Privacy notice for users of the Health and Wellbeing Service

We respect your right to privacy in line with data protection. Before using our service, you may wish to read our privacy notice which sets out why we will collect personal data from you, our retention periods and how this data will be used by the Health and Wellbeing Service.

This privacy notice provides you with information about how we collect and use your personal data when you use the Health and Wellbeing Service (HWS).

In this privacy notice, references to “we”, “our” or “us” are to BidCarbon Foundation.. Everything that we do with your personal data – for example, collecting, storing, using, sharing or deleting it – is referred to as ‘processing’.

About us

The People Operations Officer is the Controller of any personal data processed as described in this Privacy Notice.

The Data Protection Officer is the Head of Information Compliance at BidCarbon Foundation.

If you have any questions about the use of your personal data, please submit your enquiry to the Data Protection Officer at www.bidcarbon.com/legal-privacy-contact.

The personal data about you that we process

This may include your:

● Name, home address, telephone number, email address

● Date of Birth

● Role in BidCarbon Foundation when you started and, where applicable, the department you work for

● Family contact details (i.e. next of kin)

● Health information, such as the health questionnaire completed during your recruitment process or medical conditions you disclose 

● Disability information, for which we need to make a workplace adjustment

● Other personal data that you may share when using the service

Not providing personal data may affect:

● Our ability to support your health needs fully and may cause delay in accessing specialist referrals

● Our ability to provide accurate and timely recommendations that may actively support a sustained attendance in the workplace or a planned return to the workplace  

● Your ability to access the full range of health and wellbeing services available

If you do not provide your personal data

We will collect your data from: 

● You, when you contact us by email, phone, letter or other means

● Another person, by the same routes in relation to an occupational health referral or other appointment requesting support or advice 

● Feedback or survey responses you’ve participated in relating to the service

Your personal data will only be collected from third parties who have referred you to us.

How we collect your personal data

Purposes of the processing

To provide a health and wellbeing service for those who work for and in the BidCarbon Foundation, we use this data to:

● Identify you and ensure that your medical information is managed appropriately

● Assess and protect your health and your fitness to work

● Identify a baseline of your health against which to measure any future changes

● Provide advice to managers on the impact of your health on work and work on your health

● Promote your abilities and help support any disabilities in the workplace, recording recommendations for necessary adjustments, restrictions or modifications

● Identify any additional support that would help you to improve your health

The lawful basis of the processing

In order to process your personal data, we must have a ‘lawful basis’. The lawful bases are set out in the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

The lawful bases for processing your personal data will depend on the specific reason we have collected it. In most cases, the relevant lawful basis is:

● UK GDPR Article 6(1)(a) – we have your consent

In rare cases, HWS may need to process your personal data without your consent. To do so, we would rely on one of the following lawful bases:

● UK GDPR Article 6(1)(c) the processing is necessary for us to comply with the law. For example:

● a court may order the Corporate Officers to disclose your personal data

● UK GDPR Article 6(1)(d) the processing is necessary to protect your vital interests or those of others. For example:

● if you are taken seriously ill, or pose a risk to yourself or others, HWS may need to inform your next of kin, the emergency services and your line manager

● UK GDPR Article 6(1)(f) the processing is necessary for our legitimate interests, or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests. For example:

● In some circumstances, HWS may need to (without your consent) inform your line manager whether you have attended an appointment or other very limited information about you.

A further ‘condition for processing’ is required when processing special categories of personal data.   Special categories include racial or ethnic origin, religious or philosophical beliefs, trade union membership, genetic and biometric data, health data, and information about sex life or sexual orientation. The conditions for processing are set out in the UK GDPR and the DPA 2018.

Who we share your personal data with

Your information is confidential and will only be shared where necessary and lawful to do so. We may share your personal data with or disclose it to the following, as appropriate:

● Healthcare professionals assessing or supporting you within HWS for medical purpose

● An onward referral to an agreed specialist for an opinion or treatment with your consent

● Appropriate persons who can take steps to protect you or another person from harm

● Other organisations where there is legal obligation to do so, e.g. local adult or child social services, for the purposes of safeguarding vulnerable adults or children at risk

● Other third parties who we may contract with to assist us with the effective assessment or implementation of specialist services, e.g. counselling, specialist workplace adjustments, interpretation or sign language services

● Information on your fitness to work with your line manager, health & safety teams and HR

● Health Security Agency, where we have a legal duty to disclose a notifiable disease

● When a court orders us to share your information – where we have a legal duty

● Assisting third parties with regulatory responsibilities, such as the Care Quality Commission (CQC); Safe, Effective, Quality Occupational Health Service (SEQOHS); and the Information Commissioner’s Office (ICO) – where we have a legal duty

Your rights

Data protection laws provide you with rights over the personal data that we process about you.  Subject to limited exceptions (see below), these are:

● Where we are relying on your consent to process your personal data, you can withdraw that consent or unsubscribe from our services

● The right to access your personal data

● The right to rectification of your personal data

● The right to erasure of your personal data

● The right to restrict the processing of your personal data if you have an objection to us doing so

● The right to object to the processing of your personal data

● The right to portability of your personal data

Rights in relation to automated decision-making and profiling

Please note that requests to exercise these rights should be submitted to the Information Compliance team within People Operations. Their contact details are given below. 

The request, including any relevant personal data, will be retained to demonstrate that we have met our legal obligations under data protection law. These records are kept securely for two years.

Contact details

If you have any concerns relating to the use of your personal data when using the Health and Wellbeing Service (HWS), please contact peopleoperations@bidcarbon.org in the first instance.

If you have any further questions about the use of your personal data, please submit your enquiry to the Data Protection Officer at www.bidcarbon.com/legal-privacy-contact.

You also have the right to complain to the Information Commissioner’s Office, the supervisory authority, by contacting them: www.ico.org.uk/global/contact-us.