top of page

Privacy notice

Last updated: September 2026

Version: 1.0
Effective from: 01 September 2026

SECTION 1 — ABOUT THIS PRIVACY NOTICE

1.1. Worklife Medical Ltd (“Worklife Medical”, “Worklife”, “we”, “us” or “our”) provides independent occupational health and workplace medical services. We take the privacy, confidentiality and security of personal information seriously.

​

1.2. This Privacy Notice explains:

  • what personal information we collect;

  • where we obtain it from;

  • why we use it;

  • our lawful basis for doing so;

  • who we may share it with;

  • how long we keep it;

  • how we protect it; and

  • the rights individuals have in relation to their information.

 

1.3. This Privacy Notice applies to personal information we process about:

  • employees and workers referred to Worklife Medical;

  • prospective employees undergoing pre-placement health assessment;

  • individuals undergoing occupational, safety-critical, driving or other medical assessments;

  • individuals who contact or purchase services from us directly;

  • representatives and employees of our Clients;

  • prospective Clients and other business contacts; and

  • people using our website or online services.

 

1.4. Worklife Medical processes personal information in accordance with applicable data-protection legislation, including the UK General Data Protection Regulation (“UK GDPR”) and Data Protection Act 2018.

SECTION 2 — WHO IS RESPONSIBLE FOR YOUR INFORMATION

2.1. The data controller is:

Worklife Medical Ltd
Company number: 16422579

Email: privacy@worklifemedical.com

Telephone: 0151 272 5435
Website: worklifemedical.com

 

2.2. When Worklife Medical provides professional occupational health services, we will ordinarily act as an independent data controller for the personal information we process in exercising our professional occupational health responsibilities.

This means Worklife Medical determines the purposes and essential means of that processing and is responsible for complying with applicable data-protection requirements.

​

2.3. Where an employer, prospective employer or other organisation commissions our services (“the Client”), the Client will ordinarily be a separate data controller for the personal information it processes for its own employment, management and business purposes.

​

2.4. The Client does not control Worklife Medical's clinical decision-making or how we maintain our confidential occupational health clinical records. The Faculty of Occupational Medicine (FOM) guidance notes that independent OH providers are likely to be data controllers.

SECTION 3 — WHAT INFORMATION DO WE PROCESS

The information we process depends upon our relationship with you and the service being provided.

​

3.1. Identity and contact information. We may process:

  • your name;

  • date of birth;

  • address;

  • email address;

  • telephone number; and

  • other information reasonably required to identify or communicate with you.

 

3.2. Employment and occupational information. We may process:

  • your employer or prospective employer;

  • occupation and job title;

  • duties and responsibilities;

  • working hours and working arrangements;

  • relevant workplace demands, exposures and hazards;

  • sickness absence information;

  • relevant employment history;

  • workplace adjustments;

  • information contained within an occupational health referral;

  • relevant job descriptions or workplace risk information; and

  • relevant information provided by managers or other authorised representatives.

 

3.3. Health and clinical information. Where necessary for the service being provided, we may process information about:

  • physical or mental health;

  • symptoms and diagnoses;

  • disability and functional limitations;

  • medication and treatment;

  • relevant medical history;

  • relevant family or social history;

  • healthcare consultations;

  • investigations and test results;

  • sickness absence;

  • immunisation or infection status where relevant;

  • information you provide during an occupational health consultation;

  • examination findings;

  • clinical opinions;

  • fitness for work;

  • workplace adjustments;

  • occupational health reports; and

  • relevant correspondence with healthcare professionals.

Information concerning health is special category personal data under the UK GDPR and receives additional legal protection.

 

3.4. Medical and fitness assessment information. Where relevant to the assessment being undertaken, we may also process measurements or findings such as:

  • blood pressure and pulse;

  • height and weight;

  • vision;

  • hearing;

  • respiratory function;

  • urinalysis;

  • functional assessment findings; and

  • other tests or measurements reasonably required for the particular medical or occupational assessment.

We will not undertake tests simply because they are available. Information collected should be relevant and proportionate to the purpose of the assessment.

