About PAM Group
“PAM Group” consists of a group of companies People Asset Management Limited, PAM Wellbeing Limited, PAM OH Solutions Limited, Premier Occupational Healthcare Limited, PAM Health Ltd, Sankey Health Ltd, Medprotect Limited and To Health Limited We provide specialist health services and products including:
- Occupational health medicals, management reports and drug & alcohol screening
- Health Screening Assessments
- Physiotherapy and Counselling Therapy
- Employee Assistance Programmes.
- Health products and vaccines
PAM Group has appointed James Murphy as its Data Protection Officer. Our Registered Office is Holly House, 73-75 Sankey Street Warrington Cheshire WA1 1SL
Who is the Policy for?
This policy is information for people that we hold information for or are about to hold their information. They are mostly our clients employees but we also provide private treatment in this case we hold data for you the individual. PAM Group are committed to ensuring we hold your data securely this policy explains:
- What we hold?
- Why we hold it?
- How long we hold it for?
PAM Group holds “Personal and Special Information” as defined by the GDPR and Data Protection Regulations. We treat our responsibilities very seriously as an organisation and as individuals we will always treat your information as important and ensure that we protect its use, access and accuracy. PAM Group is registered with the Information Commissioners Office Registration Number: Z9280152, we hold ISO 9001 (Quality Management) accreditation, ISO 27001 (Information Security Management) accreditation and the Faculty of Occupational Health SEQOHS accreditation.
Why do we hold your data?
PAM Group employs specialist clinicians who provide advice and medical treatment. These include doctors, specialist nurses, physiotherapists, counsellors, psychologists, psychiatrists, nutritionists, physiologists, wellbeing advisors legal advisors and debt advisors.
We hold your employer’s occupational health records; these are medical and personal records that must be held for your safety and wellbeing at work. Authorised medical professionals may only hold occupational health records as set out in the Data Protection Act (2018) s(204).
We process your data for this purpose in compliance with the Data Protection Act (2018) Schedule 1 Part 1 S(2)
Health or social care purposes.
2 (1) This condition is met if the processing is necessary for health or social care purposes.
2 (2) In this paragraph “health or social care purposes” means the purposes of.
- preventive or occupational medicine,
- the assessment of the working capacity of an employee,
- medical diagnosis,
- the provision of health care or treatment,
- the provision of social care, or
- the management of health care systems or services or social care systems or services.
Where we provide occupational health services and or Employee Assistance Programme (EAP) services, we hold information about our clients employees this will include personal details E.G. Name, Home address, Date of Birth, Job details and medical records. We need this information to be able to provide accurate advice to you and your employer ensuring that work does not damage your health and you are fit for the work you do.
PAM use the information held in the delivery of our services.
- We need personal information e.g. name address, date of birth in order to identify and verify the correct person and in some cases where we need to communicate with your health care provider this is the standard identification information used with the NHS.
- We need your personal contact details e.g. telephone and email to assist us communicating with you when booking appointments.
- We need and will create medically confidential information so that our clinicians can provide professional advice based on your health fitness and wellbeing.
- We operate a secure occupational health IT system this requires any user of our service including employees referred or managers making referrals to be registered as an employee within our system.
- We may retain telephone recordings this data is held for the training and monitoring of our colleagues. Any voice recording is destroyed after 31 days and does not form part of your medical records
All medical information is held securely and only accessed by PAM Group workers. Employers have access to our system and a specific hierarchy is in place that determines which managers have access to your occupational health file. Occupational health reports and medical records are kept separately within our system managers do not have access to your medical records.
- We do not and will never sell your information to anyone else.
- Unless we advise you first, we will not share your information with anyone else other than your employer and we will always obtain your consent before we provide information.
- We will not use your information for any other purpose other than for the provision of our services and goods.
Most of the information we hold is electronic in some limited cases we do still hold paper records. Our computer servers are located in England and your information is not stored or held outside the UK. We have a Data Centre that converts paper records to electronic records then destroys old unwanted paper records this is located in England.
