1. Purpose and scope
This Policy explains how Carrig Occupational Health ("we", "us", "our") collects, uses, shares and protects personal data, including special category (health) data, when providing occupational health services. This may include assessments of employees or prospective employees at the request of an employer, and the preparation of medical advice and reports for employers or other service users (for example, insurers or legal representatives).

​

 

2. Who we are and how to contact us

​​​​

​

​

​

​

​​

​​

If you do not agree with the terms of this Policy, please contact us before using our services so we can explain what information we need and why.​

​​​

​

3. Definitions

• Client (Employer): the organisation that engages us to provide occupational health services.

• Employee Data: personal data shared with us by a Client (Employer), such as name, employee number, job role, location, referral details and absence information relevant to the referral.​​​​​​​​

• Health Data: special category personal data relating to physical or mental health, including medical history, clinical notes, assessment forms, test results and our occupational health opinion.

• Data Controller: the entity that determines the purposes and means of processing personal data (GDPR Article 4(7)).

• Data Processor: an entity that processes personal data on behalf of a Data Controller.

 

 

4. What data we collect
Depending on the service, we may collect or receive:

• Identification and contact details (for example: name, date of birth, address, email, telephone number).

• Employment-related information provided by the employer (for example: job role, work location, referral details, sickness absence information relevant to the referral).

• Health Data provided by you and/or your treating clinicians (with your consent where required), and generated during our assessment (for example: questionnaires, clinical history, examination findings, test results, and our occupational health opinion).

• Administrative information (for example: appointment details, correspondence, and billing information where applicable).

​

​

5. How we collect your data

• Directly from you (for example, forms you complete and information you provide during consultations).

• From your employer/prospective employer (for example, referral information and role details).

• From third parties acting on your behalf or with your permission (for example, treating clinicians, insurers or solicitors).

 

If you contact us by telephone, your phone number may appear in call logs on reception devices. We do not routinely record calls.
 

 

6. Why we process your data (purposes)
We process personal data for occupational health purposes, including to:

• Arrange and provide occupational health assessments, health surveillance and related services.

• Assess fitness for work, work capacity and/or workplace adjustments that may be required.

• Provide occupational health advice and reports to the referring party (typically your employer).

• Support statutory and workplace health and safety requirements where applicable.

• Manage our operations (appointments, communications, quality assurance and governance).

• Maintain appropriate records, handle complaints and respond to legal or regulatory requests.

 

 

7. Lawful bases for processing
We process personal data under one or more lawful bases in GDPR Article 6. Depending on the service, these may include:

• Article 6(1)(b) - processing necessary for performance of a contract or to take steps at your request prior to entering into a contract.

• Article 6(1)(c) - processing necessary for compliance with a legal obligation.

• Article 6(1)(f) - processing necessary for legitimate interests (for example, ensuring safe and effective service delivery), provided those interests are not overridden by your rights.

 

Where we process Health Data (special category data), we rely on GDPR Article 9(2)(h) (preventive or occupational medicine, assessment of working capacity, medical diagnosis, provision or management of health care systems and services) and/or other applicable conditions in Article 9, together with relevant Irish data protection legislation.
 

​

8. Who is the Data Controller?
In the context of occupational health assessments arranged by an employer, we generally act as an independent Data Controller for the Health Data we collect and generate as part of our clinical assessment. Your employer will be a separate Data Controller for any personal data it processes in relation to your employment. In some service arrangements, we may act as a Data Processor for certain limited processing activities; where that applies, it will be governed by a written data processing agreement.
 

​

9. How we share your information
We share information only where it is necessary and proportionate to do so for the purposes of the service.

• With the referring employer/prospective employer: we typically share a fitness for work opinion and functional recommendations. We do not disclose detailed medical diagnosis information unless it is necessary, relevant and you have provided appropriate consent, or an exception applies.

• With service providers who support our operations (for example, secure IT and record systems), under contract and subject to confidentiality and data protection obligations.

• With regulators, professional bodies, or law enforcement where required by law or to protect vital interests.

 

Reports and communications are shared using appropriate security measures (for example, encrypted email, secure portals, or secure file sharing) where available.

​

​

10. International transfers
We aim to store and process personal data within the European Economic Area (EEA). If an international transfer is required (for example, at an employer’s request), we will ensure appropriate safeguards are in place, such as Standard Contractual Clauses and any supplementary measures required.
 

 

11. CCTV, photography and video

• CCTV: We may operate CCTV at our premises for the safety of staff and visitors and for security of premises and assets. Footage is retained for a limited period (typically up to 30 days) unless required for an incident investigation.

• Clinical photography: Where clinically appropriate, we may take photographs (for example, of injuries) to support an assessment or report. This will be explained to you at the time and recorded securely as part of the clinical record.

 

 

12. Your rights
You have rights under GDPR, including:

• The right to be informed about how your data is used.

• The right of access to your personal data (subject access request).

• The right to rectification (to correct inaccurate or incomplete data).

• The right to erasure in certain circumstances.

• The right to restrict processing in certain circumstances.

• The right to object to processing in certain circumstances.

• The right to data portability where applicable.

 

Some rights are not absolute and may be subject to professional confidentiality obligations and legal exemptions.
 

 

13. Subject access requests
To request access to your personal data, please contact us at: [Insert SAR email address]. We will respond within the timelines set out in data protection law (typically one month), subject to verification of identity and applicable exemptions.
 

​​

14. Security

• We use organisational and technical measures to protect personal data against unauthorised access, alteration, disclosure or loss.

• Access to occupational health records is restricted to authorised staff and clinicians.

• We manage personal data breaches in accordance with our incident management procedures and will notify the relevant supervisory authority and affected individuals where required.

 

 

15. Retention
We retain personal data only for as long as necessary for the purposes described in this Policy, and in line with legal, regulatory and professional obligations. Retention periods may also be influenced by the employer’s requirements where appropriate.
Typical retention guidance (may vary by service and legal requirements):

​​​

​​

​​

​​​

​​​​

​​​​

​​​

​​​

​​​

​​​

​​​

​​​

​

​​​

​​​

16. Website data
Our website may receive limited technical information (for example, IP address, browser type, device information) as part of standard web hosting and security logs. If we use cookies or analytics tools, we will provide a cookie notice explaining what is used and how you can manage your preferences.
 

If you email us or submit a contact form, we will use the details you provide to respond to your enquiry and retain the correspondence in line with our retention approach.
 

​

17. Complaints
If you have concerns about how your personal data is handled, please contact us first so we can try to resolve the matter. You also have the right to lodge a complaint with the Irish Data Protection Commission.
 

Irish Data Protection Commission: dataprotection.ie
 

​

18. Changes to this Policy
We keep this Policy under review and may update it from time to time.