The Worthing Clinic
Privacy policy.
The Worthing Clinic’s privacy notice is a public document providing clients with transparent information about how we collect, use, store and share your personal data.
Within this document we explain the purposes of data processing, how long we keep your data for and why. We explain the legal basis for data processing, and the rights individuals have regarding their data under laws like the UK General Data Protection Regulation (UK GDPR).
1. Contact details
By post: The Worthing Clinic, 3rd Floor Sussex Chambers, 5 Liverpool Terrace, Worthing, West Sussex, BN11 1TA
Telephone: 01903 372 774
Email: bookings@theworthingclinic.health
The responsible person who maintains an up-to-date annual registration with the ICO (Information Commissioner’s Office) as the named data protection officer for The Worthing Clinic is Dr Andy Brereton (registration reference: ZB633238).
2. What information do we collect, use, and why?
We collect or use the following information to provide and improve products and services for clients:
Names
Home and work addresses
Date of birth
Mobile phone number
Email addresses
Gender
Occupation
Name of workplace
Line manager
Registered GP details, including GP name and surgery address
Transaction data (including details about payments to and from you and details of products and services you have purchased)
Health information (such as health conditions and/or medical records, including measurements taken during health surveillance – such as spirometry and/or audiometry results and/or neurovascular assessments in Hand Arm Vibration Syndrome (HAVS))
Records of meetings and decisions – such as ‘fitness to work’ reports
We collect or use the following special category information to provide and improve products and services for clients. This information is subject to additional protection due to its sensitive nature:
Health information
We collect or use the following personal information for the operation of client or customer accounts:
Names and contact details (email addresses/telephone numbers)
Addresses
Date of birth
Email addresses
Name of workplace
Line manager
We collect or use the following personal information for the operation of client or customer accounts. This information is subject to additional protection due to its sensitive nature:
Health information
We collect or use the following personal information for information updates or marketing purposes:
Names and contact details
Addresses
Email addresses
Marketing preferences
We collect or use the following personal information to comply with legal requirements:
Name
Contact information (date of birth, address, phone number, email address)
Identification documents (such as a photo driving licence/passport)
Health and safety information
Any other personal information required to comply with legal obligations
We also collect or use the following special category information to comply with legal requirements. This information is subject to additional protection due to its sensitive nature:
Health information
We collect or use the following personal information to protect client welfare:
Names and contact information
Health and wellbeing information
We collect or use the following personal information for dealing with queries, complaints or claims:
Names and contact details
Addresses
Transaction and payment information
Records of communication
3. Lawful bases and data protection rights
Under UK data protection law, The Worthing Clinic must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.
Which lawful basis we rely on may affect your data protection rights, which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website: https://ico.org.uk/
Your data protection rights
Your right of access – You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions, which means you may not receive all the information you ask for.
Your right to rectification – You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
Your right to erasure – You have the right to ask us to delete your personal information.
Your right to restriction of processing – You have the right to ask us to limit how we can use your personal information.
Your right to object to processing – You have the right to object to the processing of your personal data.
Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
Your right to withdraw consent – When we use consent as our lawful basis, you have the right to withdraw your consent at any time.
If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.
Should you wish to exercise any of your data protection rights, e.g. data erasure, you must contact The Worthing Clinic and make a request in writing to delete your personal information. You would need to clearly state what you want erased and you may need to provide proof of your identity and the reasons behind your request. The Worthing Clinic must respond within one month, in writing, either confirming the deletion or explaining why we can’t fully comply. However, the right to erasure is not absolute: it does not apply to health surveillance records, as a longer retention period is mandated by health and safety law. Following this due process, if you remain dissatisfied, you can escalate the issue to the ICO.
Our lawful bases for the collection and use of your data
Our lawful bases for collecting or using personal information to provide and improve products and services for clients are:
Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply, except the right to object.
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Our lawful bases for collecting or using personal information for the operation of client or customer accounts are:
Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Our lawful bases for collecting or using personal information for information updates or marketing purposes are:
Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Our lawful bases for collecting or using personal information to comply with legal requirements are:
Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply, except the right to object.
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Our lawful bases for collecting or using personal information to protect client welfare are:
Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:
Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Where we get personal information from
Directly from you (with your consent)
Directly from your employer’s HR department (with your consent)
Directly from your employer (with your consent)
Legal bodies (such as courts or solicitors) or professionals (such as your registered GP)
4. Data retention: how long will the data be kept?
The length of data retention by The Worthing Clinic depends on the type of data being collected, compliance with UK and overseas laws that govern the retention of data in ‘special’ circumstances, and whether a third party is involved in the processing and retention of your personal data.
Financial data
All clients’ financial transactional data is processed and held by the fintech company ‘Stripe’. Stripe retains most non-biometric ID verification data for 3 years and biometric data for 1 year, with options for users to opt out or request deletion of their data should they wish. For more information: https://support.stripe.com/questions/contact-stripes-data-protection-officer-%28dpo%29
Occupational health records/data
There is no strict legal rule about how long records should be kept, but current guidance from the Information Governance Alliance/Department of Health is for the period of the person’s employment plus six years, or until their 75th birthday, whichever is the earliest.