 

3.5. Client and business information. Where you deal with us on behalf of a Client, prospective Client, supplier or another organisation, we may process:

  • your name;

  • job title;

  • organisation;

  • business contact details;

  • correspondence;

  • enquiries;

  • quotations and contractual information;

  • invoicing and payment information; and

  • other information reasonably necessary to manage our business relationship.

 

3.6. Website and enquiry information. If you contact us through our website or other communication channels, we may process the information you choose to provide together with relevant technical information associated with use of our website.

Please do not submit confidential medical information through a general business or website enquiry form unless specifically asked to do so through an appropriate channel.

SECTION 4 — WHERE DO WE OBTAIN INFORMATION FROM

4.1. We obtain much of the information we process directly from you.

​

4.2. We may also receive information from other sources where relevant and lawful, including:

  • your employer or prospective employer;

  • managers or other authorised representatives;

  • another occupational health provider;

  • your GP, consultant or another healthcare professional;

  • laboratories or diagnostic providers;

  • organisations responsible for relevant medical, licensing or fitness standards; and

  • other organisations or individuals where obtaining the information is lawful and relevant to the service being provided.

 

4.3. Where we seek confidential medical information from another healthcare professional, we will comply with applicable legal, professional, consent and confidentiality requirements.

​

4.4. We do not routinely require access to an individual's complete medical record.

SECTION 5 — WHY DO WE USE PERSONAL INFORMATION

5.1. Occupational health and medical services. We may process personal information to:

  • assess the relationship between health and work;

  • assess fitness for work;

  • advise about sickness absence and return to work;

  • assess functional capacity and limitations;

  • recommend workplace adjustments;

  • identify relevant workplace health risks;

  • undertake pre-placement health assessments;

  • undertake safety-critical, driving or other workplace medical assessments;

  • provide occupational health advice;

  • prepare occupational health reports;

  • provide appropriate follow-up or review; and

  • communicate with individuals and Clients about these services.

 

5.2. Clinical and professional purposes. We may process information to:

  • maintain an appropriate occupational health clinical record;

  • provide appropriate health advice;

  • identify circumstances in which further healthcare may be appropriate;

  • communicate with another healthcare professional where appropriate;

  • undertake clinical governance and quality assurance;

  • respond to concerns or complaints;

  • maintain professional standards; and

  • meet our legal, regulatory and professional obligations.

 

5.3. Administration and operation of Worklife Medical. We may process information to:

  • receive and administer referrals;

  • arrange appointments;

  • send appointment information and reminders;

  • communicate with Clients;

  • respond to enquiries;

  • manage contracts and Client relationships;

  • administer invoices and payments;

  • maintain appropriate financial and business records;

  • protect our information, systems and services;

  • investigate security incidents, misuse or fraud;

  • establish, exercise or defend legal claims; and

  • comply with legal and regulatory requirements.

SECTION 6 — OUR LAWFUL BASIS FOR PROCESSING PERSONAL INFORMATION

Worklife Medical will only process personal information where we have an appropriate lawful basis. The lawful basis depends upon the purpose for which information is being processed.

​

6.1. Employer-commissioned occupational health services. For employer-commissioned occupational health assessment and advice, Worklife Medical will ordinarily rely upon Article 6(1)(f) UK GDPR – legitimate interests. Our legitimate interests include providing independent occupational health services which enable organisations and workers to understand and appropriately manage the relationship between health and work. We consider whether the processing is necessary and proportionate and whether those interests are overridden by the rights and interests of the individual concerned.

​

6.2. Services purchased directly by an individual. Where you purchase a service directly from Worklife Medical, we may process information where this is necessary to enter into or perform our contract with you under Article 6(1)(b) UK GDPR.

​

6.3. Other processing. Depending upon the particular purpose, we may also process personal information where necessary:

  • to comply with a legal obligation;

  • for our or another person's legitimate interests;

  • to protect someone's vital interests in exceptional circumstances; or

  • where consent is the appropriate lawful basis.

We determine and document the appropriate lawful basis according to the particular processing purpose.

