Website Privacy, Cookie Control & Security Policy

This is the privacy notice for CBH and it explains how we use any personal information we collect about you.

Who is this privacy notice from?

What information do we collect about you?

Our legal basis for processing your data

Our legal basis for processing your data - Constructing Better Health (CBH)

Marketing and managing your preferences

How we share your information

Security and safe storage of your personal information

Your rights as a data subject

Changes to our privacy notice

Complaints

Contact us


Who is this privacy notice from?

 

‘We’, Constructing Better Health Ltd. (CBH) is a not-for-profit scheme dedicated to improving the standard of occupational health (OH) management in the construction industry. It is owned by B&CE Holdings Limited (B&CE), another not-for-profit company which has been providing employee benefits to the construction industry for over 75 years.


CBH is a national scheme that has been set up to improve construction workers health, by setting industry standards and building a database for the outcome of workers health surveillance to be stored. Construction Health Action Toolkit (CHAT2) database is the industry database of employee data maintained by CBH and sourced from Occupational Health Service Providers (OHSPs) and members using the CBH Construction Health Action Tool (CHAT2) software tool for the purposes of uploading member's individual employees' data, including but not limited to clinical data and “fit for task” data of member's individual employees.


The CBH national database and card scheme brings employee fit-for-task data to site level and will allow contractors to manage their health and safety requirements.


As a member of the CBH scheme or Occupational Health Service Provider (OHSP) CBH collects and stores information and personal data about you. The purpose of this privacy notice is to explain how we use any personal data we collect from you or that you provide to us. If you use our website or web-based services, you may also be interested in our Cookies Policy. This policy applies to our website, product and services.


We are registered with the Information Commissioner as a data controller and are responsible for the way your data is stored and used – and for how long. Our Data Protection Officer is B&CE’s Group Director of Business Assurance.


We have developed procedures and policies to ensure the protection of the data we hold, and we adhere to a data protection policy.

 
 

What information do we collect about you?

Information you give us
If you are a corporate member of the CBH scheme (Contractor, SME, self-employed) the information you give us may include:
  • Name of a primary contact
  • Job title
  • Company name and address
  • Contact details: phone numbers, email address, website address
  • Name of contact for invoices along with contact details
  • Company information: staff number, annual turnover, registration numbers
  • Current OH provider
If you have applied for independent membership of the CBH scheme (Companies that have a number of employees who may need to work periodically on-site but is not their main job function) we will also need to collect the following for each member:
  • Name
  • Address
  • Date of Birth
  • National Insurance number
  • Job role
We also collect the following special category data as this may provide you with a discounted membership rate:
  • Trade Association membership
If you are an Occupational Health Service Provider (OHSP) the information you give us may include:
  • Primary contact
  • Business name
  • Business address
  • Contact details – phone numbers and email
We may receive personal information about you when you contact CBH by doing any of the following:
  • Registering to become an accredited Occupational Health Service Provider with us
  • Applying for employer membership to the CBH scheme
  • Contacting us via our website, social media, webchat, phone, email, post or otherwise
  • Taking part in market research such as surveys and questionnaires
  • Attending worksite presentations, roadshows or other events

Information we receive from other sources
If you are an employee of a CBH member company, we may receive personal information about you from employer members and Occupational Health Service Providers (OHSPs) who may upload your data for the purposes of a health assessment onto the CBH database. The information we receive may include:

  • Name
  • NI number
  • Date of birth
  • CHAT system identifiable number
  • Job role

The special categories of data we may collect about you are as follows:

  • racial/ethnic origin
  • physical or mental health, and other medical information
     

Our Legal basis for processing your data

Data protection law says that we are allowed to use personal information only if we have a proper reason to do so. This includes sharing it outside of CBH and the B&CE Group.
The law says we must have one or more of these reasons:
  • To carry out our obligations under any contracts between you and us or your employer, or
  • When it is our legal duty, or
  • When it is in our legitimate interest, or
  • When you consent to it.

When we have a business or commercial reason of our own to use your information, this is called a ‘legitimate interest’. We will tell you what that is, if we are going to rely on it as the reason for using your data. Even then, it must not unfairly go against your interests.