In the case of a pre-employment medical where a job applicant has not been appointed, it is good practice to keep records for at least a year in case there is a legal claim.
Where an OH physician/doctor is acting as an external adviser and may only see the patient once, for example in connection with a pension application, records should be kept for a minimum of six years, the limitation period for breach of contract. If the case may potentially give rise to a legal claim, they may be kept for longer.
Records of statutory health surveillance are in a special category. There are a number of regulations which impose a duty on employers to institute regular health checks of employees exposed to particular hazards, where it may be possible to detect adverse effects before serious damage is done. Examples particularly relevant to OH are the Control of Substances Hazardous to Health (COSHH) Regulations, the Control of Vibration at Work Regulations, the Control of Noise at Work Regulations, the Control of Lead at Work Regulations, the Control of Asbestos Regulations and the Ionising Radiations Regulations. All these regulations follow a similar pattern.
The employer must create a basic health record with the following details: the employee’s name, address and National Insurance number; the substance/process they are exposed to and when; the surveillance that has been done on them and the name of the tester; and the outcome, e.g. fit/unfit/fit with adjustments. This health record is not confidential to OH and can be kept by management. The detailed clinical records, with the results of the tests and other clinical information, are kept by The Worthing Clinic separate from the confidential OH record and are not disclosed without consent. The health record should be kept by management for 40 years (50 years in the case of ionising radiations), but the clinical records do not need to be retained as long as that unless there is, exceptionally, a special reason for doing so.
Pre-employment medicals
A) Candidates who don’t start the job
TWC will keep pre-employment medical records for 18 months in case of any post-offer disputes or subsequent legal claims. After this timeframe, TWC will destroy/delete the records.
B) If the candidate takes up the job
TWC will retain the records for the duration of employment plus a defined period afterwards: around 6 years after employment ends, or until the employee’s 75th birthday (whichever comes first).
If a client and TWC cease their business relationship, or TWC ceases trading, TWC will destroy/delete the records.
Night worker medicals
TWC will keep the medical records of night workers for the duration of their employment plus 2 years. After this period, TWC will delete/destroy the records. This aligns with HSE guidance, limitation periods for employment and health & safety claims, and UK GDPR.
If, on the other hand, a client and TWC cease their business relationship, or TWC ceases trading, TWC will destroy/delete the records.
Minibus/transport driver medicals
TWC will keep the medical records of minibus/transport drivers for the duration of their employment plus 2 years. After this period, TWC will delete/destroy the records. This aligns with HSE guidance, limitation periods for employment and health & safety claims, and UK GDPR.
If, on the other hand, a client and TWC cease their business relationship, or TWC ceases trading, TWC will destroy/delete the records.
Health surveillance staff records (including HAVS, noise, skin, respiratory)
Data is stored securely for 40 years. This is the standard minimum for health surveillance records, as diseases can take decades to manifest.
If TWC ceased trading: TWC, as the data controller, must immediately notify the Health & Safety Executive (HSE) in writing and offer to securely transfer all relevant health surveillance records to the HSE, so that it can take over the data controller role. Alternatively, if the client finds a new occupational health provider in this scenario, please see the explanation below.
If a client and TWC ceased their business relationship: The client would have a legal responsibility to find an alternative occupational health partner to continue this health surveillance. As such, the client/employer would be required to request, in writing, a secure transfer of previous health surveillance records from TWC to the new occupational health partner. This is particularly important, as it is the trends in decades of health surveillance records that keep employees safe and employers compliant.
5. Data sharing: is the data shared with any third parties or data processors?
Controller to processor: The Worthing Clinic (the controller) engages a third party, OrchidLive (the processor), to handle or store data on its behalf. The Worthing Clinic uses cloud-based occupational health software delivered by OrchidLive (Orchid Live – Digital Marketplace). All personal information is processed, stored and protected on this platform. OrchidLive maintains ISO 27001 accreditation for information security and Cyber Essentials certification, and undergoes regular CREST-accredited penetration testing. Your data is 256-bit SSL encrypted and transferred via an IP-restricted VPN to segregated, firewalled servers inside UK data centres with 24/7 security. In addition, OrchidLive backs up your data every single day. Multi-factor authentication, complex passwords and Single Sign-On come as standard, with the option to upgrade to IP restrictions for additional peace of mind. OrchidLive provides complete control over what each user can see and do, to ensure strict clinical confidentiality. Plus, there’s an internal audit trail which tracks all changes made and who made them.
Controller to controller or processor: On occasion, there may be a need to share data with professional or legal advisers, as is permitted under data protection laws, e.g. UK GDPR, provided there is a lawful basis for doing so. In this case, the transfer of data from The Worthing Clinic to the professional or legal adviser may be an example of data transfer between a controller and another controller, or between a controller and a processor. Legal professional privilege (LPP) also protects confidential communications between a client and their legal adviser from mandatory disclosure.
