Patient Privacy Policy

Introduction

Our privacy notices are intended to provide you with a comprehensive understanding of the utilization of your personal data, the rationale behind its usage, the entities with whom it is shared, the duration for which it is retained, and the rights afforded to you. For detailed insights into your rights and the procedures to exert them, please refer to the “your rights” section delineated later in the document.

All our privacy notices will tell you the following:

Why we process your information
Our purpose for using your information
Whether you need to provide us with information
When and how we share your information with others
How long we keep your information
Whether we will transfer your information to another country
Whether we use automated decision-making or profiling
How we protect your information
How you can contact us

In this document, the term “employer” encompasses your employer, your employer’s representative (any individual who engages us on behalf of your employer), or pension trustees, as dictated by the context.

When does this privacy notice apply?

This privacy notice pertains to clients using our services, their referred employees, employees utilising our services, and patients receiving care through our services.

Changes to this privacy notice:

We regularly review our privacy notices and ensure that any updates are promptly reflected on our website. We encourage you to check the notice periodically, and the date of the last update is indicated at the outset of the document.

Who are we?

Sugarman Occupational Health is a trading name of Sugarman Health and Wellbeing Limited, a company registered in England and Wales at 33 Soho Square, London, W1D 3QU number 12449636.

We assume the roles of “Controller” or “Processor” in handling the personal data provided to us, depending on the specific context and service. This privacy notice specifically pertains to the services where we function as a Data Controller. For instance, in the case of Occupational Health Management Referral services, we operate as a Controller, as we determine the means and purposes of processing the data. On the other hand, in the provision of Alcohol and Drug Collection services (excluding instances where one of our clinicians interprets the results and provides a report), we act as a Processor, with the data Controller being your employer.

What is our purpose and lawful basis?

We have contractual obligations with our clients that necessitate our oversight of the occupational health and welfare of their workforce and the provision of health-related guidance. Our data processing activities are driven by the need to inform employers about their employees’ fitness for work, compliance with health and safety regulations, eligibility for ill-health retirement and pension decisions, and to ensure the welfare of their employees. The legal basis for processing this information is grounded in Article 6(1)(f) (“Legitimate Interests”) and the special category condition outlined in Article 9(2)(h) (“Health – including occupational medicine”) of the UK GDPR. Our legitimate interest in processing personal data arises from our obligation to deliver services. The specific condition enabling us to process special category data relies on the necessity for preventive or occupational medicine, assessment of employee working capacity, medical diagnosis, provision of health or social care, treatment, and management of health or social care systems and services.

In the event that you provide us with details pertaining to reasonable adjustments required for appointments following the Equality Act 2010, our reliance on Article 6(1)(c) of the UK GDPR is warranted, to fulfil our legal obligations under the Act.

The information we collect and how we use it

We collect and utilise directly provided information from you or your employer. When your employer makes a referral, it may contain personal details such as your full name, title, date of birth, address, contact telephone numbers, work or personal email addresses, employment information (including role and work history), and employee number.

When we use this information

We use this information for the following reasons:

To schedule and confirm appointments
To remind you about your appointment
To reach out if we need to reschedule
To make any necessary accommodations for your appointment
To arrange face-to-face, telephone, or video appointments
To verify your identity
To gather feedback about your appointment
To address any concerns you have about your appointment or records
To send you a brief survey for feedback on the service provided by our clinicians

We collect sensitive health information as part of your occupational health record, including medical history, current medications, and other relevant details. This may also involve information from your healthcare professionals, processed as part of your record.

Why do we use this information

When we use your health information, it will depend on the service we are providing. This may include:

Checking if you are fit to work
Giving information about your fitness to work to your employer or potential employer
Assessing if you need any reasonable adjustments or support at work due to a health condition
Checking if any risks at your workplace may affect your health
Advising your employer on pensions and ill-health retirement matters
Administering medications or vaccinations
Analysing diagnostic results and/or medication for your employer or potential employer (for example, for alcohol and drug testing services or biological monitoring services)
Advising your employer about your reason for absence if you are using our absence service
Referring you to an ancillary service such as physiotherapy or counselling
Providing you with primary care services

We may use your data to provide management reporting to your employer and to improve our services. We provide data analysis about the workforce to clients. Data will be anonymized or pseudonymized. No confidential medical information is shared. We may need to verify your identity with two pieces of ID. We may use AI technology to streamline report drafting, but a clinician manages and reviews the output.

