The data we collect and why
ToHealth Ltd of 41 York Road London SE1 7NJ (registered office: Park House, 116 Park Street, London, W1K 6AF) collects, processes and holds data for the sole purpose of providing healthcare, occupational health and screening services to our clients and patients. Records may be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. All ToHealth staff have a legal and contractual responsibility to respect the confidentiality of information, and access to confidential information is restricted to only those who have a reasonable need to access it. ToHealth staff all undergo regular training in how to manage and keep data safe and secure.
We collect personal information from you through your contact with us, including by phone, by email, through our websites and health portals, through our screening software, by post, by filling in application or other forms, through social media or direct contact through meeting with our healthcare staff. We also might collect information from other people and organisations such as your employer.
The categories of data we collect
The information we collect about you can be categorised into two areas:
Standard Personal Information
• Contact information about you such as name, address, date of birth, email address, your NHS number and your current GP.
• Your employer if you are part of a corporate scheme
• Gender and date of birth
• Any contacts we have had with you such as appointments, telephone calls, written correspondence, complaints or incidents.
• Information about how you use our services such as our website, software, health portal and IP addresses.
• If you are a self-payer financial details such as bank details and credit card information are handled directly by our third party supplier, we do not record this information ourselves however we keep a record of your payment history.
Special Category Information
• Notes and reports about your physical and mental health and wellbeing
• Details about your screenings, examinations, results and care
• Results of investigations such as blood tests
• Information about your ethnic origin so that we can tailor tests and calculations that require this information.
• Relevant information from other health professionals
Purpose of the processing and the legal basis for the processing
We process your personal information for a number of legitimate interests from managing our relationship with you through to helping us improve our services and products.
Legitimate interest is one of the legal reasons why we process your personal information. Taking into account your interests, rights and freedoms, legitimate interests which allow us to process your personal information include:
• to manage our relationship with you, our business and third parties who provide products or services for us.
• to provide health-care services for you directly or on behalf of a third party (for example, your employer).
• to keep our records up to date
• If your service is being provided by your employer, to provide anonymised (information that cannot identify you as an individual) feedback to your employer so they can assess the health and wellbeing of their workforce
• for research and analysis so that we can monitor and improve our products, services, websites and software or develop new ones.
• to contact you for market research purposes about the quality of our service that we have provided to you
• to monitor how well we are meeting our clinical and business performance expectations
• to develop and carry out marketing activities and to show you information that is of interest to you (but not overriding your ability to opt out of this at any point).
Additionally we process special category personal data under the provision 9(2H) of the GDPR namely
• processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3 Article 9 of the GDPR
We only disclose information about you for the following reasons:
• It is required by law
• You consent – either implicitly for the sake of your own care such as sending your name and blood samples to contracted blood testing laboratories or explicitly for other purposes
• You consent – under the Access to Medical Reports Act (1988) to the release of an Occupational Health Report, or other clinical documentation, to your Employer
Recipients of your personal data
Your relevant data may be shared with third party providers that have contracts with ToHealth to provide relevant health care services.
Blood testing laboratories: We disclose name, gender, contact details and date of birth along with the blood sample so that your sample can be accurately processed and results returned directly to you or via ToHealth.
Your General practitioner or doctor (with consent from you): We would disclose your clinical results so that they can act on any findings that our services obtain from screening or occupational health investigations.
Third party healthcare providers (with consent from you): If your package offers specialist tests or screenings that are not provided by ToHealth’s own clinical team we contract with carefully selected third party providers to offer these additional tests. We would disclose your contact details and relevant clinical measurements.
Third party lifestyle providers (with consent from you): If your package offers lifestyle services such as coaching we contract with carefully selected third party providers to offer these additional services. We would disclose your contact details and relevant clinical measurements
Your employer: If we are undertaking statutory tests and screenings such as fitness to work in an occupational health capacity we would disclose the results of these tests to your employer.
Details of transfers and safeguards
Your data remains within the European economic area at all times and will be held in secure data centres. ToHealth undertake an annual information governance and security assessment with NHS Digital using the Data Security and Protection Toolkit to ensure we are following best practice guidelines for the management and security of your data. ToHealth are registered with the ICO under the data protection act and our registration number is Z2191268.
Automated Decision Making
ToHealth use risk stratification data tools to help determine a person’s risk of suffering a particular condition and providing appropriate advice based on that risk calculation. You have a right to object to the use of these tools if you feel the advice you have been given from one of these tools is incorrect.
We retain your data for periods that are determined by a number of factors including:
• Any periods for keeping information which are set by law or recommended by regulators, professional health bodies or health associations
• How long it is reasonable to keep records to show we have met the obligations we have to you and your employer if your employer has commissioned the service
• Your use of the ToHealth portal and how long you have been inactive on it if you are using that service
In the absence of any of the above factors determining the retention period our general retention period for health related data is 5 years.
Your rights under GDPR are as follows
• a right of access to a copy of the information comprised in your personal data
• a right to object to processing that is likely to cause or is causing damage or distress;
• a right to prevent processing for direct marketing;
• a right to object to decisions being taken by automated means;
• a right in certain circumstances to have inaccurate personal data rectified, blocked, erased or destroyed
• a right to claim compensation for damages caused by a breach of the Act
You have a right to apply for access to your personal data of which you are subject, a right to a description of the data, the purpose of the processing and if the information is to be shared, who it will be shared with. This will be supplied in permanent intelligible form (medical abbreviations etc explained). This information or any actions arising from the request will be carried out within one month of the request being made.
The only exceptions to disclosure are if it is believed information in the records would cause serious harm to your physical or mental health, or if the records or information identify or concern another person (eg, a child) who believed the information was confidential.
If you feel we have measured or recorded something wrongly then we can amend your patient record on request or re-measure it if it is clinically significant. If it is a difference in opinion i.e. our clinician has a clinical opinion different to that of you, then both positions will be held on file. In terms of clinical records, by law, this must not be altered after the event so any rectification will be recorded in a subsequent note and where possible the previous record, if written, struck through.
The Caldicott Guardian or IG lead at ToHealth Ltd is responsible for dealing with individual rights requests and can be contacted using the email address: firstname.lastname@example.org
Should you have any concerns about how your information is managed by ToHealth, please contact the ToHealth Data protection Officer by email: (email@example.com). If you are still unhappy following our review, you can then complain to the Information Commissioners Office (ICO) via their website (https://ico.org.uk/).
Links to other websites
Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.