For employers and OHSPs we use your personal data:

  • To register you as an approved and CBH accredited provider of occupational health services to the construction industry and for publication on the CBH website to give ease of access to employers in the construction industry wanting to contact OHSPs.
  • To provide you with membership to the CBH scheme and to share with an accredited provider of OH provision
  • To allow you limited access, as a member of the scheme to the CBH database to see outcomes of different work- related health checks on your employees
  • To allow you, as a fully accredited OHSP to have secure database access to the health check outcomes and clinical results of a previously assessed individual
  • To send you CBH updates and inform you of events we may be planning

For employees the personal data we receive will be stored and maintained on our occupational health work-related database for the following purposes:

  • holding information centrally so that your health check results do not get lost as you move around jobs and to prove that you have been cleared to do certain types of work
  • collecting results and using them anonymously to do reports for research purposes, or produce industry statistics to help with the prevention of construction related illnesses
  • OHSPs upload the clinical results of your health surveillance onto the CBH database for access to or future downloading by other Occupational Health Practitioners to facilitate the monitoring of your health status
  • For non-clinical outcomes of the health assessment/surveillance to be made available to future employers/site managers, in terms of medical suitability for specific duties
          

Our legal basis for processing your data - Constructing Better Health (CBH)

How we may use your personal data
Our reason
Our legitimate interest
Providing you with a service or product
·         To manage our relationship with you or your business
 
·         To administer your application, account and process your request and queries
 
·         To give you information about products and services we offer that are similar to and complement our current offering to you
 
·         To communicate with you about other products and services
 
·         To keep your details updated
 
 
• Your consent
• Fulfilling contracts
• Our legitimate interests
• Our legal duty
·         Keeping our records up to date
 
·         Working out which of our products and services may interest you and telling you about them and understanding your needs
 
·         Seeking your consent when we need it to contact you
 
·         Tailor our communication to make them relevant and of interest to you
Business improvement
·         For training purposes, to improve our services for example by recording telephone calls
 
·         To monitor and improve the service we offer to you and our customers’ experience and study how our customers use our products and services.
 
·         Fulfilling contracts
·         Our legitimate interests
 
 
·         To enhance the service we provide to you. 
Business operations
As part of our business processes and relevant activities. These include auditing, business planning, accounting and transactions.
·         Fulfilling contracts
·         Our legitimate interests
·         Our legal duty
·         Being efficient about how we fulfil our contractual duties
·        
 Complying with rules and guidance from regulators
Managing security, risk and crime prevention
·         Sharing information as required to comply with judicial proceedings, court orders or legal process and to detect, investigate, report and seek to prevent financial crime
 
·         To verify your identity and carry out anti-fraud checks.
 
·         To obey laws and regulations that apply to us
 
 
·         Fulfilling contracts
·         Our legitimate interests
·         Our legal duty
·         Developing and improving how we deal with financial crime, as well as doing our legal duties in this respect.
·        
Complying with rules and guidance from regulators.
For processing special categories of personal data
·         To verify your identity and carry out anti-fraud checks.
 
·         Maintaining your health surveillance results on our occupational health work -related database
 
 
·         Sharing information as required for regulatory or legal purposes
 
 
·         Using health information as needed to provide you with our service and as necessary for the purposes of supporting the provision of occupational medicine and the assessment of working capacity of the employee.
 
·         With your consent.
 
 
·         To help prevent and detect unlawful acts and fraudulent behaviour.
 
·         Our legal duty.
 
 

Marketing and managing your preferences

CBH and B&CE will only use your personal data to manage your products or services and to communicate with you about information that may be of interest.

However, CBH and B&CE would like to contact you with details of other products or services it provides.

CBH and B&CE aim to ensure you only receive communications about information that is of interest to you or that enhances our services to you. If you are an employer or an OHSP you can choose to receive these types of communications in your Preference Centre. If you are a construction employee, you can call us on 0345 8737726.

The above contact method can also be used if you wish to advise us that you no longer want to receive non-statutory or marketing communications. You may also be able to opt out of certain data-processing activities such as research and data analysis.
 

How we share your information

If you are an employer or OHSP:

We may share or disclose personal information when necessary to provide our services or conduct our business operations.


When we share personal information, we do so in accordance with data privacy and security requirements. Below are the parties with whom we may share personal information and why.

Within the B&CE group of companies: Personal information may be shared with other companies in the B&CE group. This allows us to efficiently provide administration, customer and technical support, marketing and business and product development. All of our employees and contractors are required to follow our data privacy and security policies when handling personal information.


Our third-party service providers: Personal information is provided to these parties when necessary to fulfil the services they provide to us. This includes: software, systems, and platform support; print and mailing services; data quality services; archiving and destruction services; auditors and actuaries; cloud hosting services and data analytics. Our third-party service providers are not permitted to share or use personal information we make available to them for any other purpose than to provide services to us, and when we outsource any process we ensure that any supplier or contractor has adequate security measures in place. 


Third parties for legal reasons: We will share personal information when we believe it is required, to comply with legal obligations and respond to requests from government agencies, including law enforcement and other public authorities such as regulators.


Third parties with your consent: We will share your contact details to allow accredited OHSPs and members to contact each other.
 

