top of page
Homepage

Privacy Policy

Last reviewed: October 2026

ServiceLine Occupational Health Ltd ("ServiceLine", "we", "us" or "our") is committed to protecting the privacy, confidentiality and security of the personal information entrusted to us.

 

This Privacy Notice explains how we collect, use, store and share personal information when providing occupational health services and explains the rights individuals have in relation to their information.

Health information is classed as special category personal data under UK data protection legislation and therefore requires additional protection. [ico.org.uk], [cy.ico.org.uk]

Who we are

ServiceLine Occupational Health Ltd
Suite 3, Salters House
Sedgefield
County Durham
TS21 3EE

 

Website: https://www.servicelineoh.co.uk

 

ServiceLine provides independent occupational health services to employers and individuals, including:

​

  • occupational health management referrals;

  • pre-employment and pre-placement health assessments;

  • fitness-for-work assessments;

  • health surveillance;

  • occupational health medicals;

  • workplace health advice;

  • advice regarding workplace adjustments;

  • onward referral for occupational health physician or specialist input where appropriate.

 

Depending upon the service being provided and the contractual arrangements in place, ServiceLine may act as a data controller in respect of the clinical occupational health information it processes. Employers will normally remain separately responsible for the employment information that they hold and for information contained within their own employment records.

 

Where another organisation processes information on our behalf, or where another controller is involved, the respective data protection responsibilities will be determined by the nature of the particular service and contractual arrangement.

What information we collect

The information we process will depend upon the occupational health service being provided.

 

It may include:

 

Personal information

  • name;

  • date of birth;

  • address and contact information;

  • employer;

  • job title and duties;

  • employee or identification number;

  • employment information relevant to the referral or assessment.

 

Health and special category information

 

We may process information concerning:

  • physical and mental health;

  • relevant medical history;

  • medication and treatment;

  • sickness absence;

  • disability or health conditions;

  • workplace exposures;

  • previous occupational health assessments;

  • health surveillance results;

  • audiometry, spirometry or vision screening results;

  • medical examination findings;

  • functional capacity and fitness for work;

  • workplace adjustments or restrictions.

 

We will only seek information that is necessary and relevant to the occupational health purpose for which you have been referred or assessed.

How we obtain your information

Information may be provided directly by you, for example during:

  • an occupational health consultation;

  • a health questionnaire;

  • a medical assessment;

  • health surveillance;

  • telephone, video or face-to-face consultations.

Information may also be provided by your employer or referring organisation as part of an occupational health referral.

Where necessary and appropriate, information may also be obtained from another healthcare professional, such as your GP, consultant or other clinician.

Where a medical report or medical records are required from another healthcare professional, we will follow the appropriate legal and professional requirements and obtain the necessary authority before requesting that information.

Why we process your information

We process information to enable us to provide occupational health services. Depending upon the service involved, this may include:

​

  • assessing fitness for work;

  • assessing fitness for a particular role or activity;

  • undertaking pre-employment or pre-placement health assessments;

  • providing health surveillance;

  • undertaking occupational health medicals;

  • assessing the impact of health upon work and work upon health;

  • advising employers regarding functional capability;

  • recommending appropriate workplace restrictions or adjustments;

  • determining whether further clinical assessment may be required;

  • maintaining an occupational health clinical record;

  • providing reports to referring employers or organisations;

  • meeting relevant professional, clinical, contractual and legal obligations.

 

The ICO makes clear that organisations processing workers' health information must have justified reasons for collecting the information and process it fairly, lawfully and transparently. [cy.ico.org.uk]

Our lawful basis for processing

The lawful basis applicable to particular processing will depend upon the occupational health service being provided.

​

Under Article 6 of the UK GDPR, ServiceLine will identify an appropriate lawful basis for processing personal information. Depending upon the circumstances, this may include processing necessary for:

​

  • compliance with a legal obligation;

  • performance of a contract; or

  • legitimate interests pursued by ServiceLine or another organisation, provided those interests are not overridden by the individual's rights and interests.

 

Because health information constitutes special category data, an additional condition under Article 9 UK GDPR is required.

​

For the provision of occupational health services, ServiceLine may rely upon:

 

Article 9(2)(h) UK GDPR, which permits processing where necessary for:

 

preventative or occupational medicine, assessment of the working capacity of an employee, medical diagnosis, provision of health or social care or treatment, or management of health or social care systems and services.

​

The ICO identifies Article 9(2)(h) as one of the conditions that may allow health and social care information to be processed. [ico.org.uk]

​

Where another lawful basis or Article 9 condition is more appropriate to a particular activity, ServiceLine will identify and document that basis.

Consent

Consent to an occupational health assessment or clinical intervention should not be confused with consent as the legal basis for processing personal information.

 

There will be circumstances in which we seek your consent or explicit consent, for example before certain information is disclosed or another healthcare professional is contacted.

 

Where we rely specifically upon consent as our legal basis for processing, you have the right to withdraw that consent.

 

Where information is processed under another lawful basis, withdrawal of consent does not necessarily require ServiceLine to delete information that we are legally or professionally required or otherwise lawfully entitled to retain.

​

The ICO confirms that explicit consent, where relied upon for special category processing, must be freely given, specific, affirmative and unambiguous and may be withdrawn. [ico.org.uk]

Occupational health reports to employers

Occupational health is an independent and confidential clinical service.

​

Where ServiceLine has been instructed by your employer to undertake an occupational health assessment, we may provide the employer with an occupational health report appropriate to the purpose of the referral.

 

Reports will normally focus on information relevant to employment, such as:

  • fitness for work;

  • functional capability;

  • likely impact of a health condition upon work;

  • recommended workplace adjustments;

  • restrictions;

  • anticipated timescales where clinically appropriate;

  • recommendations for rehabilitation or further assessment.

