1. Introduction
Medmark respects your privacy. We handle personal data fairly, lawfully and transparently, and we use it only for clear and legitimate purposes.
This notice tells you what personal data we may collect, where it comes from, why we use it, who may receive it, how long we keep it and what rights you have. “Personal data” means information relating to an identified or identifiable person. Health information is “special category” personal data and receives additional protection under the GDPR.
2. Who we are
Medmark Limited (“Medmark”, “we”, “us” or “our”) provides occupational health and related medical services to public- and private-sector organisations throughout Ireland.
Data Protection Officer Medmark Limited 69 Lower Baggot Street Baggot Street Bridge Dublin 2 D02 HW52 Ireland
Email: dataprotectionofficer@medmark.ie Telephone: 01 676 1493 Website: www.medmark.ie
3. Scope of this notice
This notice applies when you:
- visit or interact with our website;
- contact us about our services or make an enquiry;
- are referred to Medmark by an employer or another organisation;
- attend an occupational health appointment, assessment, screening or vaccination service;
- use a Medmark portal, form or other digital service;
- communicate with our clinicians or administrative teams; or
- are otherwise involved in delivering or receiving our services, including as a client contact, supplier contact or healthcare professional.
Separate privacy information may be provided for a particular service, event, portal, recruitment process or employment relationship. If it conflicts with this general notice, the more specific notice applies to that processing.
4. When Medmark is a controller or processor
Medmark as a data controller
Medmark is a controller where it decides why and how personal data is used. This may include maintaining clinical records; making independent clinical decisions; meeting medical, professional, regulatory and legal duties; managing Medmark’s business and systems; handling complaints and rights requests; and operating this website.
Medmark as a data processor
For some services, a client organisation determines the purpose and essential means of processing and Medmark handles personal data only on that client’s documented instructions. In that situation, the client is the controller and Medmark is its processor. The client’s privacy notice should explain its lawful basis and purposes. Medmark supports the client in meeting its GDPR obligations.
Roles depend on the facts
The role is determined by the actual processing, not simply by the contract label. Medmark may be a controller for its clinical record and professional responsibilities while acting as a processor for a separate administrative activity within the same service. In some arrangements, Medmark and a client may be separate controllers or, where they jointly determine purposes and means, joint controllers. We will explain the relevant arrangement where this is necessary for transparency.
Examples of how these roles may apply
The following examples illustrate how Medmark’s role may vary depending on the service provided and the particular processing activity involved. They are not intended to provide an exhaustive classification of every processing activity.
Health screening medicals
Where an individual attends Medmark for a health screening medical and Medmark provides the clinical service directly to that individual, Medmark generally acts as a data controller. This includes where Medmark determines the clinical information to be collected, maintains the medical record and provides the results directly to the individual rather than to an employer or other third party.
Workplace health assessments
For workplace health assessments, the respective roles of Medmark and the employer may differ according to the particular processing activity.
Medmark acts as a data controller in respect of confidential clinical information obtained and maintained as part of the medical assessment where Medmark determines how that information is used for its independent clinical and professional purposes.
The employer will generally be the data controller for the employee information it provides to Medmark in making the referral and for the occupational health report or opinion it receives and subsequently uses.
Depending on the nature of the service and the instructions provided by the employer, Medmark may act as a data processor for particular activities undertaken on the employer’s behalf, including elements of referral administration and the preparation or provision of an occupational health outcome to the employer.
Adoption and fostering assessments, insurance medicals and similar services
For certain assessment services, such as adoption and fostering assessments or insurance medicals, Medmark may receive personal data from a client organisation, undertake the requested assessment and provide the resulting report or opinion to that client.
Where the client determines the purpose of the assessment and Medmark processes the information on the client’s documented instructions, the client acts as the data controller and Medmark acts as its data processor for that service.
Other services
These examples are illustrative rather than exhaustive. Medmark provides a range of occupational health and related services, and its data protection role may vary between services and between different processing activities within the same service. The appropriate role is determined by the circumstances of the particular processing, including who determines its purposes and essential means and any independent legal or professional obligations applying to Medmark.
5. Personal data we collect
| Category | Examples |
|---|---|
| Identity and contact | Name, title, date of birth, address, email address, telephone number, signature and identity-verification information. |
| Employment and referral | Employer, role, department, employee or reference number, work history, job demands, attendance information, reason for referral and questions asked by the referring organisation. |
| Health and clinical | Medical and occupational history, symptoms, diagnoses, medication, disability information, examination findings, test results, vaccination information, clinical correspondence, fitness opinions, recommendations and clinical notes. |
| Appointment and service | Booking details, attendance, communications, consent and preference records, service history, accessibility or support requirements. |
| Reports and correspondence | Occupational health reports, certificates, referral documents, complaints, queries, rights requests and communications with you, the client and relevant professionals. |
| Technical and website | IP address, device and browser data, security logs, cookie identifiers, pages viewed and information submitted through online forms. |
| Business administration | Client and supplier contacts, contracts, invoices, payment status, audit trails, quality, risk and incident records. |
We aim to collect only information that is relevant and necessary. Please do not send clinical information through a general website enquiry form unless the form specifically asks for it and is intended for that purpose.