When your employer becomes a client of PAM Group the historical occupational health records held by the previous occupational health provider are transferred to PAM Group. You will have been consulted on this transfer. During the time that PAM Group provides your occupational health service we will create and add our records to your occupational health file. If your employer leaves PAM Group your occupational health file will be transferred to your new occupational health provider and you should be consulted on that change at that time. PAM Group will not retain a copy of your records after your employer leaves us.
PAM clinicians may require medical reports from your healthcare professionals e.g. GP or specialist Consultant; if required PAM will always obtain your written consent before obtaining the report. Before you give your consent to allow PAM to obtain any report you will be advised of
- The reason why the report is needed.
- Your rights under the Access to Medical Reports Act (1988)
- Your right to see a copy of the report being sent to PAM if you wish
- That PAM will send a report to your employer based on the medical report sent to us. It will not be the actual report that your healthcare provider sends to us.
- How you can see the report that PAM sends to your employer.
Where PAM sends a report to your employer if the report is being written by an Occupational Health Physician (Doctor) you will have the opportunity to see the report before it is sent to your employer. Reports are only sent to employees via our secure email procedures. If the report being sent to your employer is written by an Occupational Health Advisor (Nurse) you can obtain a copy of the report from your manager.
Unless we have copied your occupational health records we will not destroy any original documents. We hold your occupational health records on behalf of your employer and will store information in line with their data retention policy. You may wish to contact your employer to confirm their actual data retention policy. Your occupational health records will be kept whilst you are employed by your employer. After you leave their employment there are certain legal time scales that your employer needs to retain your records for: In all other cases PAM Group Data Retention Policy is:
|Reason to retain records||Time Period|
|Telephone voice recordings||31 Days|
|Employee Liability Claims||3 Years|
|Limitation Act Claims||6 years|
|Industrial Disease Records||40 years|
|Rail Workers Sentinel Medicals & drug and alcohol testing||10 years|
For private clients where we create your medical records we will store the information as long as we provide your treatment and for a further period of 5 years after the last treatment.
Where we use any subcontract labour, they will work using the same systems as our employees do and any data processed is held in our systems. There is an exception where we use the following subcontractors:
Egress www.egress.com are used to process secure email for prior sight processing. It is necessary to validate an employee’s access to the Egress systems that they first register on the Egress platform this requires them to enter their name, email, create a password and enter a telephone number. If you already have an Egress account there is no need to create a second account for PAM. You have the right to ask us to have the Egress data to be deleted, however you must register with egress if you wish to use our prior sight processing service.
Raiys www.raiys.com are used to provide a health and wellbeing app and provide health screening and lifestyle improvement plans. They may collect personal data that is held by them on their secure platform and is used by Raiys to target health and wellbeing plans. No personal data is shared by Raiys and PAM. Anonymised statistical data is provided to PAM to develop health and wellbeing. A Data Subject is entitled to request that any personal data held by Raiys is deleted.
All health information is processed using our secure clinical systems OHIO and Fit4jobs. We will process data using email internally within our business and to our clients (your employer). Processing via email will not include medical reports or clinical data this is only processed using our secure systems. Our colleagues may occasionally use chat or SMS platforms for informal communication these include Microsoft Teams Chat, What’s App and SMS Text. Informal communications will not include any personal data including health information or personal identifying data. All informal communications will be deleted every 7 days and will not form part of any formal data processing.
The UK Data Protection Regulations are specific about the treatment of personal and special data, you have the right to receive a copy of your records by making a Subject Access Request in writing. To request a copy of your Data Please submit your request to the Data Controller, PAM Group, Holly House, 73-75 Sankey Street, Warrington, Cheshire, WA1 1SL
PAM Group will only use qualified clinicians when we provide advice or services to you or your employer our clinicians are regulated and authorised by, Nursing Midwifery Council, General Medical Council, Health Care Protection Council, and British Association of Counselling and Psychotherapy
Should you have any need to complain about our services you will find useful advice in our Consultation Policy and the process that we use? The Consultation Policy is held at our clinics and on our website www.pamgroup.co.uk
Any complaints or praise can be sent to James Murphy Managing Director PAM Group, Holly House, 73-75 Sankey Street Warrington Cheshire WA1 1SL. If you are unhappy at how PAM have processed your data you can contact the Information Commissioners Office at www.ico.org.uk or write to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Chief Executive Officer
Policy Review date 31.1.2024