Skip to main content

Staying Well at Work Privacy Notice

How we use your personal information for The Rhondda Cynon Taf Staying Well at Work Occupational Health Service

The Council provides services for local communities and the people who live in them.  Undertaking this work means that we must collect and use information about the people we provide services to and keep a record of those services. Because we collect and use personal information about individuals we must make sure that they know what we intend to do with their information and who it may be shared with. 

We have summarised in this privacy notice some of the key ways in which we use your personal information for occupational health purposes. This information should be read in conjunction with the Council’s corporate privacy notice.

1. Who we are, what we do.

The Staying Well @Work programme aims to support the health and wellbeing of staff within small and medium sized businesses in Rhondda Cynon Taf.  We have a team of HR specialists, physiotherapists, occupational health nurses, counsellors and more who can help support your business and your staff with a range of wellbeing issues.

We offer:

  • Specialist HR support to develop or improve wellbeing, equality and diversity policies and strategies.
  • HR and Occupational health advice on managing complex health cases in the workplace.
  • Training on managing mental health and wellbeing in the workplace.
  • Health surveillance programmes - such as audiometry and spirometry surveillance.
  • Access to occupational health nurses for advice on the impact of work on health and health on work.
  • Access to physiotherapists for advice and treatment in relation to a range of musculoskeletal conditions.
  • Counselling and coaching, therapeutic support or one to one coaching for individuals experiencing a range of mental health conditions.

2. What and whose personal information we hold?

  •  Personal data:This includes full name, date of birth, and (where relevant to purpose) a national insurance number. We will use this data to enable us to identify different individual’s records from each other. Where we hold health surveillance records a national insurance number is required to enable future management (perhaps decades hence) in the event of occupational disease. 
  • Personal Characteristics: We need to know your gender to enable our understanding of gender related health issues that may impact on your job role. Some health surveillance tests require an understanding of your ethnic background; different ethnicities have certain different physiological parameters and understanding these is important for the accuracy of some of our testing. We will only ask about your ethnicity when it is necessary for specific tests. We will not pass any details of your personal characteristics to other parties other than when necessary for medical referral or legal purposes and subject to specific consent. 
  • Contact details: Such as address, telephone number, or email. This is important so that we can contact individuals to arrange appointments, send reports etc. It is not passed to other parties unless you consent for us to do so.
  • GP or other Medical Specialist. It may be necessary for us to hold contact details for your GP or other medical specialist if we need to contact them about your condition. We will seek your permission before contacting your GP (or other medical specialist) and will only proceed once we have your written consent.
  • Job Role. This is important to know so that when we undertake assessments for work, we understand what the job role is so that appropriate adjustments are recommended.
  • Attendance / sickness record if applicable to the referral.
  • Previous health problems and adjustments that line managers / HR are already aware of to assist the occupational health process.

Project Eligibility and Reporting.

Our service is jointly funded by the Welsh/European Social Fund (ESF) Project. Confirmation of your residency status is required to confirm individual eligibility to join the project. We are required to regularly report on the project and provide general demographic information that includes the aggregated gender, ethnic origin, marital status, and caring responsibilities of our clients. Therefore, we ask you for this information when joining the service. This information is used for statistical purposes only and will not be released to a third party in a manner attributable to your personal identity. 

3. Where does the service get my information from?

Elements of personal data may be supplied to us by your line manager in their management referral to us. Any other necessary elements of personal data, not provided in the referral, will be provided by you at your initial consultation. 

Information about your job role, attendance/sickness record and any previous health problems known by managers/HR will usually be supplied to us in their referral; if that information is incomplete we may ask you for that information during our consultation.

How we acquire information about your health will depend upon the service we provide to you. Usually you will provide us with health information verbally during a consultation. We might also obtain information on your health through the health surveillance tests, physiotherapy or counselling that we provide. Finally, other medical specialists may provide us with information about your health, but this will not occur without your consent.

Information required to confirm eligibility for the project and for the statistical analysis needed for project reporting will be obtained when you first attend the service. 