 

We will not routinely disclose detailed clinical information or diagnoses where these are not necessary for the occupational health purpose.

​

You will be informed about the report process and how your information will be used as part of the occupational health consultation.

How we store your information

ServiceLine uses Apollo occupational health software to manage occupational health referrals and clinical records.

 

Appropriate technical and organisational measures are used to protect personal information against unauthorised access, disclosure, alteration, accidental loss or destruction.

 

Access to occupational health clinical information is restricted to those who have a legitimate need to access it for the provision or administration of occupational health services.

 

Where temporary paper records are created, these will be handled securely and incorporated into the appropriate clinical record where required.

Sharing your information

We will not routinely disclose your confidential clinical information to third parties without an appropriate lawful basis.

​

Information may be shared where necessary with:

  • your referring employer or organisation, in the form of an appropriate occupational health report;

  • an occupational health physician;

  • another healthcare professional involved in your assessment;

  • specialist providers where an onward referral has been agreed;

  • organisations providing services to ServiceLine under appropriate contractual and data protection arrangements;

  • regulatory, legal or statutory bodies where disclosure is required or permitted by law.

 

Only information that is necessary and appropriate for the relevant purpose will be shared.

We do not sell personal or medical information.

Medical records and reports from your GP or specialist

On some occasions it may be necessary to request further medical information from your GP, consultant or another healthcare professional.

 

Where this is required, we will explain:

  • why further information is needed;

  • what information is being requested;

  • who it will be requested from;

  • how the information will be used; and

  • the relevant rights available to you.

 

Any reports received become part of your confidential occupational health record and will be processed in accordance with applicable data protection and medical confidentiality requirements.

How long we keep your information

ServiceLine will retain personal information only for as long as necessary for the purpose for which it was collected and to meet applicable legal, regulatory, contractual and professional requirements.

 

Different categories of occupational health records may therefore have different retention periods.

 

Some statutory health surveillance records are subject to particularly long retention requirements. For example, the appropriate retention requirements associated with surveillance under the Control of Substances Hazardous to Health Regulations (COSHH) will be applied where relevant.

 

Once information reaches the end of its applicable retention period and there is no lawful reason for its continued retention, it will be securely destroyed.

 

ServiceLine maintains a record retention schedule specifying the applicable retention period for different categories of occupational health information.

Your data protection rights

Depending upon the circumstances and lawful basis for processing, you may have rights including:

 

Right of access

 

You have the right to request access to personal information ServiceLine holds about you.

This is commonly known as a Subject Access Request (SAR).

 

Right to rectification

 

You may ask us to correct inaccurate personal information or complete information that is incomplete.

Clinical records represent the professional record made at the time of an assessment. Where it would be inappropriate to alter the original clinical entry, a correction or supplementary entry may be added to the record.

 

Right to erasure

 

You may have the right to request deletion of your personal information in certain circumstances.

This right is not absolute and may not apply where continuing to retain or process information is necessary and lawful, including certain occupational health and healthcare processing.

 

Right to restriction

 

In certain circumstances, you may ask us to restrict the processing of your personal information.

 

Right to object

 

Depending upon the lawful basis being relied upon, you may have the right to object to particular processing.

 

Right to data portability

 

This may apply to certain information where the relevant statutory requirements are met.

Subject Access Requests

If you wish to access your occupational health records, please contact ServiceLine using the details at the end of this notice.

 

We may need to verify your identity before releasing information.

 

Subject access requests will normally be dealt with without undue delay and within one month, in accordance with applicable data protection legislation.

 

Where a request is particularly complex, legislation permits the response period to be extended where the relevant requirements are met.

Data security and confidentiality

ServiceLine recognises the particularly sensitive nature of occupational health information.

​

We maintain appropriate measures designed to safeguard information, including:

  • secure occupational health record systems;

  • access controls;

  • password protection;

  • appropriate encryption and electronic security measures;

  • secure communication methods where appropriate;

  • confidential handling of clinical information;

  • appropriate arrangements with organisations processing information on our behalf.

 

The ICO specifically identifies the need to keep workers' health information secure because of its sensitive nature. [ico.org.uk]

Using information for audit and service improvement

ServiceLine may use appropriately anonymised or aggregated information for:

​

  • clinical audit;

  • quality assurance;

  • service improvement;

  • analysis of occupational health trends; and

  • reporting to client organisations.

  • ​

Where information is genuinely anonymised so that an individual cannot be identified, it is no longer personal data.

​

Identifiable clinical information will not be included in routine client trend reports unless there is an appropriate lawful basis for doing so.

Website and cookies

Our website may use cookies and similar technologies necessary for its operation and, where applicable, to help us understand how visitors use the website.

​

Where non-essential cookies are used, appropriate information and choices will be provided through our website's cookie arrangements.

Marketing

Where ServiceLine sends direct marketing communications, we will do so in accordance with applicable data protection and electronic communications requirements.

​

Where marketing communications are sent on the basis of consent, you may withdraw that consent or unsubscribe at any time.

​

Your occupational health clinical information will never be used for marketing purposes.

Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our services, systems or legal and regulatory requirements.

​

The current version will be made available through the ServiceLine Occupational Health website.

Questions, concerns and complaints

If you have a question about how ServiceLine uses your personal information, wish to exercise a data protection right or have concerns about the handling of your information, please contact:

​

Data Protection Lead
ServiceLine Occupational Health Ltd
Suite 3, Salters House
Sedgefield
County Durham
TS21 3EE

​

Website: https://www.servicelineoh.co.uk

​

Lindsay.risley@servicelineoh.co.uk.

​

If you are dissatisfied with our response, you also have the right to raise a concern with the Information Commissioner's Office (ICO).

​

Information Commissioner's Office

bottom of page