1. Who We Are
Work Welfare Support Ltd (“we”, “us”) provides professional occupational health (OH) services to employers and their employees.
This Privacy Policy explains how we collect, use, share and protect personal data, including health data, through our website and occupational health services.
Organisation name: Work Welfare Support Ltd
ICO registration reference: ZB880973
Data Protection Lead: Rachel Phiri
Email: info@workwelfaresupport.ltd
Telephone: 0330 133 4990
Work Welfare Support Ltd is responsible for protecting personal information that we process and for ensuring that it is handled in accordance with applicable UK data protection legislation.
2. The Data We Collect
We collect and process two distinct categories of personal information, which are kept separately where appropriate.
Personal identifiers
- Name
- Date of birth
- Telephone number
- Email address
- Employer or company name
- Appointment or referral information
- Information submitted through our website enquiry form
This information is collected for purposes including enquiries, scheduling, referrals and administration.
Special category health data
- Medical history
- Relevant health conditions
- Clinical findings
- Health surveillance information
- Occupational health assessment information
- Fitness assessments
- Information discussed during occupational health consultations
Health information collected during occupational health assessments is stored within our secure clinical IT system and is handled separately from general website enquiries.
We do not ask visitors to provide confidential medical information through the general website enquiry form.
Where We Obtain Personal Information
Personal information may be obtained directly from the individual or provided to Work Welfare Support Ltd by an employer, referring organisation or occupational health provider.
Information provided as part of an occupational health referral may include the individual's name, contact details, date of birth, job role, relevant employment information, absence information, workplace concerns, referral questions and other information considered relevant to the occupational health assessment.
During an occupational health consultation, additional information may be provided directly by the individual. Where necessary and with appropriate authority or consent, relevant information may also be obtained from healthcare professionals or other appropriate sources.
Work Welfare Support Ltd only processes information that is necessary and relevant to the occupational health service being provided.
3. Lawful Basis for Processing
Work Welfare Support Ltd processes personal information only where there is an appropriate lawful basis under UK data protection legislation.
Depending on the purpose and circumstances of the processing, the lawful bases we may rely upon include:
Article 6(1)(b) – Contract: where processing is necessary to take steps at the request of an individual before entering into a contract, or to perform a contract directly with that individual.
Article 6(1)(c) – Legal obligation: where processing is necessary for compliance with a legal obligation that applies to Work Welfare Support Ltd.
Article 6(1)(f) – Legitimate interests: where processing is necessary for the legitimate interests of Work Welfare Support Ltd or a third party. These interests include the provision and administration of occupational health services, management of referrals and appointments, communication with referring organisations and the safe and effective delivery of occupational health services, provided those interests are not overridden by the individual's rights and freedoms.
Where we rely on legitimate interests, we consider the necessity and proportionality of the processing and the potential impact on the individual's rights and interests.
Special Category Health Information
Health information is special category personal data and receives additional protection under UK data protection legislation.
Where Work Welfare Support Ltd processes health information for occupational health purposes, including assessing an individual's working capacity, fitness for work, workplace adjustments or health surveillance requirements, we may rely on:
Article 9(2)(h) UK GDPR – occupational medicine and assessment of working capacity, together with the relevant provisions of the Data Protection Act 2018.
Health information is processed by, or under the responsibility of, healthcare professionals or other persons who are subject to appropriate duties of confidentiality.
Where another Article 9 condition is more appropriate to a particular activity, that condition will be identified and documented.
Consent to participate in an occupational health assessment and consent to disclose confidential clinical information are managed separately from the lawful basis relied upon for processing personal information.
Where appropriate, individuals will be informed about the information proposed for disclosure and their consent will be obtained before confidential clinical information is released, unless there is another lawful justification for disclosure.
4. How We Handle Occupational Health Reports and Disclosure to Employers
Work Welfare Support Ltd is committed to maintaining the confidentiality of information obtained during occupational health assessments.
Clinical information gathered during an occupational health assessment is confidential to Work Welfare Support Ltd and is not the property of an individual's employer, manager or HR department.
Except in an emergency as described below, individuals will be shown their occupational health outcome before it is shared with their employer and will be given a reasonable period, normally 24–48 hours, to review it and raise any factual queries.
Only the agreed occupational health outcome will normally be shared with the employer. This may include:
- Overall fitness outcome, such as fit, fit with adjustments or unfit
- Recommended workplace adjustments
- Recommended restrictions
- Duration of adjustments or restrictions
- Recall or review dates
Diagnoses, symptoms, test results, detailed clinical narrative or other confidential information disclosed during a consultation will not be provided to an employer without the appropriate explicit and specific consent, unless there is another lawful justification for disclosure.
Where an employer has a separate and verified occupational health provider, distinct from the employee's manager, a report may instead be sent to that occupational health provider.
A manager's own clinical or occupational health qualifications do not automatically make that manager a separate occupational health provider, and reports will not be released to a manager solely on that basis.
Emergency exception
In a genuine emergency — for example, where there is an immediate and serious risk to an individual's safety or the safety of others — Work Welfare Support Ltd may disclose urgent and relevant information to an employer or another appropriate party without first providing the individual with an opportunity to review it.
This exception will be applied narrowly and only where delaying disclosure could itself cause harm.
