Data Protection Notice

2. Consent comes first

No examination begins without a recorded, timestamped consent from the employee, captured digitally in a language they understand. The consent states what will be tested, why, what the employer will be told, and what will not be shared.

An employee may decline. Declining is recorded as a non-completion and communicated to the employer as such — the clinical reason is never disclosed.

3. What the employer sees, and what it does not

Employers receive the fitness decision — fit, unfit, or fit with restrictions — together with any work restrictions relevant to job allocation, and the validity period of the certificate.

Employers do not receive diagnoses, laboratory values, prescriptions, mental health notes, reproductive health information, genetic information, or any history unrelated to job fitness. This boundary is enforced by role-based access control in the platform, not by policy language alone.

4. What we collect and why

Identifiers needed to attach a record to the right person: name, employee or contractor code, date of birth, department, job role and hazard category.

Clinical information generated by the examination: vitals, vision, audiometry, spirometry, imaging, laboratory results, physician findings and the fitness decision. Each test is included because it answers a documented exposure for that job role.

5. Who can access records

Examining physicians and authorised clinical staff, for the purpose of assessment and review. The employee, for their own complete record. Authorised HR and EHS users at the employer, limited to fitness status and restrictions for the employees in their scope.

Every view, edit and export is written to an immutable audit log. Administrator access requires multi-factor authentication, and bulk export activity triggers anomaly alerting.

6. How records are protected

Data is encrypted at rest using AES-256 and in transit using TLS 1.3. Infrastructure is hosted in India with daily encrypted backups and documented restore testing.

We carry out periodic penetration testing, maintain a documented incident-response runbook, and operate access reviews for all privileged accounts.

7. Retention

Occupational health records are retained for the period required by the applicable statute for the hazard concerned, which in several categories extends well beyond the end of employment. Where no statutory period applies, records are retained for the duration of the engagement plus the period needed to defend a claim.

Retention periods applicable to your specific programme are listed in your contract schedule.

8. Employee rights

Every examined employee may obtain a copy of their complete health record, ask for factual corrections, ask what has been shared with their employer, and withdraw consent for future examinations.

Requests can be made through the employee portal or directly to our clinical services team. Identity is verified before any record is released, and requests are never routed through the employer.

9. Incident notification

In the event of a personal data breach we will notify the affected individuals, the client organisation and the Data Protection Board of India as required, within the timelines set by applicable law, and provide details of the impact and the remediation taken.

10. Grievance officer

Concerns about the handling of health information can be raised with our grievance officer through the contact details on this site. We acknowledge within two working days and aim to resolve within the period required by applicable law.