SECTION 7 — HEALTH INFORMATION AND OTHER SPECIAL CATEGORY DATA

7.1. Health information is special category personal data and requires an additional legal condition before it can be processed.

​

7.2. For our professional occupational health activities, Worklife Medical will ordinarily rely upon Article 9(2)(h) UK GDPR, which permits necessary processing for purposes including occupational medicine and assessment of an individual's working capacity, subject to the applicable legal and professional safeguards. This is particularly appropriate to professional OH processing: the FOM guidance identifies Article 9(2)(h) and the professional-secrecy safeguards applicable to occupational health professionals.

​

7.3. Other Article 9 conditions may apply to particular processing activities where appropriate, including where processing is necessary:

  • for relevant employment or social-protection obligations or rights;

  • for reasons of substantial public interest;

  • for the establishment, exercise or defence of legal claims;

  • to protect vital interests; or

  • where explicit consent is an appropriate condition.

 

7.4. We determine and document the appropriate Article 6 lawful basis and Article 9 condition for our processing activities.

SECTION 8 — DATA PROTECTION, CONSENT AND MEDICAL CONFIDENTIALITY

These are related, but they are not the same thing.

​

8.1. The lawful basis Worklife Medical uses to process information under the UK GDPR is separate from the professional and legal requirements governing consent to assessment and disclosure of confidential clinical information.

​

8.2. Worklife Medical does not ordinarily rely upon an employee's consent as its UK GDPR lawful basis for providing employer-commissioned occupational health services. This is particularly important in employment because consent may not always be freely given where there is an imbalance of power. The FOM guidance similarly advises OH professionals generally to use another GDPR lawful basis while continuing to obtain consent where required by common-law confidentiality and professional ethics.

​

8.3. We will nevertheless obtain appropriate consent for occupational health assessment and for disclosure of confidential clinical information where required by law and professional standards.

​

8.4. An individual may normally decline to participate in an occupational health assessment.

​

8.5. An individual may also decline or withdraw consent for an occupational health report to be released before it has been issued.

​

8.6. If an assessment cannot be completed or a report cannot be released because the individual declines assessment or report disclosure, Worklife Medical may inform the Client of this. We will not ordinarily disclose unnecessary confidential clinical information when doing so.

​

8.7. The Client may then need to make employment or management decisions using the information otherwise available to it.

​

8.8. There are limited circumstances in which confidential information may be disclosed without consent, for example where disclosure is required by law or is otherwise justified under applicable legal and professional principles. Any such disclosure will be carefully considered and limited to information reasonably necessary for the relevant purpose.

SECTION 9 — WHAT INFORMATION DO WE PROVIDE TO YOUR EMPLOYER

9.1. Information you provide during an occupational health consultation is confidential.

​

9.2. Your employer does not have a general right of access to your Worklife Medical clinical record. Commissioning or paying for an occupational health assessment does not give an employer access to the underlying clinical notes. The FOM guidance describes the clinical record as confidential documentation whose access should be strictly limited to OH professionals and others with a legitimate reason for access.

​

9.3. Where appropriate, Worklife Medical may instead provide the Client with an occupational health report containing information and professional advice reasonably necessary for the occupational purpose. This may include:

  • fitness for work;

  • the functional effects of health upon work;

  • likely timescales or prognosis relevant to work;

  • return-to-work advice;

  • workplace adjustments;

  • relevant restrictions;

  • rehabilitation;

  • further occupational health review; and

  • answers to appropriate occupational health questions raised by the Client.

 

9.4. We will aim to provide useful occupational health interpretation and recommendations without unnecessarily disclosing medical information. A diagnosis or other clinical information will only be included where it is appropriate and relevant to the occupational purpose and disclosure is consistent with our confidentiality obligations.

​

9.5 No surprises. Wherever practicable, we will explain the important conclusions and recommendations we intend to communicate to the Client before releasing an occupational health report.

