Privacy Policy

Who We Are and What We Do

Workplace GP is a UK-based provider of employee healthcare benefit plans. We provide the platform and administrative framework that connects members of Workplace GP's employee healthcare benefit plans ("Enrolled Members") with private healthcare services, including digital GP consultations, employee assistance programmes, private specialists and online health masterclasses.

Important Note: Workplace GP is a facilitator of access to third party services. Workplace GP does not provide any clinical or medical services to any Enrolled Member under Workplace GP's employee healthcare benefit plans. The online health masterclasses delivered by Workplace GP provide general health information for educational purposes only. While we aim to ensure this information is accurate and up to date, it is not a substitute for personalised medical advice from a doctor or other qualified healthcare professional.

All clinical consultations and other clinical or medical services are delivered directly to Enrolled Members by third party regulated clinical or medical providers, whose identities are set out below ("Third Party Providers"). All medical records and any "Special Category Data" (health information) shared during a consultation, or during the delivery of any other medical or clinical service accessed by any Enrolled Member from a Third Party Provider, are held strictly by the applicable Third Party Provider under medical confidentiality and such personal data will be processed under the privacy policy of that Third Party Provider.

We encourage all Enrolled Members to read and review the privacy policy of each Third Party Provider who provides services to such Enrolled Members. Workplace GP does not collect or have access to clinical records or consultation notes held by these providers. We do not request health information when administering employee benefits and are not set up to handle personal medical enquiries. Please do not include personal medical details in enquiries, support requests or masterclass questions. If you share health information with us despite this, we will not use it and will delete it. Any questions about your individual health or treatment should be directed to the relevant Third Party Provider or your own healthcare professional.

The Third Party Providers:

The identities of the Third Party Providers of services accessed via Workplace GP's healthcare benefit plans are set out below. Such details will be updated in the event of any change to any of the Third Party Providers.

• Doctor Care Anywhere Limited, 19-21 Great Portland Street, Mayfair, London, W1W 8QB – provides remote video and phone consultations with GPs, Mental Health Practitioners, Physiotherapists, Nurses, and Advanced Clinical Practitioners.
• PAM Wellness Limited, 9 Lakeside Drive (also known as 820 Mandarin Court), Centre Park, Warrington, England, WA1 1GG – provides an employee assistance programme, including a 24/7 helpline, counselling, and legal, debt and family guidance.
• GetWellSoon Ltd, Suite 320 Trigate House, Hagley Road West, Birmingham, England, B68 0NP – enables Enrolled Members to find and book consultations with private specialists, at the Enrolled Member's own cost.

Identity of Data Controller

Workplace GP is the data controller of the information that we collect about you. Workplace GP is a company registered in England and Wales.

• Company Number: 16829734
• Registered Office: 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom.
• ICO Registration: Workplace GP Ltd is registered with the Information Commissioner's Office (ICO) as a data controller under registration number ZC107881.

Each Third Party Provider is the data controller of the information that the relevant Third Party Provider collects and processes about Enrolled Members in the course of providing services to such Enrolled Members. Where permitted by the relevant Third Party Provider and included in the applicable Workplace GP plan, Enrolled Members may access certain services for the benefit of eligible family members and dependants, including children under the age of 18. Any personal data relating to the family and dependants (including children) of Enrolled Members is collected and processed by the applicable Third Party Provider and each Third Party Provider is the data controller in respect of such personal data. We encourage all Enrolled Members to read and review the data protection or privacy policy of each Third Party Provider who provides services to Enrolled Members and/or the family and dependants (including children) of Enrolled Members.

Information We Collect

We collect the following "standard" personal data necessary to manage Workplace GP's employee healthcare benefit plans:

• Identity Data: Name.
• Contact Data: Business email address (to enable Enrolled Members to be contacted about their benefit plan and to inform and update Enrolled Members about the services that can be accessed via their benefit plan).
• Employment Data: The name and identity of the employer of an Enrolled Member (to link each Enrolled Member to the correct healthcare benefit plan).
• Service Utilisation data: Anonymous data about the utilisation of services offered via our healthcare benefit plans.
• Usage Data: Information on how Enrolled Members interact with our website and with our online information portal for Enrolled Members (the "Member Portal") and access our online health masterclasses.

We also collect personal data when a person interacts with our website or contacts us to make an enquiry about our services via our website enquiry forms, by email or telephone or otherwise. This personal data includes:

• Identity Data and Contact Data: The name and contact details of the person who has contacted us, to enable us to respond to their enquiry and, if the enquiry relates to Workplace GP's employee healthcare benefit plans, to provide information to that person about Workplace GP's employee healthcare benefit plans.
• Usage Data: Information on how visitors to our website interact with our website.

We collect personal data from and about you through:

• Your interactions with us, when you provide your personal data to us, for example, for the purposes of becoming an Enrolled Member or for the purposes of making an enquiry.
• Your employer, who will provide personal data about you to us when you choose to become an Enrolled Member.
• Referrals, when an employee of your organisation refers it to us through our referral programme and names you as the best person to contact. When we first contact you, we will tell you that you were referred to us and how to opt out of further contact.
• Enquiry forms within our online adverts, such as Google Ads lead forms, when you choose to send us your details.
• Automated technologies and interactions, when you interact with our website, through the use of cookies. Please see our Cookies Policy here.

Business contact information: We collect names, job titles, employer or business names, business email addresses and other business contact details of prospective customers. We obtain this information directly from individuals, through business networking, introductions and referrals, and from sources such as company websites and business directories, including membership directories.

