Occupational Health Services

In order to comply with articles 13 and 14 of the General Data Protection Regulation (GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Identity and contact details of the data controller

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact details of the data protection officer

Our Data Protection Officer is Paul Bond. You can contact him at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Purposes for processing

Lancashire County Council is committed to promoting a culture of workplace health and wellbeing. We work with our occupational health provider to improve the current and future health of our employees by developing a healthy culture and adopting a systematic approach to occupational health.

This is done via a contract managed by the Health Safety and Quality team which makes available to managers and headteachers a full range of advice and support.

The three key areas of work where we provide occupational health support and advice are:

Preventative action and health promotion
Sickness and ill health management
Rehabilitation, early interventions and returning to work

Lancashire County Council's Occupational Health Services are provided by Working on Wellbeing Ltd, (t/a Optima Health). Optima Health are committed to providing a pro-active occupational health service for the county council which is based on prevention and early intervention.

Optima Health act on behalf of the county council when dealing with outside medical agencies such as GPs, hospitals and medical specialists etc when there is a need to source further medical evidence to assist them in making recommendations to management in occupational health reports.

Where you require these services, your personal data will be processed by Lancashire County Council and our partner organisations to fulfil these functions.

Category of personal data being processed

Personal data (information relating to a living, identifiable individual)
Special category personal data (racial, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation)

Legal basis for processing personal data

The legal basis for processing your personal data, in accordance with Article 6 (1) of GDPR is:

(b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.

(c) Legal Obligation: the processing is necessary for you to comply with the law. You must reference the applicable legislation if you wish to rely on this basis for processing.

The application of GDPR Article 6 (1) (c) above is applied by virtue of the following legislation:

Health and Safety at Work Act 1974
Management of Health and Safety at Work Regulations 1999
Control of Substances Hazardous to Health Regulations 2022
Control of Asbestos Regulations 2012
Control of Vibration at Work Regulations 2005
Noise at Work Regulations 2005

Legal basis for processing special categories of personal data

The legal basis for processing your special categories of personal data, in accordance with Article 9 (2) of GDPR is:

(b) Processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law

(h) Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.

The application of GDPR Article 9 (2) (h) above is applied by virtue of the following legislation:

Health and Safety at Work Act 1974
Management of Health and Safety at Work Regulations 1999
Control of Substances Hazardous to Health Regulations 2022
Control of Asbestos Regulations 2012
Control of Vibration at Work Regulations 2005
Noise at Work Regulations 2005

Recipients of the data

Lancashire County Council
Optima Health
Third party medical organisations, such as GPs, counsellors, physiotherapists and other medical specialists, where this is necessary to provide a medical intervention, such as counselling, or a specialist health assessment, or to source further medical information to assist in making recommendations in occupational health reports

Access to personal sensitive data on OH referrals

Access is restricted to authorised *managers, **officers and third-party organisations who have been authorised to process personal and sensitive personal information relating to the health of an employee.

All third-party service providers and other entities in the Optima Health group providing services to the county council are required to take appropriate security measures to protect employee personal information. Optima Health do not allow their third-party service providers to use employee personal data for their own purposes. They are only permitted to process employee personal data for specified purposes and in accordance with the county council's instructions.

*Authorised managers:

Where necessary, the referral information and a copy of the OH outcome report may be shared with other authorised managers (usually within the employee's hierarchy) with the purpose of supporting the employee in the workplace and managing sickness absence.

**Authorised officers

Authorised officers with 'case co-ordinator' status within the Peoples Service and Health and Safety team (who manage the OH contract), have access to all Lancashire County Council and School/Academy employee OH referrals and the outcome reports held on Optima Health's referral system, myOHportal. In addition, specified case co-ordinators receive regular contract management information which contains personal sensitive data. The information is required to:

manage the OH contract, for example, undertake trend analysis and monitor service costs and charges
triage and authorise or reject OH referral requests
support referring managers to manage sickness absence within their team
deal with OH referral queries and complaints
monitor the progress of ill health retirement cases

Information we share

Title
Name
DOB
Employee number
Home address
Personal or work contact numbers
Personal or work email address
Gender
Work address
Name of service or school
Occupation (job title)
Manager name (if being referred by line manager)
Current health conditions
Sickness absence information
Copies of risk assessments

Further data that may be required:

GP/Consultant details
Medical history

Any transfers to another country

No - Optima Health UK Limited process personal data within AWS data centres in London EU-West-2.

Retention periods

Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.

File type	Description	Security	Retention period
All clinical records	General occupational records such as sickness absence, fitness for work etc retained about an employee	Retained securely by Lancashire County Council Retained securely by Optima Health	10 years from termination of employment, unless a subsequent OH or pensions assessment is required after leaving employment, such as a pensions review, in which case any necessary supporting records will be reviewed 100 years from the employee's date of birth
Immunisation records	Occupational health records relating to immunisation	Retained securely by Lancashire County Council Retained securely by Optima Health	40 years from termination of employment
Health surveillance records	Occupational health records relating to health surveillance	Retained securely by Lancashire County Council Retained securely by Optima Health	40 years from termination of employment
Asbestos exposure records	Occupational health records relating to asbestos exposure	Retained securely by Lancashire County Council Retained securely by Optima Health	40 years from termination of employment
Ionising radiation related records	Occupational health records relating to ionising radiation	Retained securely by Lancashire County Council Retained securely by Optima Health	50 years from termination of employment
Psychological intervention records eg counselling, CBT, EMDR	Occupational health records relating to psychological interventions	Retained securely by Lancashire County Council Retained securely by Optima Health	10 years from termination of employment
Physiotherapy records	Occupational health records relating to physiotherapy interventions	Retained securely by Lancashire County Council Retained securely by Optima Health	10 years from termination of employment
Pre-employment health assessments record for unsuccessful applicants	Occupational health records relating to the prospective employee's pre-placement health screening/assessment	Retained securely by Lancashire County Council Retained securely by Optima Health	10 years from date of creation

Your rights

You have certain rights under the General Data Protection Regulation (GDPR), these are the right:

to be informed via Privacy Notices such as this.
to withdraw your consent. If we are relying on your consent to process your data then you can remove this at any point.
of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
of rectification, we must correct inaccurate or incomplete data within one month.
to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ

Or email: dpo@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Further information

If you would like more information about this specific project then please contact the Health, Safety and Quality team via email health.safety@lancashire.gov.uk.

For more information about how we use personal information see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).