Privacy Policy

OH Specialists Hub Ltd

Version 3.0 · September 2026 · UK GDPR Compliant · Replaces Version 2.1 (April 2026)

1. Introduction

OH Specialists Hub Ltd (“we”, “us”, or “our”) is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, store and safeguard your information when you use our occupational health services, our clinical platform, our AI-assisted tools, and the OH Advisor Pro subscription service.

This policy applies to all information collected through our services, including:

• The OH Specialists Hub clinical platform at clinic.ohspecialistshub.co.uk
• The OH Advisor Pro subscription product at ohadvisor.pro
• Susan, the OH Advisor AI assistant, in both its HR and Clinical versions (available within the clinical platform and OH Advisor Pro)
• Our marketing website at ohspecialistshub.co.uk
• Any related services, communications or events

2. Who We Are

Data Controller: OH Specialists Hub Ltd, a private limited company registered in England and Wales (company number 17230362).

Registered office: 4 Haughton Road, Darlington, DL1 1SS

Data Protection Officer: Craig Page RGN DipOH, Director

Email: dpa@ohspecialistshub.co.uk

ICO Registration: ZC115930

If you have any questions or concerns about this Privacy Policy or our data practices, please contact the Data Protection Officer using the details above.

3. Legal Basis for Processing

We process personal data under the following legal bases, as defined by UK GDPR:

• Consent — you have given clear consent for us to process your personal data for a specific purpose
• Contract — processing is necessary to fulfil a contract with you, or to take steps before entering into one
• Legal obligation — processing is necessary to comply with a legal requirement
• Legitimate interests — processing is necessary for our legitimate interests (for example, maintaining the quality and safety of our AI tools), where those interests are not overridden by your rights

For health data and other special category data, we rely on the following additional conditions under Article 9 UK GDPR:

• Article 9(2)(b) — processing necessary for obligations in the field of employment, social security and social protection
• Article 9(2)(a) — explicit consent obtained directly from the individual before assessment (digitally recorded with timestamp and IP address)
• Article 9(2)(h) — processing necessary for the purposes of occupational medicine and the assessment of the working capacity of an employee, carried out by or under the responsibility of a health professional bound by a duty of confidentiality (Data Protection Act 2018, Schedule 1, Part 1, paragraph 2)
• Article 9(2)(f) — processing necessary for legal claims

4. Information We Collect

4.1 Clinical Platform — Employee / Patient Data

When an employer refers an employee for occupational health assessment, we collect:

• Identity data: full name, date of birth, gender
• Contact data: address, email address, telephone number
• Employment data: employer name, job title, role description, hours per week, contract type
• Health data (Special Category — Article 9): medical history, health questionnaire responses, clinical notes, OH assessment findings, fitness-for-work outcomes, recommendations and pre-employment health screening results
• Consent records: digital consent timestamp, IP address, unique consent token, declarations
• Technical data: IP address, browser type and access timestamps for audit logging

4.2 Clinical Platform — Manager / HR Portal Data

When an employer organisation registers and uses the clinical platform, we collect:

• Account data: name, email address, company name, job title
• Organisation profile: sector, headcount, website, telephone
• Data Processing Agreement acceptance: digital signature timestamp, IP address, signatory name and company
• Referral data: employee referral information submitted by the manager
• Payment data: processed by Stripe — we store a Stripe customer ID only; no card data is held on our servers

4.3 OH Advisor Pro — Subscriber Data

OH Advisor Pro is a subscription product available at ohadvisor.pro, separate from the clinical referral service. When you create a subscriber account, we collect:

• Account data: full name, email address, and password (hashed — never stored in plain text)
• Subscription data: product (OH Advisor HR or OH Advisor Clinical), free or paid status, and Stripe subscription ID
• Usage records: a record of each question answered by Susan — which account asked, which product, and when (see Section 11.3)
• Question text: the text of the questions you ask Susan, stored encrypted for 90 days (see Section 11.4)
• Agreement acceptance: digital timestamp and IP address recorded when you sign up
• Affiliate referral code: if you arrived through an affiliate referral link, the referring affiliate’s code is recorded when your account is created (see Section 4.5)
• Technical data: IP address, browser type and login timestamps for security and audit purposes

Subscriber accounts give access to Susan and the features of your plan only. Subscribers have no access to the clinical referral system, patient records, the diary, or any other user’s data.