How We Use Your Information

• To verify your eligibility for the healthcare plan provided via an Enrolled Member's employer.
• To grant Enrolled Members access to our Member Portal and online health masterclasses.
• We receive anonymised, aggregated usage information from the Third Party Providers, and we may share anonymised, aggregated usage reports with your employer. We never share identifying data regarding who used a service or the nature of their medical concerns, and we do not report usage where numbers are small enough that an individual could be identified.
• To respond to your enquiries, including to provide information about and to promote Workplace GP's employee healthcare benefit plans in response to an enquiry made by you.
• To understand how visitors find our website, including which online adverts brought them to it, so we can improve our marketing.
• If you refer your employer through our referral programme, we use your name and email address to manage your referral and, if your employer joins, to send you your voucher. We use the details you give us about your employer and the contact person you name to get in touch with that person about our employee healthcare benefit plans.

The Third Party Providers will require Enrolled Members to sign up to the Third Party Provider's own terms and conditions relating to the provision of their services to Enrolled Members and they may require Enrolled Members to provide further personal data relating to the provision of those services. Such further personal data is provided directly by you to the Third Party Providers and is not shared with Workplace GP. Each Third Party Provider will be the data controller in respect of any additional personal data that you provide to them and will process such personal data in accordance with their own Privacy Policy.

We use business contact information to contact prospective customers about Workplace GP's employee healthcare benefit plans, follow up on enquiries and develop business relationships. You can ask us to stop sending marketing communications at any time by using any unsubscribe option provided, replying to our message or contacting privacy@workplacegp.co.uk.

Basis of Lawful Processing

The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following legal bases:

• Legitimate interests — administering employee benefits: We use Enrolled Members' identity, contact and employment information where necessary for our legitimate interests and those of their employers in administering employee healthcare benefit plans. This includes verifying eligibility, managing enrolment, arranging access to included services, providing access to the Member Portal and online health masterclasses, and sending essential communications about membership. We rely on this basis only where these interests are not overridden by the individual's interests, rights or freedoms.
• Legitimate interests — enquiries and security: We use personal information where necessary to respond to enquiries, manage our business relationships, protect our systems and prevent fraud, provided these interests are not overridden by the individual's interests, rights or freedoms.
• Legitimate interests — business marketing: Where permitted by law, we use business contact information for our legitimate interest in promoting our employee healthcare benefit plans to relevant business contacts, provided this interest is not overridden by the individual's interests, rights or freedoms. Where consent is required for a particular marketing activity, we obtain it before sending marketing communications.
• Legal obligation: To comply with UK tax, accounting, and regulatory requirements or for compliance with any other legal obligation that we are subject to.
• Consent: We rely on consent only where we have obtained your active agreement to use your personal data for a specific purpose, including our use of analytics cookies to understand how visitors use our website and which adverts brought them to it. You can withdraw this consent at any time using "Cookie Settings" in our website footer.

Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Our website forms use Google reCAPTCHA to protect against spam and abuse. reCAPTCHA collects information about your device and how you interact with the form, which is sent to Google.

Data Retention

We retain your administrative data for as long as you are an active Enrolled Member of a Workplace GP employee benefit plan. Once your membership ends, we retain minimal data for up to six years to satisfy legal, accounting, and reporting requirements.

We retain prospect contact information for as long as reasonably necessary to pursue relevant business opportunities, taking account of our interactions and whether the information remains current. We periodically review these records and delete information we no longer need. If you opt out of marketing, we retain the minimum information needed to ensure that we respect your preference.

Website analytics data is retained in Google Analytics for 14 months.

Sharing Your Personal Data

Third Party Providers: We do not share your personal data with the Third Party Providers. We provide them only with your employer's name, the number of members covered and the dates of your employer's plan. You access each service using an access code and provide your details directly to the Third Party Provider when you register with them.

We only share your data with:

• Service Providers: Third-party companies that provide IT, hosting, system administration, email, CRM and website form services, website analytics, spam protection (Google reCAPTCHA) and webinar services for our masterclasses.
• Regulatory Bodies: If required by law or to protect our legal rights.
• Business Transfers: If we sell or transfer all or part of our business, we may share personal data with the prospective buyer and their advisers, under obligations of confidentiality, and personal data may transfer to the new owner.

We do not sell, rent or trade your personal data to third parties for marketing purposes.

International Transfers

The Third Party Providers are based in the UK. Some of our technology and service providers, such as our CRM and webinar providers, store or process personal data outside the UK. Where personal data is transferred outside the UK, we ensure that the transfer is covered by applicable adequacy regulations or appropriate safeguards required by UK data protection law.

Your Legal Rights

Requests relating to your consultation, counselling or other service records must be made to the relevant Third Party Provider, as they are the data controller of that information. If you send us a request relating to information held by a Third Party Provider, we will let you know and direct you to them. For example, subject access requests to PAM Wellness can be sent to sar@pamgroup.co.uk.

You have a number of rights under data protection laws in relation to your personal data.

You have the right to:

• Request access to your personal data (commonly known as a "subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data in certain circumstances. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object.
• You also have the absolute right to object any time to the processing of your personal data for direct marketing purposes.
• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in certain circumstances.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

If you have any questions about this Privacy Policy or about the use of your personal data or you want to exercise your privacy rights, please contact privacy@workplacegp.co.uk.

If you are unhappy with how we have handled your personal data, you have the right to complain to us. Please contact privacy@workplacegp.co.uk. We will acknowledge your complaint within 30 days, investigate it and tell you the outcome without undue delay.

You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk).

Changes to the privacy policy and your duty to inform us of changes

We keep our Privacy Policy under regular review and we will notify Enrolled Members of any material changes by email.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.

Third-party links

This website, or the websites of Third Party Providers, may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control the websites of the Third Party Providers or other third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.