6. Data Storage and Security
Work Welfare Support Ltd takes appropriate measures to protect personal information against unauthorised access, disclosure, alteration, loss or destruction.
Personal identifiers obtained through general enquiries and administration are handled separately from special category clinical information where appropriate.
Special category health information is stored using secure electronic systems and approved business IT infrastructure, which may include Microsoft 365 business services. Access to occupational health information is restricted to authorised personnel according to their role and on a need-to-know basis.
Appropriate technical and organisational security measures are applied according to the nature and sensitivity of the information being processed. These may include access controls, authentication controls, encryption and secure transmission methods, device security, restricted permissions and appropriate backup and recovery arrangements.
7. Data Retention
We retain personal information only for as long as necessary for the purposes for which it was collected and in accordance with applicable legal, regulatory and professional requirements.
Website and administrative information: Personal identifiers used for website enquiries and administration are normally retained for 120 days following completion of the relevant service, after which they are deleted unless there is a legitimate requirement to retain them for longer.
Clinical health records: Clinical occupational health records are normally retained for 7 years from the date of the last entry, subject to applicable professional, legal and regulatory requirements.
Statutory health surveillance records: Where legislation requires longer retention periods for particular occupational health surveillance records, those records may be retained for up to 40 years or for another period required by applicable legislation.
Where information is required for an ongoing legal, regulatory or professional matter, it may be retained for as long as necessary to deal with that matter.
Retention periods may vary where a different statutory, contractual, regulatory or professional retention requirement applies.
When information reaches the end of the applicable retention period and there is no continuing lawful reason to retain it, it will be securely deleted or destroyed.
9. Your Rights
Under UK data protection legislation, individuals may have the right to:
- Request access to personal information we hold about them.
- Request correction of inaccurate or incomplete information.
- Request erasure of personal information in certain circumstances.
- Request restriction of certain processing.
- Object to certain processing.
- Request transfer of personal information to another organisation where the right to data portability applies.
- Withdraw consent where processing relies on consent.
- Lodge a complaint with the Information Commissioner's Office.
Automated Decision-Making
Work Welfare Support Ltd does not currently make decisions about individuals based solely on automated processing, including profiling, where those decisions produce legal effects or similarly significant effects on the individual.
Occupational health fitness decisions and recommendations involve appropriate professional assessment and clinical judgement.
Clinical record-keeping exception
Work Welfare Support Ltd may be subject to professional, legal or regulatory obligations requiring clinical records to be retained for specified periods.
Where such an obligation applies, we may not be able to erase a clinical record before the applicable retention period has expired, even where an individual asks us to delete it.
Where this applies, we will explain why the information cannot be erased.
Rachel Phiri
Data Protection Lead
info@workwelfaresupport.ltd
0330 133 4990
10. Complaints
If you are unhappy with how Work Welfare Support Ltd has handled your personal information, please contact our Data Protection Lead in the first instance:
Rachel Phiri
info@workwelfaresupport.ltd
0330 133 4990
We will review your concerns and respond appropriately.
Information Commissioner's Office
You also have the right to raise a concern or make a complaint to the Information Commissioner's Office (ICO), the UK's independent regulator for data protection.
Information Commissioner's Office (ICO)
Telephone: 0303 123 1113
Website: ico.org.uk
You can contact the ICO at any time; however, we welcome the opportunity to address your concerns directly in the first instance.
11. Enquiries, Appointments and Cancellations
Initial enquiries may be made through the Work Welfare Support Ltd website, by telephone or by email.
The website enquiry form may collect information including:
- Name
- Work email address
- Telephone number
- Company or organisation
- Enquiry details
Visitors should not submit confidential medical information through the general website enquiry form.
Where an appointment or occupational health assessment is subsequently arranged, additional information may be collected as necessary to provide the requested service.
Where cancellation or rescheduling requirements apply to a particular service, these will be communicated when the service or appointment is arranged.
Work Welfare Support Ltd may provide services remotely or face-to-face depending on the type of assessment and the requirements of the employer or individual.
12. Intellectual Property and Content Protection
Unless otherwise stated, content created and owned by Work Welfare Support Ltd on this website, including original text, branding, logos and clinical or service descriptions, is protected by applicable intellectual property laws.
Content owned by Work Welfare Support Ltd must not be copied, reproduced, republished or used on another website, platform or publication without prior written permission from Work Welfare Support Ltd, except where permitted by law.
Some photographs, fonts, icons, software or other materials displayed on the website may be provided by third parties or used under applicable licences. Ownership and permitted use of those materials remain subject to the terms of their respective owners or licences.
13. Data Protection Roles
The data protection role of Work Welfare Support Ltd may vary depending on the occupational health service being provided and the contractual arrangements in place.
Where Work Welfare Support Ltd determines the purposes and means by which personal information is processed, it acts as a data controller.
In some contractual arrangements, Work Welfare Support Ltd may process specified information on behalf of another organisation in accordance with documented instructions.
Where this applies, the respective responsibilities of the organisations will be addressed within the appropriate contractual or data processing arrangements.
Regardless of the contractual arrangement, occupational health information is handled in accordance with applicable data protection requirements and professional duties of confidentiality.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our services, systems, legal obligations or the way we process personal information.
The latest version will be published on our website together with the date it was last updated.
Questions about your privacy?
Contact Rachel Phiri, Data Protection Lead.
Email Work Welfare Support Ltd