The information we share and why

Under English common law, we share information with your employer with your consent.

If a report is generated, you have the right to see it before your employer does. If you choose to review it first, you have 2 business working days to correct any factual inaccuracies before we share it. We will not change the outcome, recommendations and guidance to management as this will have already been discussed and agreed upon by both parties.

The report provided to your employer includes relevant facts and opinions regarding your fitness for a task or job, any conditions affecting your role, and recommended adjustments. Some contracts may require us to transfer information to other specialist clinical services.

In some cases, we may share information with public bodies as required by law or in the public interest.

Our clinicians may need to share your information with their colleagues to provide high-quality service and in serious safeguarding cases. We also share some services and functions with other companies in HCRG Group, such as Legal and Compliance, HR, Marketing, Finance, and IT. This means we have to share your personal data with these companies, but we have strict rules and contracts in place to protect your information.

We also work with third-party companies to support our systems, scan medical records, and store data. Our systems may contact you for feedback about our clinicians, and if you participate, we may share your name and phone number with them in order to discuss feedback. We may also share information with other companies to manage your health data.

Sometimes, we may need to share your information with third-party suppliers chosen by your employer, so you can access services like physiotherapy and counselling. These suppliers will then be responsible for your information.

We take the security of your information seriously and have agreements in place with all our suppliers to protect it. We will never use your personal data for marketing.

If your employer changes healthcare provider, we may need to share your records with the new provider, and they will then be responsible for your information.

Sharing fitness information in safety-critical roles

If you have a safety-critical role, we may need to tell your employer about your fitness for the job. This is required by law or if it is in the public interest.

After your consultation, a written statement about your fitness for your role will be automatically given to your employer. It will show your fitness level and any adjustments or restrictions needed for your job. If your role needs a personal track safety card, your competency level will also be provided.

If you need to have a sentinel medical assessment and drug and alcohol test, the results will be put on the Sentinel database right away, whether you pass or fail. If there are any restrictions, they will also be included.

Sometimes, you may need to report the outcome of your consultation to a licensing authority or statutory organization, like the DVLA. If they ask, we will give them a copy of the outcome report.

In some cases, we may have a duty to report to a statutory body or licensing organisation if you can’t or won’t do it if it is in the public interest.

We may also share information with your employer, or they might get in touch with us, only about your fitness statement for your safety-critical role. We won’t share any other details.

How long do we store your information?

We store your information based on the type of record we process. Occupational health records are kept for the duration of our contract with your employer and for six more years after you leave your employment. After this, we securely delete your occupational health record.

According to Health and Safety law, employers must keep Health Surveillance records for 40 years or longer. These records are different from clinical records and will be kept for six years after you leave the relevant employment. If we can’t distinguish between different records, we may decide to keep them for a longer period to avoid early destruction.

If our contract with your employer ends, we stop processing your information. Your Occupational Health records, including any Health Surveillance records, will be transferred to your employer’s next Occupational Health provider. After the transfer, we keep your records for an additional 90 days before securely destroying them. If not requested for transfer, we store them for six more years before destroying them.

Non-occupational health recordings used for quality, training, and monitoring purposes are stored on a restricted network and kept for a maximum of 60 days before being securely deleted. Phone calls not made via Sugarman Health and Wellbeing telephony are not recorded.

Information processed about you, which is not part of your Occupational Health record, like internal email communications, may be securely deleted as part of our in-house ‘housekeeping’ procedure to ensure that we do not retain your data unnecessarily.

Where do we process your information?

Our company processes your health information in the UK and EEA. We take special care to ensure that your personal data remains within these regions and is not sent or stored outside of the UK or EEA. However, in cases where your employer is based in or has an office outside of the UK or EEA, and we are required to send information to them in order to fulfil our contract, we will do so in accordance with UK GDPR and the Data Protection Act 2018 to ensure the protection and security of your data.

