data security

Precision Health Patient Privacy Notice

Primary care, occupational health and health screening

Draft for approval, prepared 21 September 2026. Effective date: 21/09/2026

Your privacy at a glance

Precision Health respects your privacy and the confidentiality of your health information. This notice explains how we collect, use, store and share personal information when you use our primary care, occupational health or health screening services, register for our patient portal, or contact us through our website.

Your clinical record is confidential: An employer paying for your care does not give that employer access to your clinical record.
Different services have different purposes: Primary care supports your personal healthcare; occupational health assesses the relationship between health and work; health screening helps identify health risks and appropriate follow-up.
Employer reports are limited: Occupational health reports are subject to a separate explanation and consent process, except where disclosure is required or otherwise lawfully justified. Routine employer reports about primary care and general health screening use anonymised, aggregated information.
Registration is not blanket consent: Creating an account does not consent to every future examination, test, treatment, report or use of your information.
You can contact us: Please contact our Data Protection Officer at dpo@precisionhealth.ie with questions or requests about your information.

Who is responsible for your information?

Precision Health Ltd, referred to in this notice as “Precision Health”, “we”, “us” or “our”, is the data controller for the patient information we collect and use to deliver our clinical services. This means we determine why and how that information is processed.

Our contact details are:

Postal address: Precision Health Ltd, 238 Blanchardstown Corporate Park 2, Blanchardstown, Dublin 15, D15 KV21, Ireland.
Data Protection Officer: dpo@precisionhealth.ie.
Telephone: +353 1 910 4024.

Where an employer refers you to occupational health, the employer is separately responsible for the information it holds and the purposes for which it uses a report lawfully provided to it. The employer’s own privacy notice explains that processing; it does not replace this notice or authorise access to our clinical records.

This notice covers services delivered at our clinics, at employer premises, through mobile services and remotely, where available. Additional information may be provided for a particular screening programme, test or service, and should be read alongside this notice.

What information do we collect?

We collect information relevant to the service you receive and do not require every category below for every patient. Health information is particularly sensitive, and we apply additional confidentiality and access safeguards.

Identity and contact information: Your name, date of birth, address, telephone number, email address, patient identifier and information needed to verify your identity.
Relevant personal circumstances: Sex at birth, gender information where relevant, communication or accessibility needs, and emergency contact details where needed.
Health information: Medical and family history, symptoms, medications, allergies, vaccination history, lifestyle and risk factors, examination findings, diagnoses, clinical opinions, treatment plans, prescriptions, investigation results and referrals.
Sensitive clinical details: Information about sexual or reproductive health, mental health, disability or other sensitive matters where relevant to your assessment or care.
Employment and referral information: Employer, employee identifier, role, duties, work location, relevant workplace exposures, absence information and the questions raised in an occupational health referral. For primary care, employment information is normally limited to confirming eligibility for an employer-funded service.
Screening information: Questionnaire answers, measurements such as blood pressure or cholesterol, laboratory results, risk assessments, advice and follow-up recommendations.
Service and financial information: Appointments, attendance, service eligibility, invoices, payments and relevant funding or insurance details where applicable.
Communications and choices: Correspondence, portal messages, consent and refusal records, communication preferences, complaints and feedback.
Technical information: Portal and website access records, IP addresses, device or browser information, security logs and cookie preferences, where collected by the systems you use.

Some services involve collecting biological samples for testing. The associated identifiers, test requests and results are handled as confidential health information; any additional arrangements for sample storage or onward testing will be explained where relevant.

Where does the information come from?

Most information comes directly from you during registration, questionnaires, appointments and correspondence. We also create information through clinical assessment, testing and professional advice.

Where relevant, information may come from your referring employer, GP, specialist, hospital, pharmacy, laboratory, another healthcare provider, or a person you have authorised to communicate with us. We seek your permission to obtain external clinical reports where required, and explain the purpose and scope of the request.

If an employer refers you before you have registered with us, we may receive your identity, contact details and referral information first. We provide privacy information when we contact you or otherwise within the applicable transparency timeframe.

How we use your information

Primary care

We use your information to assess symptoms, examine you, provide advice, prescribe where appropriate, arrange investigations, review results, make referrals and organise follow-up. We also keep a clinical record so that decisions and care can be delivered safely and reviewed when necessary.

Primary care is a confidential healthcare service, not an occupational health assessment. We do not routinely disclose identifiable primary care attendance, consultation details, diagnoses, prescriptions or test results to your employer.

Occupational health

We use your information to assess how your health may affect your work and how work may affect your health. This may include pre-placement assessments, management referrals, return-to-work advice, workplace adjustments, fitness-for-work assessments, occupational immunisation and health surveillance.

An occupational health report is distinct from your full clinical record. Its purpose is to give relevant advice about work, rather than provide an employer with your medical history.

