How we use your personal information
This Privacy Notice explains why Occupational Health collects information about you and how that information may be used.
We are committed to maintaining the privacy, dignity and confidentiality of service users at all times. We adhere to the principles of the General Data Protection Regulation GDPR May 2018, the General Medical Council and Nursing & Midwifery Codes of Confidentiality.
We use your personal information to allow us to advise and support you in accordance with your requirements and the consent you have given us.
The Occupational Health service is medically confidential. The occupational health records are classed as ‘sensitive personal data’ and securely stored in line with General Data Protection Regulation and only accessible to Occupational Health (OH) staff. All OH staff adhere to a strict code of ethics in relation to the confidentiality of all consultations, telephone contact and the maintenance of occupational health records.
Occupational Health records may be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. No information is divulged to any third party, including the person’s general practitioner (GP) without the person’s informed consent.
Records Drayton Medical Services hold about you may include the following information;
- Any personal information you knowingly provide us with through the registration form such as your name, telephone number, email and company name
- Any contact Drayton Medical Services has had with you such as appointments and visits.
- Notes and OH reports
- Relevant information from other health professionals
OH reports to management concerning your fitness for work will always be discussed and agreed with you prior to sending the report. The advice should be treated by you as sensitive personal data in respect of the GDPR and can be shared by you only and with your consent with others who have a legitimate need to know (e.g., because they will be responsible for implementing adjustments in the workplace).
Your data is not held outside of the European Economic Area (EEA).
How Long Your Data Will Be Held For
- OH records will be held for 7 years after the data subject has left the organisation or until your 75th birthday whichever is sooner.
- New starter assessments will be destroyed after 2 years if the application has been rejected.
- Records of statutory health surveillance will be kept for 40 years.
Change of Details
It is important that you tell Occupational Health if any of your details such as your name or address have changed or if any of your details such as date of birth is incorrect in order for this to be amended. You have a responsibility to inform us of any changes so our records are accurate and up to date for you.
Access to personal information
You have a right under the GDPR to request access to view or to obtain copies of what information Drayton Medical Services holds about you and to have it amended should it be inaccurate.
In order to request this, you need to do the following:
- Your request must be made in writing to Occupational Health (Drayton Medical Services)
- There may be a charge to have a printed copy of the information held about you
- We are required to respond to you within 40 days
- You will need to give adequate information (for example full name, address, date of birth, and details of your request) so that your identity can be verified and your records located.
Objections / Complaints
Should you have any concerns about how your information is managed at Drayton Medical Services, please contact the Office Manager at the following address:
Drayton Medical Services Ltd
The Sanderson Suite
280 Havant Road
If you are still unhappy following a review by Drayton Medical Services, you can contact the Information Commissioners Office (ICO) via their website (www.ico.gov.uk).
The GDPR requires organisations to register a notification with the Information Commissioner to describe the purposes for which they process personal and sensitive information.
This information is publicly available on the Information Commissioners Office website www.ico.org.uk
Drayton Medical Services is registered with the Information Commissioners Office (ICO).
Who is the Data Controller?
The Data Controller, responsible for keeping your information secure and confidential is:
Drayton Medical Services Limited
Who is the Data Processor?
The Data Processor is necessary for the purpose of preventive or occupational medicine and for the assessment of the working capacity of the employee and is Drayton Medical Services Limited.