SECTION 10 — HOW DO WE PROTECT YOUR INFORMATION

10.1. Worklife Medical will only share personal information where there is an appropriate reason and lawful basis for doing so. Depending upon the circumstances, this may include:

  • the Client commissioning an occupational health service;

  • healthcare professionals involved in your care;

  • another occupational health provider;

  • laboratories, diagnostic services or other healthcare providers;

  • appropriately authorised Worklife Medical employees, associates or subcontractors;

  • organisations providing IT, communications, records-management, payment or other services to Worklife Medical;

  • professional advisers, including legal, accounting and indemnity advisers;

  • regulatory, statutory or professional bodies;

  • courts, law-enforcement agencies or other public authorities where legally required; and

  • another organisation where you have requested or authorised disclosure or another lawful basis exists.

 

10.2. We will limit disclosures to information reasonably necessary for the relevant purpose.

​

10.3. Where another organisation processes personal information on our behalf, we will put appropriate contractual, confidentiality and data-protection arrangements in place.

​

10.4. Worklife Medical does not sell personal or medical information.

SECTION 11 — OCCUPATIONAL HEALTH CLINICAL RECORDS

11.1. Worklife Medical maintains confidential occupational health clinical records where appropriate to the services provided.

​

11.2. Clinical records are maintained separately from an employer's personnel and management records.

​

11.3. Access to identifiable clinical information is restricted according to role and legitimate need.

​

11.4. Where a Client changes occupational health provider, Worklife Medical may facilitate the appropriate transfer of occupational health records where this is lawful and consistent with applicable confidentiality and professional requirements. The FOM guidance states that outsourced-provider OH records will normally remain with the OH provider unless alternative arrangements have been made, and recommends secure, auditable arrangements where records are transferred to a replacement provider.

SECTION 12 — HOW LONG DO WE KEEP PERSONAL INFORMATION

12.1. Worklife Medical keeps personal information only for as long as necessary for the purpose for which it was collected and to meet applicable legal, regulatory, professional, clinical and legitimate business requirements.

 

12.2. Different types of information may therefore be retained for different periods.

​

12.3. When determining an appropriate retention period, we consider:

  • the nature and sensitivity of the information;

  • why it is held;

  • applicable professional and clinical record-keeping requirements;

  • legal and regulatory requirements;

  • relevant limitation periods and potential legal claims; and

  • whether continued retention remains necessary and proportionate.

 

12.4. Our defined retention periods are maintained within the Worklife Medical Records Retention Schedule.

​

12.5. When information no longer needs to be retained, it will be securely deleted, destroyed or appropriately anonymised.

SECTION 13 — HOW DO WE PROTECT PERSONAL INFORMATION

13.1. Worklife Medical uses appropriate technical and organisational measures designed to protect personal information against:

  • unauthorised or unlawful access;

  • inappropriate disclosure;

  • accidental loss;

  • alteration;

  • destruction; and

  • other unlawful processing.

 

13.2. Our safeguards are proportionate to the nature and sensitivity of the information we process.

​

13.3. Access to personal information is restricted according to role and legitimate operational or professional need.

​

13.4. Identifiable clinical information receives additional protection because of its confidential and sensitive nature.

SECTION 14 — INTERNATIONAL TRANSFERS

14.1. Some organisations providing technology or other services to Worklife Medical may process or store personal information outside the United Kingdom.

​

14.2. Where personal information is transferred outside the UK, Worklife Medical will ensure that the transfer complies with applicable data-protection legislation. Where required, this will include use of an appropriate legal transfer mechanism and safeguards.

​

14.3. You may contact us for further information about safeguards applying to your personal information.

SECTION 15 — TECHNOLOGY, AUTOMATION AND ARTIFICIAL INTELLIGENCE

15.1. Worklife Medical may use appropriately governed technology, including automation and artificial intelligence, to support administrative or professional activities.

​

15.2. Technology may assist activities such as administration, information organisation or preparation of draft material for professional review.

​

15.3. Worklife Medical does not use automated systems to independently determine an individual's fitness for work, make substantive occupational health clinical decisions or independently authorise the release of an occupational health report.

​

15.4. Where technology supports clinical or professional work, appropriate human oversight will be maintained and the responsible healthcare professional remains accountable for their professional opinion and the information communicated. This also reflects the FOM’s current guidance that AI should support rather than replace professional expertise, that clinical accountability remains with the OH professional, and that use of AI should be transparent to workers.