Controller to processor (website analytics): If you agree to analytics cookies on our website, Google Ireland Limited processes information about how you use the website on our behalf through Google Analytics. Google may transfer this data outside the UK, protected by appropriate safeguards such as the UK International Data Transfer Addendum. See section 8 for more detail.
Separate controllers: On occasion, there may be a need to ask for more clinical information from a specialist or from your registered GP to guide further OH input. This will always require the client’s written consent, prior to The Worthing Clinic asking (via a ‘subject access request’ – SAR) for that separate data controller to consensually share some or all of your medical records with us.
6. Data protection: the measures in place to keep your data safe and secure
The Worthing Clinic protects your data through a combination of technical, physical and administrative measures. The specific measures used are proportionate to the sensitivity of the data and the risks involved, as required by GDPR.
Technical measures within our computer systems and cloud-based network (OrchidLive)
Encryption: Converts data into a coded format, rendering it unreadable to unauthorised parties even if it is stolen. Encryption is applied to data “at rest” (stored) and “in transit” (transmitted over a network).
Access controls: Restricts data access based on a user’s role and need-to-know, ensuring only authorised individuals can view or modify specific information.
Strong passwords and multi-factor authentication (MFA): Requires users to provide two or more forms of verification to gain access to systems and data.
Malware protection: Includes anti-virus, anti-malware and anti-ransomware software to detect and remove malicious code.
Firewalls: Creates a barrier between a network and the internet, monitoring and filtering traffic to block threats.
Secure configurations: Ensures all systems and applications are set up securely to minimise entry points for cybercriminals.
Patch management: Keeps software and applications updated to fix security vulnerabilities.
Data backup and recovery: Involves making and testing regular backups, with at least one copy stored securely offline or off-site, to enable data restoration after a breach or disaster. Immutable storage can prevent backups from being altered or deleted.
Data loss prevention (DLP): Monitors and controls sensitive data to prevent it from leaving the organisation’s network.
Physical measures
Some medical records, such as our paper questionnaires, are stored on site at the clinic and never leave the premises.
Secure premises: The Worthing Clinic premises are secured behind 3 locked doors, including a keycode door.
Secure facilities: Locks and alarms restrict access to buildings and sensitive areas.
Secure storage: Physical records are stored in a locked cabinet inside the locked clinic, inside a locked building.
Environmental controls: Includes systems for fire detection and suppression to protect hardware.
Secure disposal: The Worthing Clinic ensures old equipment and hard-copy documents are destroyed securely to prevent data recovery.
Administrative measures
These are the policies and procedures that guide an organisation’s overall data security efforts.
Security awareness training: The Worthing Clinic educates employees on threats like phishing and their responsibilities for handling data securely.
Information security policies: Defines the organisation’s security rules, procedures and responsibilities for all employees.
Data classification: Organises data based on its sensitivity to ensure the appropriate level of security is applied.
Risk assessment: Conducts regular assessments to identify potential threats and vulnerabilities.
Confidentiality agreements: Requires employees and third-party contractors to sign agreements regarding the protection of confidential data.
7. How to complain
If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.
The ICO’s address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint
8. Cookies and website analytics
What are cookies?
Cookies are small text files that a website stores on your device when you visit it. Some are needed for the website to work. Others help us understand how people use our website so we can improve it.
How we use cookies
When you first visit our website, a banner asks which cookies you’re happy for us to use. We only use cookies that aren’t strictly necessary if you agree to them, and you can change your mind at any time.
Strictly necessary
These cookies are needed for the website to work. One of them remembers your cookie choices so we don’t ask you again on every page. You can’t switch them off, because the website wouldn’t work properly without them.
Analytics
With your consent, we use Google Analytics to understand how visitors use our website: which pages they view, how long they stay, roughly where they are (to city level) and what type of device and browser they use. This shows us which information is useful and what we need to improve. Google Analytics stores this information in the following cookies:
_ga: tells one visitor apart from another. Lasts up to 2 years.
_ga_[ID]: keeps track of your current visit. Lasts up to 2 years.
Google Analytics does not collect your name, contact details or any health information. We have turned off Google’s advertising features, so your website data isn’t used for advertising or to personalise adverts. We keep this data for 14 months.
We use Google Tag Manager to load Google Analytics. It only does this once you’ve given consent, and Google Tag Manager doesn’t set any cookies of its own.
Google Maps
Our contact page includes an embedded Google Map to help you find us. When the map loads, Google may set its own cookies, which are controlled by Google rather than by us. To find out more, see Google’s privacy policy at https://policies.google.com/privacy
Our lawful basis
Our lawful basis for using analytics cookies is consent. You can withdraw your consent at any time and it won’t affect how you use our website or our services.
Changing your cookie choices
You can change your choices at any time using the Cookie settings link at the bottom of every page. You can also block or delete cookies in your browser settings, although some parts of the website may then not work as expected. For more on how Google uses data, see https://policies.google.com/technologies/partner-sites
Last updated 23/10/26