Health screening

We use your questionnaire responses, measurements and test results to assess health risks, provide an individual report or advice, and recommend appropriate follow-up. Where necessary, we may discuss referral to your GP or another healthcare professional.

Your individual screening results are provided to you and are not routinely given to an employer funding a general health screening programme. If a programme involves occupational fitness certification or statutory health surveillance, we explain that different purpose and the proposed reporting arrangements before the assessment.

Running and improving our services

We also use information to manage appointments, communicate about your care, administer accounts, respond to complaints, maintain information security and meet clinical governance and legal requirements. Clinical audit and quality improvement use identifiable information only where necessary, with access restricted to authorised personnel; anonymised information is used where it can meet the purpose.

We do not sell your personal or health information. This notice does not authorise identifiable health information to be used for unrelated research, advertising or another new purpose; any proposed additional use requires a separate assessment, appropriate legal basis and further information to you.

Our legal grounds for using information

We distinguish consent to healthcare from the legal grounds for processing personal information. Healthcare processing requires an Article 6 GDPR lawful basis and, for health information, an additional Article 9 condition; consent is not the only possible basis (GDPR, Articles 6 and 9).

The following describes our proposed purpose-specific framework.

Purpose

Providing primary care or screening under a service agreement with you, including registration, appointments and necessary clinical records

Article 6(1)(b), necessary to provide the service under our agreement with you

Article 9(2)(h), healthcare or preventive medicine, with professional confidentiality safeguards and section 52 of the Data Protection Act 2018

Providing employer-arranged occupational health or screening where you are not a party to the employer’s contract

Article 6(1)(f), legitimate interests in providing the commissioned clinical service, supporting access to healthcare and assessing health in relation to work, subject to assessment of your rights and reasonable expectations

Article 9(2)(h), healthcare, occupational medicine or assessment of working capacity, with section 52 safeguards

Clinical governance, service security, necessary administration and investigation of service complaints

Article 6(1)(f), legitimate interests in operating a safe, accountable healthcare service; Article 6(1)(c) for a specific legal obligation where applicable

Article 9(2)(h) where necessary for healthcare management;

Article 9(2)(f) where necessary for legal claims

Specifically requested, genuinely optional disclosures or other optional uses for which we rely on data-protection consent

Article 6(1)(a), consent

Article 9(2)(a), explicit consent, where health information is involved

Required public-health notifications or other legally required reporting

Article 6(1)(c), compliance with the particular legal obligationThe applicable condition for that report, such as Article 9(2)(i) for public-health reporting under relevant law, or Article 9(2)(f) for legal proceedings

Establishing, exercising or defending legal claims

Article 6(1)(f), legitimate interests in protecting legal rights, or Article 6(1)(c) where legally required

Article 9(2)(f), legal claims

Website enquiries, optional newsletters and non-essential cookies

Article 6(1)(f) for responding to general enquiries; Article 6(1)(a) for consent-based newsletters and non-essential cookies General website forms and marketing do not require health information

The healthcare condition covers preventive and occupational medicine, assessment of working capacity, diagnosis, treatment and healthcare management, subject to the required safeguards (Data Protection Act 2018, section 52). Where we rely on legitimate interests, we assess necessity, consider less intrusive alternatives and balance those interests against your rights.

In a life-threatening emergency, different legal grounds may apply, including protection of vital interests; the specific health-data condition under Article 9(2)(c) applies only where the person is physically or legally incapable of giving consent (GDPR, Articles 6 and 9). We assess and document the grounds appropriate to the circumstances rather than treating an emergency as a general permission to disclose information.

Consent and your choices

We explain proposed assessments, examinations, investigations and treatment and obtain the appropriate clinical consent. A privacy notice or portal registration acknowledgement is not a substitute for that discussion.

Consent to an occupational health report is also separate from consent to the assessment itself. We explain its purpose, intended recipient and proposed information, and seek your specific informed consent before release, subject to the exceptional disclosure circumstances described below.

You may decline an optional service, ask questions or withdraw consent before the relevant action is taken. If you decline an occupational health assessment or report, we will explain any limitations on the advice we can provide; your employer may then have to make decisions without that advice.

Where personal-data processing relies on consent, you can withdraw that consent by contacting us, without affecting processing that was lawful before withdrawal (GDPR, Article 7). Withdrawal does not automatically erase your existing clinical record or prevent processing that remains necessary on another lawful basis.

If we need particular information to verify identity, prescribe safely, interpret results or complete an assessment, we will explain that requirement. If you choose not to provide it, we may be unable to provide all or part of the service safely; optional marketing choices do not affect access to clinical care.

Who can access or receive your information?

