Roles
Before contracting, confirm who is controller or processor for booking data, health-surveillance outcomes and confidential medical records. These roles may differ across the service pathway.
Data flows
Document how employee lists are transferred, how appointments are arranged, where results and records are stored, who receives employer outcomes and how clinical referrals are handled.
Security and retention
Agree access controls, encryption, incident management, subprocessors, international transfers, retention and secure deletion. COSHH health-record retention must not be confused with retention of all clinical or administrative data.
Contracting
A suitable services agreement and, where required, data-processing terms should reflect the verified operational model.
Business identity, service operations and legal basis must be verified before this page is treated as final.