Everwell Occupational Health Ltd’s (Everwell) privacy notice explains how we use any personal data and special category data (health information) we collect about you.

Everwell is an Occupational Health provider to your employer, pension fund (or similar) and we have been contracted to provide an Occupational Health opinion on you or provide a related service. We need to collect 2 types of information:

1. Your personal contact details and unique identifiers such as name, address, email, telephone number, date of birth and similar.
2. Information relevant to the task we have been asked to complete. Typically, this will include:
   1. some employment related information (for example job role, possibly risk assessments, type of activities and similar);
   2. health related information relevant to the task we are doing. This data is classified as special category data.

We have three sources of information:

1. We are given information from your employer.
2. We collect information direct from you.
3. We collect information from other sources (such as your GP) but ONLY after you have given us express permission to do so. Therefore, you will be aware of what and from whom we are seeking.

Lawful basis for Processing the Data:

1. GDPR Article 6 (1) (f) - Processing the Personal Data is necessary for the purpose of the legitimate interests pursued by your employer.
2. GDPR Article 9 (2) (h) - Processing of the Special Category Data is necessary for the purposes of the Occupational Medicine services provided by Everwell to your employer.

We have to tell you the above, but all this really means in plain English is that:

3. We use the information to complete the task your employer has instructed us to undertake. These tasks can only be completed with your participation, so you will be aware of what we are doing.

We also:

4. Use anonymised data to monitor performance, provide statistics and high-level trend information.
5. Review and audit work within Everwell.

We only use your Data for the above tasks.

Everwell staff or, if required for the service delivery, approved associate Occupational Health or other associate professionals will have access to any relevant information we hold, in order to undertake the task.

Everwell’s approved IT contractors have access to our systems and therefore have indirect access to any stored data; we have and monitor confidentiality agreements for these contractors.

The outcome of our activity is to provide a relevant Occupational Health report, a certificate or similar statement of fitness to work. This will be for issue to your employer or whomever has contracted the work. Apart from this output, your employer does NOT have access to any data we have collected during the process other than to the data they have actually provided in the first instance.

We do NOT give any other party access to any of your data without your express consent or upon receipt of court order or other legal instruction.

For clarity, we would like to be clear that we have NO access to your NHS record. Likewise, the NHS does NOT have access to your Occupational Health file held by us.

Everwell holds your Data in an “Occupational Health File”. Everwell retains these files to ensure compliance with any Health and Safety Legislation or to have them available to defend any related complaint or employment claim. The retention period is:

• Generally, 6 years from employment ending in line with the guidance from the Information Governance Alliance / Department of Health;
• For any pre-placement assessment, whereby the applicant does not subsequently become an employee the retention period will be 2 years.
• Some Health and Safety laws (for example, The Control of Asbestos Regulations 2012) mandate much longer retention periods. These can have lengthy periods of 40+ (forty plus) years. Everwell will maintain such records in line with these statutory requirements.

We have a duty to keep all data secure and, in particular, we have an enhanced duty to protect your medical information. Therefore, at the end of a contract and following instruction from your employer and following a formal process, we will transfer your Occupational Health file only to another suitable Occupational Health (or medical) provider. We will NOT transfer your record to the care of your employer.

We do NOT use any of your personal data for any marketing purposes.

Cookies are files placed on your computer to collect standard internet log and visitor behaviour information. Everwell does NOT use cookies to collect any of your information.

You have the right to request a copy of your information that we hold about you

We want to ensure that your personal information is accurate and up to date. You may ask us to correct any factual information that you think is inaccurate. You cannot change any medical opinion.

You have the right to object or withdraw your consent to process your Data at any time

You have the right to complain to the Information Commissioner’s Office (ICO see www.ico.org.uk)

If you would like to exercise any of your rights, please email to admin@everwelloh.co.uk

Requests will normally be free of charge, but charges may apply in exceptional circumstances.

Please email toadmin@everwelloh.co.uk or write to Everwell OH, Edwin Foden Business Centre, Moss Lane, Sandbach CW11 3AE.

Everwell’s Data Protection Officer is Mr Kevin Harding and Everwell’s ICO registration number is Z9315837.