6. How we obtain personal data
We may obtain personal data:
- directly from you, including during an appointment, by telephone, email, post, form, portal or website;
- from your employer, prospective employer or another referring organisation;
- from an occupational health, medical or nursing professional;
- from your GP, consultant or another treating professional, with your knowledge and after permission has been obtained;
- from laboratories, imaging providers, vaccination providers or other clinical service partners;
- from records created while we deliver the service; and
- from publicly available or official sources where lawful and relevant.
Where we receive your data from someone else, the categories commonly include identity and contact details, employment and referral information, relevant health information, appointment details and the questions the referring organisation wants addressed. Article 14 GDPR requires this source information unless an exemption applies.
7. Why we use personal data and our legal bases
When Medmark is a controller, we must have a lawful basis under Article 6 GDPR. Because occupational health work frequently involves health data, we must also satisfy a condition under Article 9 GDPR. The basis depends on the service, the facts and the circumstances.
| Why we use the information | Plain-English legal basis |
|---|---|
| To arrange appointments and provide our services | Contract steps or performance of a contract (Article 6(1)(b)); compliance with a legal obligation (Article 6(1)(c)); or legitimate interests in delivering and administering occupational health services (Article 6(1)(f)). For health data: occupational medicine, assessment of working capacity, medical diagnosis, health care or management of health systems and services, subject to professional secrecy (Article 9(2)(h)). |
| To assess fitness for work and provide occupational health advice | Legal obligation (Article 6(1)(c)) or legitimate interests (Article 6(1)(f)), depending on the referral and applicable law. For health data: employment and social protection obligations or rights (Article 9(2)(b)) and/or occupational medicine and working-capacity assessment (Article 9(2)(h)). |
| To maintain clinical records and support safe, high-quality services | Legal obligation (Article 6(1)(c)) and legitimate interests in safe, accountable clinical practice (Article 6(1)(f)). For health data: health care and occupational medicine (Article 9(2)(h)); in limited cases, public interest in public health (Article 9(2)(i)). |
| To prepare and communicate occupational health reports and recommendations | Legal obligation (Article 6(1)(c)), contract (Article 6(1)(b)) or legitimate interests (Article 6(1)(f)). For health data: employment and social protection law (Article 9(2)(b)) and/or occupational medicine and working-capacity assessment (Article 9(2)(h)). Only relevant and proportionate information is communicated. |
| To answer enquiries and manage relationships with clients, suppliers and professional contacts | Steps at your request or contract (Article 6(1)(b)) and legitimate interests in responding, managing services and keeping business records (Article 6(1)(f)). |
| To meet legal, regulatory and professional obligations | Compliance with legal obligations (Article 6(1)(c)). For special category data: the relevant Article 9 condition, commonly Article 9(2)(b), (f), (h) or (i), together with applicable Irish law. |
| To investigate complaints or incidents and manage legal claims | Legal obligation (Article 6(1)(c)) or legitimate interests in investigating, protecting rights and managing risk (Article 6(1)(f)). For special category data: establishment, exercise or defence of legal claims (Article 9(2)(f)) or, where relevant, Article 9(2)(h). |
| To protect our systems, information and services | Legitimate interests in security, fraud prevention, service continuity and audit (Article 6(1)(f)); legal obligation where applicable (Article 6(1)(c)). |
| To use optional cookies or send communications that require consent | Consent (Article 6(1)(a)). You may withdraw consent at any time. Where permitted by Irish electronic communications law, limited business communications may rely on legitimate interests (Article 6(1)(f)) with an opt-out. |
Consent
We do not normally rely on consent as the legal basis for core occupational health processing where another lawful basis applies. Clinical consent to an examination or procedure, or the release of particular information, is separate from consent as a legal basis under the GDPR. Where we rely on GDPR consent, it may be withdrawn at any time without affecting processing already carried out lawfully.
Legitimate interests
Where we rely on legitimate interests, we consider why the processing is needed, whether it is necessary and how it may affect you. We will only rely on legitimate interests where we are satisfied that your rights and interests are properly protected.
Is providing information required?
Some information is needed to arrange or safely deliver a service, answer the referral question, meet legal or professional duties, or enter into or perform a contract. If you do not provide it, we may be unable to complete an assessment, provide a reliable opinion or deliver the requested service. We will explain any material consequence at the time.
Automated decisions
Medmark does not ordinarily make decisions producing legal or similarly significant effects about individuals solely by automated means.
9. International transfers
Where personal data is transferred outside the EEA, we use a lawful transfer mechanism, such as an adequacy decision or appropriate contractual safeguards. You may contact our Data Protection Officer for further information or to request a copy of the relevant safeguard.
