Purpose limitation
Collect only what is necessary for a specific, explained wellbeing purpose; do not quietly reuse it for employment decisions.
Employee consent, privacy and wellbeing screening
A plain-English framework for genuine choice, health information, employer reporting and responsible boundaries in workplace wellbeing services.
Reviewed 24 August 2026
Privacy is part of the intervention
Employees are unlikely to engage honestly if they believe personal wellbeing information may reach a manager, affect their career or be used for an unstated purpose. Every workplace service therefore begins with a written explanation of who is responsible for data, what is collected, why it is needed, who can access it, how long it is kept and how a person can ask questions or exercise their rights.
Information about physical or mental health is special-category personal data under UK GDPR. It requires an Article 6 lawful basis, an Article 9 condition and appropriate safeguards. In employment, consent can be difficult because of the imbalance of power. It should not be treated as freely given where refusing may carry a real or perceived disadvantage.
Four minimum protections
Genuine participation choice
Provide a meaningful alternative and ensure declining, pausing or withdrawing does not trigger disadvantage or a demand for explanation.
Separation of information
Keep individual practitioner notes and outputs outside routine employer access, with technical and organisational controls.
Safe reporting
Use aggregated themes, minimum group sizes and suppression where a combination of details could identify a participant.
What managers should and should not receive
A manager may receive an agreed programme summary: themes affecting the workforce, practical work-design recommendations and high-level uptake where disclosure risk is controlled. They should not receive named screening scores, ECG results, aura images, consultation notes, medical histories or assumptions about an employee’s diagnosis or capability.
If an individual wants a particular adjustment or referral supported, the information to be shared is agreed specifically with that person. Safeguarding or immediate-risk situations may create different duties, which must be explained honestly rather than hidden behind an absolute promise of confidentiality.
Technology and automated decisions
Devices, apps and questionnaires can produce persuasive-looking scores. An output should not be used as a solely automated employment decision or treated as objectively true without understanding validity, error, context and bias. A data-protection impact assessment may be required where monitoring or health-data processing is likely to create high risk.
Vendors and subcontractors, international transfers, device security, retention and deletion must be checked before launch. An employer should not collect more data simply because a platform makes collection easy.
Official guidance and scope
- ICO: data protection and workers’ health information
- ICO: carrying out health monitoring
- ICO: monitoring workers
This page explains our service design, not legal advice. The commissioning organisation should obtain its own data-protection, employment and clinical-governance advice where required.
Start with the safeguards, not the technology
We can help shape a proportionate wellbeing brief and identify the privacy questions that must be answered before delivery.