Patient Privacy Notice

Optima Health Patient Privacy Notice

1.Purpose

This Privacy Notice explains how Optima Health (referred to as “we”, “us” and “our”) collects, uses, shares, stores and protects personal data relating to patients who receive occupational health services in Ireland. It is intended to provide clear information in accordance with the EU General Data Protection Regulation (GDPR), the Data Protection Acts 1988- 2018 and other applicable Irish data protection and privacy legislation (“Data Protection Legislation”).

2.Who this policy applies to

Patients (those who receive Occupational Healthcare services from Optima Health)

3.How your information will be used

Optima Health acts as a data controller for personal data processed in connection with patient occupational health services, except where we are required to act on behalf of another controller under a specific written arrangement. We process personal data only where there is a lawful basis under Article 6 GDPR and, where health or other special

category data is involved, a separate condition under Article 9 GDPR.

We use personal data to deliver occupational healthcare services, verify identity, manage appointments, assess fitness for work where relevant, prepare occupational health reports, communicate with patients and authorised parties, support billing and administration, maintain clinical and business records, meet legal and regulatory obligations, and manage quality, safety, complaints and clinical governance.

If you do not provide this data, we may in some circumstances be unable to fulfil our obligations to provide care, and we will inform you of the implications of that decision.

Where we rely on legitimate interests, we will only do so where those interests are not overridden by your rights and freedoms. Where we rely on consent, including for certain disclosures to third parties, you may withdraw consent at any time; withdrawal will not affect processing carried out before consent was withdrawn.

4.The Personal Data We Collect

The table below summarises the main categories of personal data we may process, the purposes for processing and the relevant lawful bases. We will only collect information that is adequate, relevant and limited to what is necessary for the relevant purpose.

Types of personal data	Purpose of processing	Article 6 lawful basis for processing	Article 9 lawful basis for processing
Name	Identification and administration	Performance of a Contract	Not Applicable
Passport copies	Validate identity	Legal Obligation	Not Applicable
Date of Birth	Identification purposes	Legal Obligation	Not Applicable
Address	Contact and Billing	Performance of a Contract	Not Applicable
Phone Number	Contact and Appointment Management	Performance of a Contract	Not Applicable
Personal Email Address	Contact and Appointment Management	Performance of a contract	Not Applicable
Emergency Contact Details	Emergency care coordination	Vital interests	Not Applicable
Medical history	Diagnosis and treatment	Consent	Provision of Healthcare
Medication	Treatment Management	Consent	Provision of Healthcare
Health insurance details	Billing and Insurance Claims	Performance of a contract	Not applicable
Test Results	Diagnosis and treatment	Consent	Provision of Healthcare
Gender	Medical reporting and care customisation	Legal Obligation	Not Applicable

5.Sharing and Transferring Personal Data

We will only disclose personal data where necessary for the purposes described in this notice, where you have authorised the disclosure, or where we are legally required or permitted to do so. We will not share more information than is necessary for the relevant purpose.

Your authorised representatives
Third parties where you have consented to, requested or authorised the disclosure, such as your employer, GP, specialist, insurer, legal representative or other healthcare provider;
Cognate Health Ltd Occupational Health Network, where relevant to the delivery of services;
Service providers who provide us with support services;
Statutory and regulatory bodies (including central and local government) and law enforcement authorities;
Healthcare professionals and medical consultants;
Business or joint venture partners.

Where we use service providers, we carry out appropriate due diligence and require written contractual safeguards, including confidentiality, security and data processing obligations, so that personal data is processed only on our documented instructions and in accordance with Data Protection Legislation.

6.Transfers Outside of the EEA

We do not routinely transfer personal data outside the European Economic Area (EEA). If an international transfer becomes necessary, we will ensure that an appropriate transfer mechanism and supplementary safeguards are in place, such as an adequacy decision, standard contractual clauses, or another lawful safeguard permitted by Data Protection Legislation.

7.Record keeping and Data Retention Periods

We maintain records of processing activities, retention periods and appropriate technical and organisational measures to support accountability, confidentiality, integrity and availability of personal data.

Personal data will be retained only for as long as necessary for the purposes for which it was collected, including the provision of healthcare services, legal, regulatory, clinical governance, insurance, audit and record-keeping requirements. Where statutory or professional retention requirements apply, we will comply with those requirements.

Optima Health has adopted the policy that all health information records have to be kept for a minimum of 7 years with exceptions as outlined below:
Regulations made under the 2005 Act do sometimes require employers to maintain records for specified periods. In particular, an employer is required to keep a record of any accident or dangerous occurrence reportable to the HSA for a period of 10 years from the date of the accident or dangerous occurrence.
The Irish Medical Councils Guide to Ethical Conduct and behaviour states that Medical Records should be retained for an adequate period and eventual disposal may be subject to advice from legal and insurance bodies.
That Booklet also recommends retention of records for at least 10 years in relation to Occupational Medicine / General Practice.
In the case of Health Surveillance records for exposure to carcinogens must be kept for a minimum period of 40 years.
For exposure to biological agents the recommendation is to retain individual confidential medical records for an ‘appropriate’ time, usually between 10 to 40 years, depending on the length of time of exposure and/or the likely duration of risk to the safety and health of the employee due to exposure.

Where the data is required to defend a potential claim, the data will be retained for the required period of time.

8.Your Rights

Under Data Protection Legislation, you have a number of rights with regards to your personal data, these are outlined below.

If you have provided consent for processing, you have the right to withdraw that consent at any time by contacting us using the details in Section 10. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal, and in some circumstances we may continue processing where another lawful basis applies.

8.1 Your Rights Explained:

Right to be informed about the processing of your personal data
Right to rectification if your personal data is inaccurate or incomplete • Right of access to your personal data and supplementary information and the right to confirmation that your personal data is being processed
Right to erasure by having your personal data deleted or removed on request where there is no compelling reason for the company to continue to processing • Right to restrict processing of your personal data, for example, if you consider that processing is unlawful or the data is inaccurate
Right to data portability of your own personal data for your own purposes (you will be allowed to obtain and reuse your data)
Right to object to the processing of your personal data

Following receipt and validation of a request, we will respond without undue delay and in any event within one month of receipt. That period may be extended by up to two further months where necessary, taking into account the complexity and number of requests. If an extension is required, we will inform you within one month and explain the reason for the delay.

These rights may be subject to limitations under Data Protection Legislation, including where we must retain information to comply with legal obligations, protect vital interests, maintain clinical records, or establish, exercise or defend legal claims.

9.Right to Lodge a Complaint

You have the right to lodge a complaint with the Data Protection Commission if you are unhappy with how we process your personal data or how we have handled a data protection request. We encourage you to contact us first so that we can try to resolve your concern.

Ireland – Data Protection Commission

Data Protection Commission

21 Fitzwilliam Square South

Dublin 2

D02 Rd28

Telephone – 01 7650100 / 18000437 737 09:30 – 13:00 and 14:00-17:30 (Monday – Friday) Online – https://forms.dataprotection.ie/contact

10.Further information

Should you have any queries regarding this Privacy Notice or data protection in general, please contact our Data Protection Officer at www.optimahealth.ie, by mail to Optima Health, Elm Court, Boreenmanna Road, Ballintemple, Cork, T12 HHW2, Ireland, by telephone on 1890 989 322, or by email at Dpo@optimahealth.ie.

This Privacy Notice will be reviewed regularly and updated where necessary to reflect changes in our processing activities, legal obligations, regulatory guidance or operational practices.

Find out how we can work with you to find a solution.