10. Retention
We keep personal data only for as long as necessary for the purposes for which it was collected. Retention periods vary according to the type of record, the service provided and applicable clinical, legal, regulatory and contractual requirements.
| Record type | How the retention period is determined |
|---|---|
| Occupational health and clinical records | The nature of the service and record, continuity of care, professional guidance, legal obligations and applicable limitation periods. |
| Referral reports and service administration | Service, contractual, audit and quality requirements, applicable limitation periods and any continuing complaint or claim. |
| Website enquiries and general correspondence | The time required to respond and follow up, followed by a limited period for business, audit, security or legal purposes. |
| Cookie and technical data | The period stated in our cookie information or the shorter period required for security, troubleshooting and analytics. |
| Rights requests, complaints and incidents | The time required to manage the matter, demonstrate compliance and address any related proceedings. |
| Financial and corporate records | The period required by applicable Irish tax, accounting, company and other laws. |
A specific retention period may be stated in the privacy information provided for a particular service. When personal data is no longer required, it is securely deleted or anonymised.
11. Security
We use proportionate technical and organisational measures designed to protect personal data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include:
- role-based access and least-privilege controls;
- authentication, encryption and secure transfer methods where appropriate;
- logging, monitoring, backup, resilience and recovery arrangements;
- confidentiality duties, staff training and clinical governance;
- supplier due diligence and data-processing agreements;
- physical security and secure disposal; and
- incident response, risk assessment and periodic review.
No system can be guaranteed completely secure. If a personal data breach occurs, we assess it promptly and notify the Data Protection Commission and affected individuals where the GDPR requires this.
12. Your rights
Depending on the circumstances and subject to legal restrictions, you may have the following rights:
| Right | What it means |
|---|---|
| Access - Article 15 | Ask whether we process your personal data and obtain a copy of it. |
| Rectification - Article 16 | Ask us to correct inaccurate personal data or complete information that is incomplete. A clinical opinion is not inaccurate merely because you disagree with it, but your view may be recorded where appropriate. |
| Erasure - Article 17 | Ask us to delete personal data in certain circumstances. This is not absolute; clinical, legal or public-interest duties may require continued retention. |
| Restriction - Article 18 | Ask us to limit how data is used while an issue is considered, in specified circumstances. |
| Notification - Article 19 | Where applicable, require us to tell recipients about rectification, erasure or restriction. |
| Portability - Article 20 | Receive your personal data in a portable format or have it transferred to another organisation, where applicable. |
| Object - Article 21 | Object to processing based on legitimate interests or a public task. |
| Automated decisions - Article 22 | Not be subject to a solely automated decision with legal or similarly significant effects, except where law permits it and safeguards apply. |
| Withdraw consent | Withdraw consent at any time where consent is the basis. Withdrawal does not affect earlier lawful processing. |
| Complain - Article 77 | Lodge a complaint with the Data Protection Commission. |
How to exercise a right
Contact our Data Protection Officer using the details in section 14. Please describe your request and the information or service concerned. We may ask for proportionate information to verify your identity and locate the relevant records. We do not charge a fee. We generally acknowledge your request within one week, and respond fully within one month. The GDPR permits an extension of up to two further months for complex or numerous requests. We will tell you within the first month if such an extension is required.
Rights can be limited by the GDPR or Irish law, including where disclosure would adversely affect another person’s rights or where data must be retained for legal or clinical reasons. If we cannot fully comply, we will explain why and tell you about available complaint and judicial-remedy rights.
Where Medmark acts only as a processor, the relevant client controller is responsible for deciding the request. You may contact either organisation; Medmark will assist you route the request appropriately.
14. Contacting us
For questions, concerns, rights requests or information about safeguards and retention, contact:
Please avoid sending unnecessary medical information by ordinary email. We will tell you if a secure method is appropriate.
15. Complaints to the Data Protection Commission
We encourage you to contact us first so we can try to resolve your concern. You also have the right under Article 77 GDPR to lodge a complaint with the Irish Data Protection Commission (“DPC”), in particular in the EU Member State of your habitual residence, place of work or the place of the alleged infringement.
Data Protection Commission 6 Pembroke Row Dublin 2 D02 X963 Ireland Website: www.dataprotection.ie (opens in a new tab) Email: info@dataprotection.ie Telephone: 01 765 0100 or 1800 437 737
The DPC’s online contact form is generally the most effective route for a query or complaint. The DPC recommends that individuals first raise the concern with the organisation and retain the relevant correspondence.
16. Changes to this notice
We keep this notice under review and may update it to reflect changes in our services, technology, legal obligations or regulatory guidance. The current version will be published on our website with the “last updated” date. Where a change materially affects how we use personal data, we will take reasonable steps to bring it to the attention of affected individuals and seek consent if required.