SECTION 16 — YOUR DATA PROTECTION RIGHTS

16.1. Depending upon the circumstances and applicable law, you may have the right to:

  • be informed about how we use your personal information;

  • obtain access to personal information we hold about you;

  • ask us to correct inaccurate or incomplete information;

  • ask us to erase personal information in certain circumstances;

  • ask us to restrict processing in certain circumstances;

  • object to certain processing;

  • receive certain personal information in a portable format where applicable;

  • exercise rights relating to solely automated decision-making where applicable; and

  • withdraw consent where the relevant processing is based upon consent.

 

16.2. These rights are not absolute and their application depends upon the circumstances and the lawful basis for processing. For example, withdrawing consent for an occupational health report to be released does not necessarily require Worklife Medical to delete the underlying clinical record.

​

16.3. To exercise a data-protection right, contact: privacy@worklifemedical.com

​

16.4. We may need to verify your identity before responding.

​

16.5. Your right to object. Where Worklife Medical relies upon legitimate interests as the lawful basis for processing your personal information, you have the right to object to that processing in certain circumstances. If you wish to object, please contact us using the details above.

SECTION 17 — PROVIDING INFORMATION TO WORKLIFE MEDICAL

17.1. Whether you are required to provide personal information depends upon the service concerned.

​

17.2. Participation in an occupational health assessment is normally voluntary. However, if information reasonably required for an assessment is not provided, Worklife Medical may be unable to:

  • complete the assessment;

  • provide a fitness opinion;

  • answer some or all of the Client's questions; or

  • provide an occupational health report.

 

17.3. Where this occurs, we may inform the Client that the assessment or opinion could not be completed without unnecessarily disclosing confidential clinical information.

SECTION 18 — WHERE WE RECEIVE YOUR INFORMATION FROM SOMEBODY ELSE

18.1. If your employer, prospective employer or another organisation refers you to Worklife Medical, we may receive personal information about you before we have had direct contact with you.

​

18.2. This may include your identity and contact details, employment information, the reason for referral and relevant information supplied by the referring organisation.

​

18.3. Where this occurs, we will provide or bring this Privacy Notice to your attention within the timescale required by applicable data-protection law. Where we communicate with you directly, we will normally provide or bring this Privacy Notice to your attention when we first contact you.

SECTION 19 — WEBSITES, COOKIES AND ELECTRONIC COMMUNICATIONS

19.1. When you use our website or online services, we may process information that you provide voluntarily together with technical information generated through use of those services.

​

19.2. Where our website uses cookies or similar technologies, information about their use and any choices available to you will be provided through our website's Cookie Notice and cookie controls where applicable.

​

19.3. We may communicate electronically with Clients and individuals where appropriate for the administration and delivery of our services. Appropriate safeguards will be applied according to the nature and sensitivity of the information being communicated.

SECTION 20 — CHANGES TO THIS PRIVACY NOTICE

20.1. We will keep this Privacy Notice under review.

​

20.2. We may update it where necessary to reflect changes in:

  • our services;

  • the personal information we process;

  • the purposes for which information is used;

  • our systems or suppliers;

  • professional or regulatory guidance; or

  • applicable law.

 

20.3. The current version will be available on the Worklife Medical website.

​

20.4. Where a change materially affects the way we use personal information we already hold, we will take appropriate steps to bring that change to the attention of affected individuals.

SECTION 21 — QUESTIONS, CONCERNS AND COMPLAINTS

21.1. If you have a question about this Privacy Notice, wish to exercise a data-protection right or have concerns about the way Worklife Medical has handled your personal information, please contact:

Worklife Medical Ltd

Email: privacy@worklifemedical.com

Telephone: 0151 272 5435
Website: worklifemedical.com

​

21.2. We would welcome the opportunity to investigate and respond to any concerns you have.

​

21.3. You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection: https://ico.org.uk/make-a-complaint/data-protection-complaints

​

21.4. You do not have to raise a complaint with Worklife Medical before contacting the ICO.

bottom of page