Privacy Notice

Last updated: [INSERT DATE]

1. About this notice

Caledonia Medical Assessments Ltd (“CMA”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal information.

This Privacy Notice explains how we collect, use, store and share personal information when:

  • an organisation refers you to CMA for a medical assessment;

  • you attend or arrange an assessment;

  • you contact or work with CMA;

  • you provide services as a clinician or business partner; or

  • you visit our website.

CMA provides GP-led medical assessments and medical evidence-collection services. We do not ordinarily diagnose or treat applicants.

2. Who we are

Caledonia Medical Assessments Ltd
Registered office: [INSERT ADDRESS]
Company number: [INSERT COMPANY NUMBER]
ICO registration number: [INSERT ICO NUMBER]
Privacy email: [INSERT PRIVACY EMAIL]
Telephone: [INSERT TELEPHONE NUMBER]

For questions about this notice or the use of your information, please contact us using the details above.

3. Our data-protection role

The organisation requesting your assessment—such as an insurer, underwriting organisation, medical evidence provider or occupational health organisation—will normally decide why the assessment is required and how the resulting report will be used.

Depending on the arrangement:

  • the referring organisation may be the data controller, with CMA processing information on its instructions;

  • CMA may act as an independent controller for certain clinical-governance, professional-recordkeeping, security and legal-compliance activities; or

  • CMA and the referring organisation may each have separate responsibilities for different parts of the process.

The referring organisation should provide its own privacy information explaining how it will use your report and any decisions it may make.

4. Information we may collect

Information about applicants

We may collect:

  • your name, date of birth and contact details;

  • your address and preferred appointment location;

  • referral and appointment information;

  • information required to confirm your identity;

  • relevant medical history and current health information;

  • information about medication, previous treatment or medical conditions;

  • assessment responses, measurements, observations and clinical notes;

  • accessibility or communication requirements;

  • correspondence between you, CMA, the clinician and the referring organisation;

  • the completed assessment report; and

  • information about complaints, incidents or data-rights requests.

Health information is treated as special-category personal data and receives additional protection.

Information about client and partner contacts

We may collect:

  • names, job titles and professional contact details;

  • organisation and department information;

  • referral instructions and service correspondence;

  • contract, billing and account-administration information; and

  • professional qualifications, registration details or compliance information where relevant.

Website and enquiry information

We may collect:

  • information you provide through an enquiry;

  • your IP address, browser and device information;

  • website usage and security logs; and

  • cookie information where applicable.

Please see our Cookie Policy for further information.

5. Where we obtain information

We may receive personal information from:

  • you directly;

  • the insurer, underwriter or other organisation referring you;

  • an authorised representative acting for you;

  • the GP, nurse or other professional completing your assessment;

  • medical records or evidence supplied with appropriate authority;

  • our service providers and clinical network; and

  • your use of our website or communications systems.

6. How and why we use personal information

We may use personal information to:

  • review and administer referrals;

  • contact applicants and arrange appointments;

  • confirm identity and assessment requirements;

  • allocate an appropriately qualified GP or nurse;

  • complete the requested medical assessment;

  • collect and review relevant medical evidence;

  • prepare and securely submit assessment reports;

  • communicate with referring organisations;

  • maintain clinical quality and governance;

  • respond to enquiries and complaints;

  • protect our systems and prevent unauthorised access;

  • establish, exercise or defend legal claims; and

  • comply with legal, regulatory and professional obligations.

7. Our lawful bases

Under UK data-protection law, we must have a lawful basis for using personal information.

Depending on the activity, we may rely on:

  • Contract: where processing is necessary to perform a contract or take requested steps before entering into one.

  • Legal obligation: where we must process information to comply with the law.

  • Legitimate interests: where processing is necessary for CMA’s or a referring organisation’s legitimate business, clinical-governance, security or administrative interests, provided those interests are not overridden by your rights.

  • Consent: where we have asked you to provide clear consent for a particular purpose.

  • Legal claims: where information is required to establish, exercise or defend legal rights.

Health and other special-category information

When we process health information, we must also satisfy a condition under Article 9 of the UK GDPR.

Depending on the referral and its purpose, this may include:

  • your explicit consent;

  • processing necessary for occupational or preventive medicine, assessment of working capacity or another applicable health-related purpose;

  • processing necessary for reasons of substantial public interest relating to insurance, where the applicable legal requirements are met; or

  • processing necessary to establish, exercise or defend legal claims.

The applicable basis and special-category condition will depend on the service, the referring organisation’s instructions and CMA’s role. Additional information may be provided with your referral or appointment documents.

Where we rely on consent, you may withdraw that consent at any time. Withdrawal will not affect processing that was lawful before consent was withdrawn. It may, however, mean that the assessment cannot continue.

