Data protection & GDPR

How we handle personal data

When an employer refers an employee to us, we collect only what we need to carry out the assessment: things like the employee's name and contact details, their role and workplace context, and health information relevant to supporting them at work. We process this in line with UK GDPR and guidance from the Information Commissioner's Office (ICO).

How special category (health) data is protected

Health information is “special category” data under UK GDPR and gets extra protection. We only collect health information that's relevant to the workplace assessment, we restrict who can see it, and our reports focus on the practical impact on someone's role and the recommendations, not unnecessary clinical or personal detail.

Employee consent

Assessments take place with the employee's knowledge and consent. The employee is told what the assessment is for, what will be shared, and with whom. Where a report is produced, the process respects the employee's right to understand and engage with what is being recommended. Consent and key steps are recorded so there is a clear, auditable trail.

Our GDPR commitments

• We have a lawful basis for everything we do with personal data.
• We're transparent about what we collect and why.
• We keep data accurate and only for as long as it's needed.
• We keep it secure and limit who can access it.
• We respect your data-protection rights (see below).

Data minimisation

We ask for the minimum information needed to do the job well. We don't collect health detail “just in case”, and our reports are written to be useful to an employer while sharing only what's necessary to support the employee at work.

Secure storage

Personal and health data is stored on secure, access-controlled UK/EU cloud infrastructure. Access is limited to those who need it, every action on a case is logged, and files (such as assessment reports) are held in protected storage rather than sent around by email.

Clinician confidentiality

Every assessment is carried out by a clinician registered with a UK statutory regulator (such as the HCPC or NMC) or an accredited register (such as the BABCP). They are bound by their professional code of conduct and strict confidentiality obligations, in addition to the contractual confidentiality terms they agree with Return Well.

Retention periods

We keep case data only for as long as it's needed, then delete it. Retention periods are set according to our Data Retention Policy and the relevant legal and professional requirements. They are configurable and reviewed, not arbitrary. For example, a closed clinical case is currently retained for 7 years from the date the case is closed:

• Case closed: 01/07/2026
• Retention period: 7 years
• Scheduled deletion: 01/07/2033

Retention expiry dates

When a case is formally closed, the system automatically calculates its retention-expiry date from the applicable rule. Active or open cases are never deleted, the retention clock only starts once a case is closed.

Legal hold

Sometimes data must be kept beyond its normal retention date, for example because of a complaint, dispute, legal claim, insurance matter, ICO enquiry, tribunal, or safeguarding concern. In those cases we can place a record on legal hold, which pauses deletion until the hold is lifted. Nothing on legal hold is deleted.

Secure deletion

When a record reaches its retention-expiry date, it moves into a 30-day “pending deletion” window before personal data is removed from our live systems, including health information, assessment reports, attachments and correspondence. Backup copies are removed separately, within a further 30 days — see below. After deletion we keep a permanent Deletion Register that records that deletion took place (case reference, dates, and method) but contains no personal or health information. This lets us prove we follow our retention policy without keeping data we no longer need.

Backups

We take a nightly backup of our database and of uploaded files — assessment reports, case attachments, and clinicians' compliance documents. Backups exist so that a technical fault or a mistake cannot permanently destroy records people depend on, and they are held in private storage under the same access controls as the live system.

A backup is, by design, a copy of data as it was. That means a file deleted from our live systems still exists in the backup for a short period afterwards. We do not leave it there indefinitely: the backup is checked each night, and a copy whose original has been deleted is removed within 30 days. So the outside limit for any record is its retention period, plus up to 30 days pending deletion, plus up to 30 days in backup.

We keep that window deliberately, rather than deleting both copies at once. The failure a backup exists to survive is an erroneous deletion, and a backup erased by the same action that caused it is no backup at all. Thirty days is long enough to notice and recover from a mistake, and short enough to give a definite answer to how long deleted data can persist.

Your rights

You have rights over your personal data, including the right to access it, correct it, or ask us to delete it (subject to our legal obligations). To exercise any of these, contact us at support@returnwell.co.uk.

Questions?

If you have any questions about how we handle data, or you'd like a copy of our Data Retention Policy, please get in touch, we're happy to help.