CHOHS Ltd Privacy Notice For Employers

Who is CHOHS Ltd?

CHOHS Ltd is an occupational health provider acting on behalf of an employer.  Occupational health helps to keep individuals fit and healthy, both physically and mentally, at work and assists in individuals returning to work from absences.

What information is collected?

CHOHS Ltd collect both personal and sensitive information including some or all of the following information where relevant and necessary:

  • Name
  • Date of birth
  • Job title
  • Relevant medical, personal, and job history
  • Health assessment results
  • Medical records (if relevant)

Who is collecting it?

Our health professionals will collect the information. Depending on our schedules clients may interact with different specialist members of the team from time to time. However, we are all professional and qualified individuals in our field.

How is it collected?

Information in the form of completed occupational health referrals and signed consent is obtained from the employer when a referral is made to our services. Information is also collected from occupational health assessments, either on the telephone or in person.

Why is it being collected?

The information collected is to assist in forming our occupational health opinion to keep employees healthy and safe whilst at work, or to aid in their safe return to work.

What is the lawful basis for processing the information?

We seek to process your information with individuals’ signed consent. We are a provider who aims to be transparent and to inform individuals of the contents of their reports before we send them out. However, under the General Data Protection Regulations (GDPR) we can lawfully process information where ‘Processing is necessary for the purposes of preventative or occupational medicine, for assessing the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or management of health or social care systems and services on the basis of Union or Member State law or a contract with a health professional’.

How will it be used?

The information we collect is used to assist us in making informed occupational health decisions and to help us keep individuals safe and healthy at work. The information we collect is used to write occupational health reports to employers to keep them informed about their employees’ health and to help them make decisions with regard to managing their employees in the workplace.

What are the interests of the Data Controller?

The interests of the Data Controller are to obtain the information needed to offer the best occupational health support. All members of CHOHS Ltd team have signed confidentiality agreements.

Who is the data shared with?

Your data will be shared where necessary with members of the CHOHS Ltd team, your employer, and external providers if specialist support is required. Information is only shared to support an employee’s health and safety whilst at work, and/or to aid their return to work. The employer will only receive relevant information; occupational health records are private and confidential.

How long is data kept?

Our retention periods, for records held at CHOHS Ltd, are 40 years for COSHH assessment data, and 6 years from final contact for general health records.

What will the effect be on me?

We hope that by collecting this information we can help both the employer and employee. We can then make the best decision with regards to the health and wellbeing in the work place.

What are an individual’s rights?

Under GDPR (May 2018) the individual’s rights are as follows:

  • The right to be informed how we use personal data
    • This privacy notice is used to inform of how we use personal data. However, if you have any questions please contact us at any time on the details below.
  • The right to access personal data
    • If an individual would like to access their personal information we hold, a subject access request is required in writing via email or post (contact details below).
  • The right to be forgotten and have data deleted in specific circumstances
    • This right only applies when there is no compelling reason for its continued processing, or
    • the personal data was unlawfully processed (i.e. otherwise in breach of the GDPR).
  •  The right to data portability to transfer data to another service provider
    • This right applies:
      • to personal data you provided
      • where the processing is based on consent
      • And when processing is carried out by automated means
  • The right to have information corrected if it is out of date, incomplete or incorrect
    • If this is the case then please contact us as soon as possible, including if contact details change.
  • The right to object to, or stop data being processed on, certain grounds
    • This is mostly aimed at marketing and research purposes
    • Individuals have the right to object to:
      • Processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling);
      • Direct marketing (including profiling); and
      • Processing for purposes of scientific/historical research and statistics.
    • We can carry on processing the information if:
      • We can demonstrate compelling legitimate grounds for the processing, which override your interests, rights and freedoms or
      • The processing is for the establishment, exercise or defence of legal claims.
  • The right to restrict processing, meaning an individual can request that their data is only kept on file and not used for processing
    • This right in these situations:
      • The individual contests the accuracy of the personal data, meaning processing must be restricted until the accuracy of the personal data has been verified.
      • Where the individual objected to the processing, and we will then consider whether our organisation’s legitimate grounds override the individual.
      • When processing is unlawful and the individual opposes erasure and requests restriction instead.
      • If we no longer need the personal data but the individual requires the data to establish, exercise or defend a legal claim.
    • Rights in relation to automated decision making and profiling, meaning that in some cases individuals have the right not to be subject to a decision that is based on an automated process.
      • CHOHS Ltd does not use automated decision making or profiling. Our recommendations are formed from the information we receive and only our opinion.

In the event of a concern or complaint

If there are any concerns, worries, questions, or complaints about the process then please contact one of the CHOHS Ltd team. If you feel it relevant you can also complain to the Information Commission Authority (ICO).

CHOHS Ltd contacts:

T: 0117 962317
E: [email protected]