How do we protect your information?

We take your security and privacy seriously in how we design our systems. Our in-house IT department is responsible for keeping the systems that hold your information secure. All information is stored on our secure system, which meets ISO 27001 and Cyber Essentials standards for security and undergoes annual penetration testing.

We use secure communication methods and software procedures to protect the security of your personal information during any communications with you. Your data is encrypted at rest, and we have physical, electronic, and procedural safeguards in place for its storage and disclosure. To ensure security, we may ask you to verify your identity before disclosing personal information to you.

Access to your personal data on our systems is only given to nominated employees within Sugarman Health and Wellbeing who need it to provide our services. These employees can access your information only using our secure IT network. They follow a strong Password Policy and receive regular training on Data Protection and Data Security.

When we share information with a third party, such as a laboratory processing test results, we have data-sharing agreements in place. Only authorised personnel are allowed to access your information for the purpose of processing, and they are not permitted to do anything else with it unless instructed by us. They will hold it securely and retain it for the period we instruct unless other legal obligations apply.

We use anti-virus and anti-malware software to reduce the risk of computer viruses or cyber-attacks on our systems, and we ensure that all security software updates are applied promptly.

When we move your information, we ensure that it is encrypted. For example, when we share a report with your employer, they access it through our secure portal. Only the report is stored on the portal for your employer to view; your Occupational Health record is securely kept on our system and visible only to us.

If your employer is unable to use our secure portal and we need to share your information via email, we always apply additional password protection when transferring your data in this way.

Your rights

UK GDPR grants you specific rights regarding your personal data. However, since we are processing your information for Occupational Health purposes, not all of these rights will apply. Below is a list detailing your rights under the UK GDPR:

Right of access: You can request a copy of your personal data held by us, which identifies you, and we have 30 days to respond once we verify your identity.
Right to rectification: If you believe that any personal information we hold is inaccurate or incomplete, you can request it to be updated. This right usually applies to email addresses or telephone numbers. It only applies to factual inaccuracies, and you cannot change the opinion of a clinical professional. If medical records are corrected, we may retain the original version and append the corrected version.
Right to erasure: Also known as the right to be forgotten, you can request the erasure of your personal data. However, we cannot erase records processed for Occupational Health purposes. You can request the erasure of personal information such as an email address if we can still identify your Occupational Health record.
Right to restrict processing: If you contest the accuracy of your personal data, your right to restrict processing will be automatically implemented. This means we will hold your personal data on file but will not process it.
Right to data portability: You have the right to ask us to electronically move, copy, or transfer your personal information in a machine-readable format.
Right to object: You have the right to object to the processing of your personal data at any time. This right only applies in certain circumstances.
Right to withdraw consent: Although we do not rely on consent to process your Occupational Health information, if we have previously informed you that we relied on consent as a legal basis to process any of your information, you can withdraw your consent at any time.

If you would like to make use of any of your rights, such as accessing your personal data or requesting its deletion, please reach out to us at info-occhealth@sugarmanhealth.com

When you do, we will ask you to provide specific information that will allow us to confirm your identity. This is to ensure that we safeguard your personal information. Our lawful basis for this is Article 6(1)(c) of the UK GDPR, which reflects our legal obligation to abide by the law. We will only retain the information used for verification purposes for as long as necessary to process your request.

The common law of confidentiality and consent

Health professionals must comply with confidentiality laws. You can withdraw consent for us to share your health information with your employer. If you do, your employer may need to make decisions without occupational health advice and may have to prevent you from doing your job if it requires routine fitness or health screenings.

Data Protection Officer contact details and your right to complain

Our data processing meets the highest standards. For inquiries about your personal information, contact our Data Protection Officer, info-occhealth@sugarmanhealth.com or write to us at Office SE09, 101 Lockhurst Ln CoventryCV6 5SF

If you have concerns about how we handle your data, you can file a complaint with the Information Commissioner’s Office (ICO) at www.ICO.org.uk.