Our clinical and support teams

Access is limited to authorised people who need information for their duties, including clinical care, necessary administration, security and governance. Staff and contractors are subject to confidentiality requirements, and administrative access is limited to the information needed for the task.

Where you receive both primary care and occupational health, shared identity and contact details may support a single patient account, but the clinical information is subject to service-specific access restrictions. Primary care records are not automatically available to the occupational health team or used to prepare an employer report simply because both services are provided by Precision Health.

Any necessary sharing between services requires a specific, lawful and documented purpose and your informed consent where required. Authorised governance access or exceptional access to prevent serious harm is restricted and subject to oversight.

Healthcare providers and laboratories

We may share relevant information with your nominated pharmacy, GP, specialist, hospital or laboratory to arrange prescriptions, tests, referrals or follow-up. We explain planned sharing and seek your consent where required, limiting the information to what is necessary.

Recipients may have their own responsibilities for clinical records and data protection. We can explain the organisations involved in your particular care.

Employers and programme sponsors

An employer does not receive access to your clinical record merely because it funds or arranges a service. Any information provided is limited to the agreed purpose and the applicable confidentiality and legal requirements.

Occupational health: With the consent process described above, an employer may receive relevant advice about fitness for work, functional restrictions, adjustments and review needs. Diagnoses or other clinical details are not routinely included and are disclosed only where necessary, explained and appropriately authorised.
Referral administration: For an employer’s occupational health referral, the authorised referrer may receive necessary status information, such as whether an appointment has been arranged, attended or a report is available. This does not authorise access to consultation notes or unrelated results.
Primary care and general health screening: Routine reporting to an employer or sponsor is anonymised and aggregated. We avoid small groups, detailed breakdowns or combinations of information that could identify individuals.
Exceptional disclosure: Information may be disclosed without consent only in the limited circumstances described in the next section, not simply because an employer requests it.

These limits reflect the requirement to minimise employer-facing health disclosures; the Data Protection Commission has specifically highlighted the risks of disclosing an employee’s full medical information to HR (DPC occupational health case study). We do not treat account registration as permission for employer access.

Service providers and other recipients

We use contracted organisations to support service delivery, with access and data-protection arrangements appropriate to their role. Depending on the service, these include:

Meddbase, supplied by Medical Management Systems Ltd: Patient records, appointments, referral workflows and the patient portal.
Jotform Enterprise: Approved health screening questionnaires and related form workflows.
Commify Ltd, trading as Esendex: SMS communications such as appointment reminders.
Eurofins-Biomnis Ireland Ltd and other laboratories identified for your service: Relevant test requests, sample identifiers, results and associated clinical information.
Secure clinical communications, hosting and IT suppliers: Systems needed to communicate with healthcare professionals, maintain services and protect records.
Payment, accounting and professional advisers: Necessary financial or administrative information, and relevant information where required for a complaint, legal claim or regulatory matter.

We require processors acting on our behalf to process information under appropriate written instructions and contractual safeguards. Where a recipient acts as an independent controller, its own privacy information also applies.

When confidentiality may need to be overridden

Confidentiality is fundamental, but it is not absolute: the Irish Medical Council recognises legally required disclosure and exceptional public-interest disclosure to protect against serious harm (Medical Council guidance, sections 25–29). Our healthcare professionals must also follow the professional requirements applicable to their own role.

In exceptional circumstances, a healthcare professional may be legally or ethically required to disclose relevant information without your consent, for example to address child protection or safeguarding concerns, comply with a court order or statutory reporting duty, or protect you or others from serious harm (Medical Council guidance, sections 5, 6 and 29). An ethical concern does not remove the need to identify an appropriate legal basis for processing.

We consider the necessity and proportionality of disclosure, balance confidentiality with the need to protect individuals or the public, and record the reasons for our decision. Only the minimum necessary information is shared with an appropriate person or authority, and we inform you unless doing so would undermine the purpose of the disclosure, in line with the Medical Council’s guidance.

Meddbase, communications and keeping your account private

Our patient portal supports account registration and, where enabled, appointment management, questionnaires, messages and access to reports. Not every document held in your clinical record is necessarily displayed in the portal; you can request access to your personal information separately.

We may contact you about appointments, results, follow-up or other service matters using the contact details you provide. Please tell us if an email address, telephone number or communication method is not private or safe for you, and avoid sending sensitive clinical information through general website enquiry forms.

You are responsible for keeping your portal credentials private. Use a strong, unique password, do not share passwords or verification codes, secure the email account and phone linked to your portal, and log out after using a shared device.

If you suspect unauthorised access, reset your password where possible and contact Precision Health promptly. These precautions help protect your privacy but do not reduce our own responsibilities for protecting your information.

Security and international transfers

We use technical and organisational safeguards appropriate to the sensitivity of health information, including access controls, authentication, secure transfer and storage arrangements, staff training, audit trails, backups and incident-response procedures. No system is completely risk-free; we investigate suspected incidents and notify affected individuals and regulators where required.