4.4 Susan (OH Advisor AI) — Questions and Answers

When you ask Susan a question, the text of your question, and the conversation so far in that session, is used to search our occupational health knowledge base (on our own UK server) and is then sent to our AI provider, Anthropic, to generate the answer. Section 11 explains how each version of Susan handles your information, and what we keep.

4.5 Affiliate Programme Data

We operate an affiliate programme for OH Advisor Pro. In connection with it, we collect and process:

• Affiliate partner records: name and email address of the affiliate organisation or contact, and their unique referral code
• Bank account details provided voluntarily by the affiliate for commission payments
• Conversion records: date of conversion, the subscriber linked to the conversion, commission amount and payment status
• Subscriber-side: if you arrive through an affiliate link (?ref=code), the code is stored against your account and used only to attribute commission if you upgrade to a paid plan. The code does not identify you to the affiliate.

Legal basis: contract (affiliate agreement) and legitimate interests (accurate commission attribution and payment). Bank details are used only to make commission payments and are not shared with any third party.

5. How We Use Your Information

• Delivering occupational health services: health assessments, OH management reports, pre-employment screening and fitness-for-work advice
• Service administration: appointments, diary scheduling, consent management and secure communications
• AI-assisted report drafting: OH Advisor Clinical assists the treating clinician in drafting OH reports — clinical judgement remains with the clinician at all times
• OH Advisor Pro: creating and managing subscriber accounts, applying free-plan question limits, processing upgrades through Stripe, and understanding how the service is used
• Quality and safety of Susan: review of stored questions by our lead clinician, to check the accuracy and safety of Susan’s answers and to improve the knowledge base and guidance (see Section 11.4)
• Affiliate programme administration: recording referral conversions, calculating commissions and paying affiliates by bank transfer
• Payment processing: service fees and subscription payments through Stripe
• Legal and regulatory compliance: meeting our obligations under UK GDPR, the Data Protection Act 2018 and applicable employment and health legislation
• Security and audit: access logs with timestamp, user ID and IP address for every clinical data access event

We do not use your information, or the questions you ask Susan, to train AI models. We will never sell your personal information.

6. Third-Party Processors (Sub-processors)

We use the following sub-processors, each bound by data processing terms with equivalent data protection obligations:

DigitalOcean LLC — United Kingdom (London data centre)

Hosts the whole platform: clinical records, OH reports, subscriber accounts, usage records and stored questions. Nightly backups, including an off-site copy in a separate DigitalOcean storage facility, are also held in London. All stored data remains in the UK.

Anthropic, PBC — United States

Provides the AI language model behind Susan and the clinical drafting tools. Questions and drafting content are sent to Anthropic over an encrypted connection to generate a response; Anthropic does not use this data to train its models. International transfer safeguards apply (Section 7).

Brevo SA — France / EU

Transactional email only: sign-in codes, appointment notifications, consent and questionnaire links, welcome and password emails. No clinical or health information is included in any email.

Stripe — United Kingdom / United States

Payment processing for clinical service fees and OH Advisor Pro subscriptions. No health or clinical data is ever shared with Stripe. We store Stripe customer and subscription IDs only; no card data is held on our servers.

Zoho Corporation — European Union (Zoho EU data centre)

Hosts our business email accounts (for example support@ and dpa@). If you email us, your message is held by Zoho in the EU. Transfers to the EU are covered by UK adequacy regulations.

We will notify you of any proposed changes to our sub-processors before they take effect, giving you the opportunity to object.

7. International Data Transfers

All information we store — clinical records, OH reports, subscriber accounts, usage records, stored questions and backups — is held exclusively on UK infrastructure (DigitalOcean, London).

Some information is processed outside the UK by our sub-processors in order to provide the service: the content of Susan questions and AI-assisted drafting (Anthropic, United States), payment processing (Stripe), transactional email (Brevo, EU) and our business email (Zoho, EU). These transfers are protected by appropriate safeguards, including the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and adequacy regulations where they apply.

