Privacy policy

What we collect

Only what you choose to give us: your name, work email address, telephone number, the organisation you work for, and whatever context you include in your message.

Why we process it, and our lawful basis

We use it solely to respond to your enquiry and to discuss the services you have asked about. Our lawful basis is legitimate interests under Article 6(1)(f) of the UK GDPR: it is in both our interests and yours that we can reply to a business enquiry you have initiated.

We do not add enquirers to a mailing list, send marketing, sell or rent your details, or make any decision about you by automated means.

Analytics and cookies

This website uses a self-hosted Umami analytics installation to count page views and referrers. It does not set cookies, does not store an identifier on your device and does not collect personal data, so no consent banner is required.

We do not use Google Analytics, advertising tags or any third-party marketing trackers on this site. If that changes we will ask for your consent before any such cookie is set, and we will update this notice first.

How long we keep it

Enquiry correspondence is kept only as long as needed to deal with the enquiry and any resulting contract discussion, and is then deleted. Where an enquiry becomes a contract, the correspondence is retained with the contract records for six years.

What we collect

The referral information your employer sends us, the details of your role and its demands, the health information you give us during the assessment, clinical measurements taken during screening such as audiometry or lung function results, and where you consent to it, reports or records from your GP or treating specialist.

Our lawful basis for health data

Health data is special category data and needs a condition under Article 9 as well as a lawful basis under Article 6.

Our Article 6 basis is normally legitimate interests under Article 6(1)(f), and where your employer has a statutory duty to arrange surveillance or a medical, compliance with a legal obligation under Article 6(1)(c).

Our Article 9 condition is Article 9(2)(h): processing necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, and for the provision of health care. This processing is carried out by, or under the responsibility of, a professional subject to a duty of confidentiality.

Where a statutory medical is required, such as under the Control of Asbestos Regulations 2012 or the Ionising Radiations Regulations 2017, we also rely on Article 9(2)(b) in relation to obligations in the field of employment law.

Confidentiality and what your employer is told

Your clinical record is confidential and is held by us, not by your employer. Your employer does not get access to it.

What your employer receives is a report answering the questions they asked: whether you are fit for the role, any adjustments we suggest, and likely timescales. It contains clinical detail only where that detail is necessary to explain the advice, and only with your consent.

You have the right to see the report before it is sent, to ask for factual inaccuracies to be corrected, and to withdraw consent to it being sent at all. If you withdraw consent we will tell your employer that a report cannot be released, which they may then act on without our advice.

For health surveillance, the employer receives a fitness statement rather than clinical results, together with any advice about exposure controls.

Who else we share information with

We do not sell or rent personal data and we do not share clinical information for marketing.

Where it is necessary to deliver the service you have been referred for, we may share the minimum necessary information with a partner clinic carrying out your appointment, a clinician providing specialist input, or an IT supplier hosting our records, all under written confidentiality and data processing terms.

We may share information without consent only where the law requires it, or in the rare circumstances where there is a serious risk to the safety of you or others. If that ever happens we will tell you unless doing so would create further risk.

How long we keep clinical records

Retention is largely set by health and safety law rather than by us, and statutory health records are kept far longer than ordinary business records:

• Health surveillance records under COSHH: at least 40 years from the date of the last entry.
• Asbestos health records under the Control of Asbestos Regulations 2012: at least 40 years.
• Records relating to work with ionising radiation: until you reach 75, and in any event at least 30 years after the work ends.
• Management referral and case management records where no statutory duty applies: normally six years after our involvement ends.

Where records are held

Clinical records are held on access-controlled systems in the United Kingdom. Access is limited to the clinicians and administrative staff who need it to deliver your care, and access is logged.

How to exercise them

Email [email protected] or write to us at the address above. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

Please note that the right to erasure does not override the statutory retention periods listed above. Where we must keep a health record for 40 years, we cannot delete it on request.