8. Sharing personal information

Where necessary and lawful, we may share information with:

  • the organisation that requested the assessment;

  • GPs, nurses and other appropriately qualified professionals participating in the assessment;

  • appointment, communications, secure-reporting and information-technology providers;

  • professional advisers, including legal, insurance, accounting and data-protection advisers;

  • regulatory, professional or supervisory bodies;

  • law-enforcement agencies, courts or public authorities where disclosure is required or permitted by law; and

  • another organisation involved in a merger, restructuring or transfer of our business, subject to appropriate confidentiality protections.

We require service providers handling personal information for CMA to protect it and use it only for authorised purposes.

We do not sell applicants’ personal information.

9. International transfers

Some technology or support providers may process information outside the United Kingdom.

Where a restricted international transfer occurs, CMA will use an approved legal mechanism, such as:

  • UK adequacy regulations;

  • an approved international data-transfer agreement or equivalent contractual safeguards; or

  • another lawful transfer mechanism permitted under UK data-protection law.

Information about applicable safeguards may be requested using the contact details in this notice.

10. Information security

We use appropriate technical and organisational measures designed to protect personal information against accidental loss, unauthorised access, alteration, disclosure or destruction.

These measures may include:

  • access controls and role-based permissions;

  • secure communication and reporting systems;

  • encryption where appropriate;

  • confidentiality obligations;

  • staff and clinician training;

  • supplier due diligence; and

  • incident-management and data-breach procedures.

Access is limited to people who reasonably require the information for an authorised purpose.

11. How long we retain information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected.

The applicable period may depend on:

  • the instructions and contract agreed with the referring organisation;

  • clinical and professional-recordkeeping requirements;

  • legal, regulatory or insurance obligations;

  • complaint and legal-claim limitation periods;

  • information-security requirements; and

  • whether information remains necessary to establish, exercise or defend legal rights.

Information is securely deleted, anonymised or returned to the appropriate organisation when it is no longer required.

Further information about specific retention periods may be requested from CMA.

12. If you do not provide requested information

You are not ordinarily required by law to participate in an assessment arranged by CMA.

However, if required information is not provided, CMA may be unable to:

  • verify your identity;

  • arrange or complete the appointment;

  • carry out the requested assessment; or

  • provide a complete report to the referring organisation.

The referring organisation can explain how non-participation or incomplete information may affect its own application, underwriting or decision-making process.

13. Underwriting and automated decisions

CMA gathers medical information and provides assessment reports. We do not ordinarily make insurance, underwriting, employment or eligibility decisions.

CMA does not use solely automated decision-making to determine whether an applicant should receive insurance or another benefit.

The referring organisation may use the report as part of its decision-making process. You should consult that organisation’s privacy notice for information about its decisions, profiling or automated systems.

14. Your data-protection rights

Depending on the circumstances and lawful basis, you may have the right to:

  • request access to your personal information;

  • ask for inaccurate information to be corrected;

  • ask for incomplete information to be completed;

  • request deletion of your information in certain circumstances;

  • request restriction of processing;

  • object to processing based on legitimate interests;

  • receive certain information in a portable format;

  • withdraw consent where processing is based on consent; and

  • complain about how your information has been handled.

These rights are not absolute, and legal or professional exemptions may apply.

Where CMA processes information only on behalf of a referring organisation, we may forward your request to that organisation or direct you to contact it.

To exercise your rights, contact:

Privacy Team
Caledonia Medical Assessments Ltd
Email: [INSERT PRIVACY EMAIL]
Address: [INSERT POSTAL ADDRESS]

We may ask for information necessary to confirm your identity. We will normally respond within one month.

Your right to object

You have the right to object where we process your personal information on the basis of legitimate interests. We will consider your request and stop the processing unless there are compelling lawful reasons to continue or the information is required for legal claims.

15. Complaints

Please contact CMA first if you have concerns about how we use your information. We will investigate your complaint and aim to resolve it promptly.

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/

16. Cookies

Our website may use essential cookies required for security and basic operation.

We will request consent before using non-essential analytics, advertising or similar cookies where consent is legally required.

Please read our Cookie Policy for details of the cookies in use and how to manage your preferences.

17. Changes to this notice

We may update this Privacy Notice to reflect changes to our services, technology, suppliers or legal obligations.

The latest version will be published on our website with an updated revision date. Where a change materially affects how we use existing personal information, we will provide additional notice where required.

18. Contact us

For privacy questions, complaints or rights requests, contact:

Caledonia Medical Assessments Ltd
Privacy email: [INSERT PRIVACY EMAIL]
Telephone: [INSERT TELEPHONE NUMBER]
Postal address: [INSERT POSTAL ADDRESS]