Privacy notice
The Occupational Health department is committed to maintaining the privacy, dignity and confidentiality of its service users. We adhere to the requirements under the General Data Protection Regulations (2018) along with the General Medical Council and Nursing and Midwifery codes of confidentiality.
Here at Loughborough University we take the protection of your data and your privacy seriously and this part of our website provides information on what personal data we collect; how and why we collect it; how we store it and for how long we keep it. This Notice will also explain how we look after your data and protect your rights in accordance with the relevant data protection legislation.
Further information and guidance on the University’s approach to personal information can be found at the University’s Information Governance webpages.
What personal information do we hold about you?
We provide reports to your manager (employer) and Human Resources (HR) about your fitness to work including results of statutory health surveillance relevant to your job e.g. hearing tests and of any adjustments required to support you in work. We also provide advice on adjustments to accommodate a disability or health condition. Information is only shared with your consent.
We will share relevant information from your occupational health record with other service providers when making a referral e.g. for physiotherapy. This will be with your consent.
You have the right to object to information being shared. You also have the right to have any mistakes or errors corrected.
Where an external provider is used to provide some aspect of Occupational Health care to the University there will be a contract between the Data Controller (the University) and the Data Processor (the external Occupational Health Service provider).
Why do we collect your information?
We will also use your information so that we can check and review the quality of service we provide. This helps us to improve our services to you.
We use your anonymised data to provide reports on service activity to the University’s Audit and Risk Committee.
Who has access to your data at the University?
Healthcare professionals and administrative staff at Loughborough University’s Occupational Health and Wellbeing department.
HR and line managers with your informed consent.
Loughborough campus physiotherapy service if referral required.
USS or the LGPS pension scheme in relation to ill health retirement applications.
This may affect the assessment of your fitness to work and employment.
You are not able to object when information is legitimately shared for safeguarding reasons.
In appropriate circumstances it is a legal and professional requirement to share information for safeguarding reasons. This is to protect people from harm.
You have the right to object to information being shared.
Rights of access
As a data subject, you have the right to access your medical record and have any errors or mistakes corrected. Anyone wishing to access Personal Data about themselves should complete the Data Protection Subject Access Request Form.
Who do we share your data with outside the University?
Access to Medical Reports Act
If we need to get a report from your GP or specialist, we will need your consent. This report is only to gain up to date medical information from your treating specialist, and the report will be kept by Occupational Health in confidence and not be released to your Manager or Human Resources (HR). Occupational Health (OH) will interpret the report, discuss it with you and then suggest a suitable OH report to be sent to your Manager or HR.
Information held in the OH department will only be shared without your consent in exceptional circumstances such as -
- Where necessary in the public interest e.g. to protect you or someone else from the risk of significant harm
- Where required by law
If we feel it necessary to break confidentiality for the above reasons this will be discussed with you if possible.
How long do we keep your information?
Occupational Health records will be kept for the following periods:
40 years from date of last entry in the case of Control of Substances Hazardous to Health (COSHH) records, in support of the Health and Safety Executive (HSE) 'Health Record' requirement*
50 years from date of last entry in the case of Ionising Radiation records, in support of the HSE 'Health Record' requirement*
10 years for standard employment records after an employee leaves Loughborough University, unless there are any HSE requirements then the above will apply
* a Health Record is a non-confidential record of the outcome of an employee's Health Surveillance assessments, held by management. Whereas the HSE does not stipulate the storage of confidential OH records for this long, it is widely accepted within the speciality of Occupational Medicine that retention of such records is in accordance with medico-legal best practice, as it supports the identification of potential latent disease in the future.
General
Loughborough University does not sell your data to third parties or other organisations.
From time to time, Loughborough University will use your personal data to conduct analysis that will provide useful information.
Who can I contact?
If you have a general question about how Occupational Health related data is used, please do contact us. You can contact Sarah van Zoelen, Occupational Health and Wellbeing Manager. Please also contact this email if you have a concern or complaint about how your data is being handled.
If you have any questions more generally regarding Data Protection at the University, then please do contact the Data Protection Officer or write to The Data Protection Officer at Academic Registry, Loughborough University, Loughborough, Leics, UK LE11 3TU.
You may find additional useful information and the answer to your query on our Information Governance webpages.
Complaints about Data Protection
If you have taken steps to have a concern or complaint about Loughborough University’s handling of data resolved but are still not satisfied you have a right to lodge a complaint with the Information Commissioner’s Office (ico), who are the relevant regulator for data privacy and protection matters. The ico can be contacted at Wycliffe House, Water Lane, Wilmslow, SK9 5AF.
Updates to this policy
This information was last updated in November 2019. It is reviewed as necessary. If there are significant changes in the processing of your personal data which will impact you, we will act to inform your directly.