Workplace NHS Health Check programme privacy notice

1 Council contact details

1.1 North Northamptonshire Council

Registered Office:

Sheerness House
41 Meadow Street
Kettering
NN16 8TL

Telephone: 0300 126 3000

Email: [email protected]

1.2 North Northamptonshire Council (the council) has been awarded funding by the Department of Health and Social Care to commission this pilot programme.

The Workplace NHS Health Check programme is a pilot programme that aims to reduce the number of cardiovascular disease related illnesses in the city through providing an NHS Health Check in the workplace. Its aim is to support local people to remain in work, linking to the council’s strategy to ensure that we have a fair and inclusive local economy.

This pilot will be an addition to the existing national NHS Health Check programme in the area, which is currently commissioned by the council and delivered by GP practices and community providers, with eligible people invited to have a check once every five years.

The pilot will involve delivering NHS Health Checks in workplace settings around North Northamptonshire, targeting employees working in routine and manual occupations in small, medium and large workplaces, who may not have had an NHS Health Check in the past.

The pilot will run from November 2024 to March 2025 and is being delivered by two Service Providers, Concept Care Solutions and Medloop Ltd both appointed by the council.

2 Information that we hold

2.1 At the end of the pilot period, an anonymised search of the lifestyle interventions, further testing and clinical follow-up will be carried out by the Service Providers on behalf of the council using the full Workplace NHS Health Check Minimum data set listed:

  • No. Workplace NHS Health Checks carried out
  • Method of delivery (face-to-face,)
  • Month and year of assessment
  • Demographics: sex, gender, age, ethnicity, profession, GP registration status
  • No. of patients with QRISK ≥10% (where recorded)
  • No. of patients with a BP over 140/90
  • No. of patients who are current smoker
  • No. of patients who are overweight or obese
  • No. of patients referred to their own GP following a Workplace NHS Health Check
  • No. of patients who can recall receiving an offer of an NHS Health Check (the national programme) in the last 5 years; and

Further, data will also be collected on the workplace setting, including:

  • Type of industry as per the ONS/UK Standard
  • Industrial Classification
  • The size of workforce
  • The demographics of the workforce, including no. of employees, their sex, ethnic groups, professions, and estimated no. of employees eligible for a Workplace NHS Health Check

3 How the information is obtained

3.1 Following the delivery of Workplace NHS Health Checks by the Service Providers, anonymised patient data will be used to evaluate the effectiveness of the pilot by the Office for Health Improvement and Disparities and to inform the council on its NHS Health Check strategy moving forward.

The council will only be handling anonymised data, which will be anonymised and shared by the Service Providers.

The Service Providers will be collecting personally identifiable data, via the electronic patient record system and information provided by individuals attendings.

3.2 Whereas the council will receive all data anonymised, it may be possible in a small number of cases for individuals to be identifiable from a combination of their responses. There is also the potential that despite our request not to, the Service Provider may in error disclose personal data. Therefore, whilst the council will redact and remove any such data when reviewing the data provided, it is necessary to issue a privacy notice.

3.3 Section 2B of the National Health Services Act 2006 gives local authorities power to perform the public health function. This means the council has a ‘duty to improve the health of the people and will have responsibility for commissioning appropriate public health services.

The Service Provider is committed to protecting your privacy and will only use information collected lawfully in accordance with:

  • Data Protection Act 2018
  • The GDPR 2016 and UK GDPR 2021
  • The Human Rights Act 1998
  • Common Law Duty of Confidentiality
  • Health and Social Care Act 2012
  • NHS Codes of Confidentiality, Information Security and Records Management
  • The Caldicott Principles

3.4 As noted above the council’s Public Health trained team of officers will redact and delete any personal data collected through the Service Provider.

Prior to its deletion, the lawful bases for processing this data under GDPR:

  • article 6 (1) (e): for the performance of a task carried out in the public interest
  • article 9 (2) (h): for the provision of health or social care or the management of health and social care systems and services
  • article 9 (2) (i): for reason of public interest in the area of public health

4 What we do with the information

4.1 The council is a data controller for any personal information collected in relation to the Workplace NHS Health Check pilot programme.

The Service Providers are the data processors, collecting and handling personally identifiable information as part of the delivery of the Workplace NHS Health Check pilot programme. They are also responsible for anonymising the data set before sharing with the council.

4.2 We may share this information with our internal audit team to evaluate the effectiveness of the organisation’s risk management, control and governance processes.

4.3 Automated decision-making is where decisions are made about you without any human influence on the outcome. These may affect your legal rights or have an impact on your circumstances, behaviour or choices.

4.4 Profiling is where you analyse parts of an individual’s personality, behaviour, interests and habits to identify their preferences, make predictions or decisions about them.

5 How long we keep your information for and how we securely dispose of it after use

5.1 We keep the data for this purpose in line with the council’s retention schedules. A copy of the retention schedule can be requested.

5.2 We will securely dispose of your information in line with retention periods.

6 How we store your information

6.1 In regard to the council, any data received electronically regarding the Workplace NHS Health Check pilot programme, prior to being deleted, will be stored within a secure cloud network owned managed by the council and will only be accessible by authorised public health staff and relevant regulatory authorities.

6.2 Where study data is collected on paper it will, prior to redaction and deletion, be held securely in a locked room or locked cabinet that is accessible only to the public health team and relevant regulatory authorities.

7 Your data protection rights

7.1 The law gives you a number of rights to control what personal information is used by us and how we can use it. For further information, please see section 15 of the council’s Corporate Privacy Notice.

7.2 Please be aware that your rights may differ depending on the lawful basis for processing your personal data.

7.3 The right to withdraw consent - You can ask that we no longer use your details for this processing. If you wish to exercise this right, please contact the Data Protection Officer detailed in section 8.1 below.

8 Who to contact

8.1 If you would like further information about how we use your personal information, or you wish to exercise one of your data rights or you wish to complain about the use of your personal information please contact the Data Protection Officer.

8.2 If you are still dissatisfied once you have contacted the Data Protection Officer, you have the right to complain to the ICO.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

9 Changes to this privacy notice

9.1 Privacy notices are live documents, which will be updated or revised in line with legislation.

9.2 This privacy notice was last updated on 30 January 2025.

Last updated 03 February 2025