If you are an employee:


Below are the parties with whom we may share personal information and why:


Your employer/future employer: Your employer cannot access the medical part of the database, but what they will see, via a secure log in, is the outcome of your health check, a bit like an electronic version of a fitness certificate the OHSP would provide to your manager following your health check. This means that your manager, regardless of which site you are working on can ensure you are not exposed to anything that will affect your health, by putting in the correct preventative measures. Your employer has a legal duty under the Health and Safety at Work Act to provide you with a healthy and safe place to work.


Under no circumstances will your employer or a site manager be able to see your medical information as this is confidential between you and the medical professional. The information that your employer or site manager is able to receive is that you have had your health check, how long it remains valid for and your medical suitability to undertake the specific tasks in your job role.


Accredited Occupation Health Service providers: Some health checks need to be carried out regularly and may need to be compared with previous ones so that they can be checked to ensure that they only change as expected rather than an unexpected change which could indicate work related ill health. Retaining data on the CBH database helps future accredited OHSPs who are carrying out your health checks to retrieve past results.

Within the B&CE group of companies: Personal information may be shared with other companies in the B&CE group. This allows us to efficiently provide administration and customer and technical support. All of our employees and contractors are required to follow our data privacy and security policies when handling personal information.


Our third-party service providers: Personal information is provided to these parties when necessary to fulfil the services they provide to us. This includes: software, systems, and platform support; print and mailing services; archiving and destruction services; auditors and actuaries; cloud hosting services and data analytics. Our third-party service providers are not permitted to share or use personal information we make available to them for any other purpose than to provide services to us, and when we outsource any process we ensure that any supplier or contractor has adequate security measures in place.


Third parties for legal reasons: We will share personal information when we believe it is required, to comply with legal obligations and respond to requests from government agencies, including law enforcement and other public authorities such as regulators.
 

Security and safe storage of your personal information

The data that we collect from you will be stored and processed within the United Kingdom and Europe. The data that we collect from you may also be transferred to, stored and processed at a destination outside the European Economic Area (EEA) by us, our group companies, or our third party administrators. If we do transfer your personal data outside of the EEA we will make sure it is protected to the same extent as in the EEA such as:
  • Transfer it to a non-EEA country with privacy laws that give the same protection as the EEA.
  • Put in place a contract with the recipient that they protect it to the same standards as the EEA.

We hold data in various forms, including electronic databases and paper files. We take all reasonable steps necessary to ensure that your data is adequately protected and processed in accordance with this Privacy notice.


We take data security seriously, and we use appropriate technologies and procedures to protect personal information. Our information security policies and procedures are closely aligned with widely accepted international standards and are reviewed regularly and updated as necessary to meet our business needs, changes in technology, and regulatory requirements.


We will retain and process your personal information for as long as you are a member or accredited OHSP of the CBH scheme. When the relationship comes to an end personal data will be archived for one year and then deleted. Employee personal data will also be deleted after 1 year if there is no health record attached, where a health record is attached to a members’ employee data this data will be held on our system for 40 years.


When we no longer need personal information, data will be disposed of in line with approved company processes to ensure all reasonable efforts and precautions are taken to protect the confidentiality of the data.

Your rights as a data subject

 
Right of access - You have a right to request a copy of all the personal information we hold about you, and to establish the purposes we process your data for, and who we share your personal data with. This is known as a Subject Access Request. To submit a request please write to us, using the contact details at the bottom of this notice. Before we provide any information, we’ll ask you for proof of identity and information about your interaction with us.

Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete. We want to make sure your personal information is accurate and up-to-date. You’re able to correct the information we hold about you by contacting us using the contact details at the bottom of this policy.

Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our record. If the processing is necessary for the purposes of occupational medicine to assess the working capacity of an employee the right to be forgotten will not apply.

Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.

Right of portability – you have the right to have the data we hold about you transferred to another organisation.

Right to object – you have the right to object to certain types of processing such as direct marketing, data analysis. You can also withdraw consent where this has been provided. You can do this by setting your preferences or by contacting us.
All of the above requests will be forwarded on should there be a third party involved in the processing of your data.
 

Changes to our Privacy notice

This policy was last updated 25 May 2018. We may amend this notice from time to time to keep it up to date or to comply with legal requirements.

 

Complaints

In the event that you wish to make a complaint about how your personal data is being processed by CBH or by our third parties, you have the right to lodge a complaint directly with the supervisory authority, The Information Commissioner (ICO - link) who can be contacted on 0303 123 113, and/or you can complain to the Data Protection Officer of the B&CE Group.
 

Contact us

You can write to us at CBH, Manor Royal, Crawley, West Sussex, RH10 9QP
Please email info@cbhscheme.co.uk or phone 0345 8737726
 
 

 

Useful Links Contractors Occupational Health Service Providers Employees Clients Affiliates