Who controls your data
If you're employed by us when you use the service, the controller is Derbyshire County Council. If we're providing an occupational health service on behalf of another employer, they are the data controller and we're just the data processor. Additionally, an occupational health specialist becomes a data controller in their own right when exercising professional judgement.
Information we collect
We may ask for:
- basic details such as your name, your home address, your date of birth and, if you have them, an email address and telephone number
- more intimate information such as your medical history and current health status
Why we need your data and how long we keep it
We need your personal information so that we can provide an occupational health service that helps you effectively. It's in every employer's interest to have a healthy workforce. In data protection terms, we say that legitimate interest is our lawful basis of processing, under the General Data Protection Regulation (GDPR) Article 6(1)(f).
Your medical history and other health data are regarded as 'special category' data, which our clinical professionals process for the purposes of preventive and occupational medicine.
We also have duties under legislation such as the Employment Rights Act. So if you work for us, we're processing your data under an employment obligation.
We do not use your information for any marketing purposes.
We keep our current case files up to date, so please tell us about any changes. We close files when they are no longer current but closure doesn't mean we destroy them. Instead, we'll keep your information for up to 100 years after your date of birth. This is because we may need evidence of who we have helped and how, even after many years have passed. For example, some people apply to us for their occupational health history so they can apply for early access to their pension.
Our counselling service is different. For counselling records, we only keep your information for 7 years after your contact with the service.
Sharing your information
Your information is closely guarded within Derbyshire County Council. Much of what you tell us is covered by common law confidentiality, which means you have a reasonable expectation that you are giving personal information in confidence. Our occupational health professionals take their legal and ethical duties very seriously, so if we have a need to share confidential information, we ask your permission first. We would not act against your wishes without compelling reasons - for instance, if you told us you were planning to harm someone.
Like any occupational health service, we pass completed reports and recommendations back to your employer for their action. For instance, we might tell your line manager about an issue that could be resolved by adjusting your work environment. Our communications to management only include the information they need in order to act.
We do not ordinarily share your information with any other services or organisations, unless the law requires.
Keeping your information safe
We keep your information in paper files and a database. We're committed to protecting personal data and have data policies and procedures in place to ensure that it's safeguarded.
Your rights
Your data protection rights include the right to access your information and have it corrected if necessary. Should you wish to raise any concerns about how we have processed your personal data you can contact the Data Protection Officer:
- email: gdpr@derbyshire.gov.uk
- write to:
Data Protection Officer
Derbyshire County Council
County Hall
Matlock
DE4 3AG
You also have the right to contact the Information Commissioner.
Who you can contact
Find out more about how we handle personal information.
If you need to complain, find ways to get in touch, or come into your local library to speak to us.