4. What we will do with your personal information?

Personal data is held for the purposes of administering the service we provide to you. It will only be used for this purpose.  What we do with other forms of personal information depends upon the service we are providing for you:

Health Surveillance Results.

The employment role or tasks that you undertake within that role will have been subject to a health and safety risk assessment that indicates a need for health surveillance. The results of your tests are used to enable us to decide your fitness to perform that role or undertake the specified tasks. The outcome of our assessment will be a fitness for work certificate which we will provide to your employer. No detail of your test results, your general health or your medical condition will be provided to your employer or any other party without your consent.

Medical Records.

If you have been referred to us for Occupational Health advisor or physiotherapy the relevant professionals need to record your medical information to enable them to provide fitness to work advice to your employer in the form of a report. The report will only contain the information required for the employer to fulfil their legal responsibilities; whether your condition constitutes a disability, if it impacts your ability to perform a defined role and if reasonable adjustments at work need to be made.

Additionally, the medical records are required to appropriately manage and record the treatment provided.

All medical records are confidential, held securely and managed in accordance with GDPR and medical best practice. Medical records will not be shared with another party without your specific consent.

If you have been referred to the counselling service ,all counselling service information is kept separately with the counsellors in paper form and are not included in the main Occupational health record and are only viewed by the treating counsellor

Project Reports

Reports on project progress will draw upon statistical data drawn from the personal details or project users. However, this will not be directly attributable to individual project users.

5. What is the legal basis for the use of this information?

1.  The processing of your information and data outlined in this statement is necessary for us to comply with the law; this includes health & safety legislation and employment legislation.

2.  It is also necessary to support your Employer in complying with the same law (as we are acting as their agent and occupational health provider):

  • To assess the working capacity of an employee.
  • To ensure the health and safety of the employees at work and allow consideration of any reasonable adjustments that may be required to support their ability to work.

3. Special category data is collected for the “purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health”. This refers to the medical information we have from consultations with you, and that which we receive, with your consent, from your GP, Medical Consultants, Specialists and Therapists.

The Legal Basis is defined in GDPR under Article 6 (1)(c), Article 6 (1)(e) and Article 9 (2)(h). 

The processing is also subject to conditions and safeguards specified by relevant medical, nursing, and allied health professions professional bodies.

Whilst we ask for consent to share your information, this consent is in line with the Common Law Duty of Confidentiality, not consent as defined in the GDPR.

6. Does the service share my personal information with any other organisation?

To enable correct identification, we will share your full name and date of birth with your employer when we send them fitness for work certificates or fitness for work reports.

We may recommend that you be examined and/or treated by other medical professionals outside our organisation (for example your GP, National  Exercise Referral Scheme (NERS) or the Joint Care Programme ); we may offer to write a referral letter/form  to these individuals so that they can better understand your case. We will only write a referral letter/form with your consent.

In the event that you believe you are suffering from an occupational disease we may release your health surveillance records to a relevant third-party subject to receiving appropriate written consent from you.

In line with Health and Safety Law, Health Surveillance Information may also need to be shared with Health and Safety (under Reportable Injuries Diseases and Dangerous Occurrences regulations 2013 (RIDDOR)

7. How long will my information be kept?

All Occupational Health records (and personal data used for its administration) will be kept for the length of your employment and for 6 years after leaving employment (this applies to Management Referrals and Physiotherapy records). Counselling records will be kept for 20 years or for 8 years after the death of the employee. Health surveillance records required under Health and Safety at Work legislation must be retained in line with the retention periods stipulated in the specific regulations. For example, records that fall within the scope of the COSHH Regulations must be kept for 40 years. Following the stipulated time periods, the Occupational Health record will be expunged from the systems and deleted / destroyed.

8. Your information, your rights

The General Data Protection Regulation (GDPR) gives you important rights, including the right to access the personal information that the service holds about you.

View further details on your information rights and how to exercise them.

9. Contact us

If you have any concerns or would like to know more about how the service using your personal information please contact us in one of the following ways:

By email :

By telephone : 01443 827317

In writing : Staying Well at Work, Heol Talbot Road,Llantrisant,Pont-y-clun,CF72 8AW