Information may be processed in Ireland, elsewhere in the European Economic Area and by approved providers in the United Kingdom. Our current arrangements include UK-based providers such as Meddbase and Esendex; any other overseas hosting, support or subprocessor access must be assessed and reflected in the relevant supplier arrangements.

The European Commission currently recognises the United Kingdom as providing an adequate level of data protection under the GDPR (European Commission adequacy information). Where a transfer is not covered by an applicable adequacy decision, we use an appropriate safeguard, such as European Commission Standard Contractual Clauses together with any necessary supplementary measures.

You can contact our DPO for information about the countries and organisations relevant to your service and a copy or explanation of applicable transfer safeguards.

How long do we keep information?

We retain information only for as long as necessary for its purpose, taking account of patient safety, continuity of care, applicable legal obligations, professional guidance and the need to deal with complaints or legal claims. The period depends on the type of record; ending employment, closing a portal account or withdrawing consent does not automatically require deletion of the underlying clinical record.

Our retention arrangements include:

Record category

Adult primary care clinical records, including associated prescriptions, results and consent records

8 years after last contact.

Routine pre-placement, periodic occupational health and return-to-work assessment records

Normally the duration of employment plus three years, unless an exposure, ongoing case or another justified requirement calls for longer retention

Occupational health management referral records

At least six years after the last entry, with longer retention where clinically necessary or required for an ongoing matter

Exposure-related health surveillance records

Long-term retention according to the particular exposure and applicable requirement; our schedule includes 40 years from the last entry for specified exposure-related categories

General preventive health screening records

2 years

Copies held in screening and messaging platforms

Our current schedule specifies two years for Jotform and Esendex copies; this is separate from retention of the authoritative clinical record

Laboratory test data

Our current schedule records seven years for Eurofins-Biomnis test data; other laboratories or tests may have different requirements

Billing and financial records

Normally six years, with longer retention where a specific legal or unresolved accounting matter requires it

General website enquiries

Up to two years after the last contact, unless the enquiry becomes part of a clinical record, complaint or other record with its own retention requirement

Marketing preferences

While the subscription is active; a minimal opt-out record may be retained to ensure we respect your choice not to receive marketing

At the end of the relevant period, information is reviewed for secure deletion or anonymisation. Records subject to a complaint, investigation or legal hold are retained for the justified period and reviewed when that matter ends.

Your data-protection rights

Depending on the circumstances and applicable limits, you can request access, rectification, erasure, restriction, portability and object to certain processing, as explained in the DPC’s guidance on information and rights. You can also withdraw consent where processing relies on it and complain to the Data Protection Commission.

Access: Ask whether we hold personal information about you and request a copy.
Correction: Ask us to correct inaccurate factual information or complete an incomplete record. Clinical records may need a dated correction or supplementary statement rather than removal of the original entry.
Erasure: Ask us to delete information where the legal conditions apply. This is not an absolute right to delete necessary clinical or legal records.
Restriction: Ask us to limit particular uses in qualifying circumstances, for example while a dispute about accuracy is considered.
Objection: Object, on grounds relating to your situation, to processing based on legitimate interests. You can object to direct marketing at any time.
Portability: Where applicable, request information you have provided in a structured, commonly used electronic format.

Contact our DPO by email, telephone or post to make a request; you do not need to use a special form. We may request proportionate information to confirm your identity or clarify what you need.

We respond without undue delay and normally within one month; for complex or numerous requests, the period may be extended by up to two further months, with reasons provided within the first month (DPC response-time guidance). If a request cannot be fulfilled in full, we explain the reason and your options.

You may raise a concern directly with the Data Protection Commission without first complaining to us (DPC guidance). We welcome the opportunity to address any concern and help you understand how your information has been handled.

Automated tools, website cookies and marketing

Clinical risk calculators and other software may support our clinicians, but we do not make decisions about your care or occupational fitness solely through automated processing without meaningful human involvement. If a new service would change this, we will assess it and provide the required information before introducing it.

We use essential website or portal technologies where needed to operate a service you request. Non-essential cookies and tracking require prior consent, and that consent must be capable of withdrawal (DPC cookie guidance).

See cookies and privacy notice for the technologies used, their purposes, providers, durations and available choices. This notice does not itself provide consent to analytics, advertising cookies or other optional tracking.

Where we offer optional newsletters or marketing, the choice is separate from clinical registration and you can unsubscribe at any time. Appointment reminders, result notifications and other necessary care communications are not marketing.

Changes to this notice

We review this notice when our services, systems or legal obligations change, and show the effective date at the top. Where a change materially affects how your information is used, we will provide an appropriate additional notification and obtain fresh consent where required.