work.

Medical (health) information: We need this information as part of the history taking the process of occupational medicine and to complete the process of assessment of the client’s health. It may include your social history and relevant family medical history. Medical information is also required e.g. for immunization or travel health assessments, health surveillance & pre-placement fitness assessment. However, no medical information will be shared outside the OHIS clinical team without your consent unless the law allows us to do so.

Attendance at work & previous sickness absences: This data may be required depending upon the reason(s) for a referral to occupational health.

Photo ID: We may ask you to show us your photo ID e.g. passport or photocard driving license to confirmyour identity but we will not keep a copy of these documents.

The above data could be collected from you, human resources, managers (referring), employees, occupational health physicians(OHP), your general practitioner (GP), a hospital specialist & other allied health practitioners who are/ have been involved with your care. In circumstances where we (OHIS) require further clinical information from your GP , a hospital specialist, an OHP or other allied health practitioner, we (OHIS) will discuss this request with you and obtain your written consent in keeping with our ethical, legal and professional responsibilities e.g. under common law, GMC guidance on consent and confidentiality, and Access to Medical Reports Act.

The above data could be collected via post, email, face to face communication, telephone or video consultation.

Personal Data (Article 6(1) (f)) of GDPR: Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.

Special Categories Data (Article 9(2) (h) of GDPR: Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems or services.

Article 9(3) of GDPR: Special categories of personal data may be processed for the purposes of Article 9 (2) (h) when those data are processed by or under the responsibility of registered health professionals.

Your personal data will be treated as strictly confidential. Unless the law allowes us, we (OHIS) will not share information about you with third parties without your consent.

The occupational health record will be kept for the length of your employment plus 7 years after leaving your employment or until your 75th birthday whichever is sooner. It includes management referral information. In cases of pre-placement medicals, if the job offer is not taken up, we will keep the records for 1 year. If the job offer is taken up then we will keep the records for the same length as the management referral information. Records used for research or statistical purposes could be kept indefinitely. Where an OH physician is acting as an external adviser and may only see the patient once, for example in connection with a pension application, we will keep the records for a minimum of six years (the limitation period for breach of contract). If the case may potentially give rise to a legal claim they may be kept for longer. We retain the clinical records associated with statutory health surveillance (with results of the tests and other clinical information) for the duration (40 years, except for ionization radiation, for which it is 30 years) as stipulated in the HSE specific regulations.

At OHIS, we store all occupational health record in a secure electronic health record system.

Unless subject to an exemption under the GDPR you have the following rights with respect to your personal data:

The right to request a copy of the personal data which we (OHIS) hold about you. A request should be made in writing and we will respond within four weeks without charges.

The right to request that we correct any personal data if it is found to be inaccurate or out of date.

The right to request your personal data is erased where it is no longer necessary to retain such data. OHIS will review this request on a case by case basis, as some records are exempt from erasure e.g. in cases of a potential litigation. Health surveillance records are exempt from erasure. The records which is agreed to be erased will be erased within 30 days.

The right to withdraw your consent to the processing at any time where consent was your lawful basis for processing the data.

The right to request that we provide you with your personal data and where possible, to transmit that data directly to another data controller ( known as the right to data portability), (where applicable i-e, where the processing is based on consent or is necessary for the performance of a contract with the data subject and where the data controller processes the data by automated means).

The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing.

The right to object to the processing of personal data (where applicable i-e. where processing is based on legitimate interests ( or the performance of tasks in the public interest/ exercise of official authority) direct marketing and processing for the purposes of scientific , historical research and statistics.

We (OHIS) do not transfer your data abroad. However in cases where we may require exchange of information with e.g. HR, Manager, GP, Specialist, or other allied health practitioner who are involved with your case or healthcare but they are based outside the UK , we will not transfer your data or exchange information without your consent.

If we wish to use your personal data for a new purpose not covered by this data privacy notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purpose and processing conditions.

Any changes that we (OHIS) may make to our privacy policy in the future will be posted on this page. Please check back frequently to see any updates or changes to our privacy policy.

To exercise all relevant rights, queries or complaints in the first instance please contact OHIS Limited at the address given above. If this does not resolve your complaint to your satisfaction, you have the right to lodge a complaint with the Information Commissioner’s Office on 03031231113 or via email https://ico.org.uk/global/ contact-us/email/ or at the Information Commissioner’s Office, Wycliffe house, waterlane, Wilmslow, Cheshire SK9 5AF, England