Legal
Health & Special Category Data
Some of the data healthcare staffing requires is treated as special category data under UK GDPR, and needs an additional condition before it can be processed.
This page explains what we handle, why, and the limits we place on it.
Policy detail
What counts as special category data
Article 9 of UK GDPR defines special category data as data revealing or concerning:
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade union membership
- Genetic data and biometric data used for identification
- Health
- Sex life or sexual orientation
Criminal offence data is not special category data, but Article 10 gives it comparable protection. See DBS & Criminal Record Data.
What we actually process
In practice we handle a narrow subset.
| Data | Why we need it | Condition relied on |
|---|---|---|
| Occupational health outcome and fitness to work | Confirming you can safely undertake an assignment | Art. 9(2)(b) and (h); DPA Sch. 1 Pt. 1 |
| Immunisation and health clearance status | Where a client or setting requires it for the role | Art. 9(2)(b) and (h); DPA Sch. 1 Pt. 1 |
| Reasonable adjustments and disability information | Meeting our duties under the Equality Act 2010 | Art. 9(2)(b); DPA Sch. 1 Pt. 1 |
| Sickness absence during an assignment | Managing the assignment and any pay entitlement | Art. 9(2)(b); DPA Sch. 1 Pt. 1 |
| Equality monitoring data, where collected | Monitoring equality of opportunity | DPA Sch. 1 Pt. 2 — equality of opportunity or treatment |
| Safeguarding information concerning health | Protecting individuals at risk | DPA Sch. 1 Pt. 2 — safeguarding |
How we limit it
- We ask for an outcome, not your clinical history — normally "fit", "fit with adjustments" or "not fit" plus any adjustments needed
- We share with a client only what the assignment genuinely requires, not the underlying detail
- Access is restricted to staff who need it for their role
- Equality monitoring data, where collected, is separated from recruitment decision-making and reported only in aggregate
- We do not use health data to make automated decisions about you
Appropriate policy document
Where we rely on a Schedule 1 condition, the Data Protection Act 2018 requires an appropriate policy document explaining our compliance with the data protection principles and our retention and erasure policies. We maintain one and review it regularly. A copy is available on request.
Your rights
You can ask what health information we hold, ask us to correct it, and object to or restrict its use. Clinical records held by an occupational health provider are usually held by that provider as controller — we can tell you who to approach.
Need to discuss an adjustment?
Tell us what you need. We would rather make an assignment work than lose a good worker.
Prefer to talk? Call 020 8075 5966