8. Data Retention

We keep personal information only for as long as necessary for the purposes set out in this Policy and to meet our legal obligations:

• Occupational health records, clinical notes and OH reports: 8 years from the date of assessment, in line with BMA guidance
• Pre-employment health records: 8 years from the date of assessment, whether or not the candidate was employed
• Health surveillance records: up to 40 years where required by occupational health regulation
• Access audit logs: 8 years — these may not be deleted early
• Data Processing Agreement acceptance records: the duration of the business relationship and 8 years afterwards
• Payment records: as required by HMRC and financial regulation (typically 7 years)
• Susan question text: 90 days, then automatically and permanently deleted
• Susan usage records (who asked, which product, when — no question text): 12 months, then automatically deleted
• OH Advisor Pro subscriber accounts: the duration of the subscription and 2 years after account closure, unless the law requires longer
• Affiliate partner records and conversion data: the duration of the affiliate relationship and 7 years afterwards, for financial record-keeping

When a retention period ends, data is securely deleted or anonymised. Backups are kept for a limited period (30 days), so deleted data also leaves our backups within that period.

9. Your Rights Under UK GDPR

• Right of access (Art. 15): request a copy of the personal data we hold about you
• Right to rectification (Art. 16): request correction of inaccurate or incomplete data
• Right to erasure (Art. 17): request deletion of your data — assessed against the 8-year retention obligation for clinical records
• Right to restriction (Art. 18): request that we limit how we process your data
• Right to data portability (Art. 20): request transfer of your data to another provider
• Right to object (Art. 21): object to processing based on legitimate interests, including the review of your stored Susan questions
• Rights related to automated decision-making (Art. 22): Susan provides guidance only and never makes decisions about you

To exercise any of these rights, contact the Data Protection Officer at dpa@ohspecialistshub.co.uk.

You also have the right to complain to the Information Commissioner’s Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF · Tel: 0303 123 1113 · ico.org.uk

10. Security of Your Information

• Encryption at rest: AES-256-GCM encryption of clinical notes, OH reports, health questionnaire data and stored Susan questions before they are saved
• Encryption in transit: TLS for all connections — no unencrypted connections permitted
• Two-step sign-in: every sign-in requires a one-time code sent to your registered email address, in addition to your password
• Sessions: signed-in sessions expire after 8 hours
• Access control: role-based — clinicians access only data for their practice; managers see only their own employees’ data; subscribers access only their own account. Stored Susan questions can be read only by our lead clinician, and every such access is recorded in the audit log
• Audit logging: every clinical data access is logged with timestamp, user ID, IP address and action — retained 8 years
• Database security: an isolated database with no direct external access
• Backups: nightly backups with an off-site copy held separately in London; encrypted fields remain encrypted within backups
• Passwords: hashed using bcrypt — never stored in plain text

No method of electronic transmission or storage is 100% secure. While we take all reasonable measures, we cannot guarantee absolute security.

11. Susan (OH Advisor AI) — Specific Notice

Susan is an AI-powered occupational health advisor built on Anthropic’s Claude models, grounded in our own curated occupational health knowledge base. Susan provides guidance only. She does not make clinical decisions, diagnose, or replace a qualified occupational health professional.

11.1 OH Advisor HR (managers and HR professionals)

• For general occupational health and HR guidance
• You must keep questions anonymous: do not enter employee names, dates of birth, NI numbers, NHS numbers or other identifiers. Describe the situation generically (for example, “a 45-year-old warehouse employee”)
• Do not enter detailed medical information about an identifiable employee
• Question text is stored for 90 days for quality review (Section 11.4)
• Answers are informational only and do not constitute clinical advice or an OH assessment

11.2 OH Advisor Clinical (occupational health professionals)

• For qualified occupational health practitioners, including for clinical guidance, note structuring and report drafting
• Practitioners may include case-specific clinical information in their questions where this is necessary for the case. The platform is designed to protect this information: it is encrypted in storage, held in the UK, and accessible only as described in this Policy
• When you include information about your own clients or patients, you remain responsible, as their healthcare professional, for having a lawful basis to use it and for telling them that you use AI-assisted tools in their care. We process that information on your behalf to provide the answer, and for the quality review described in Section 11.4
• We recommend including only the information needed for the question, and leaving out names and other direct identifiers where they are not needed
• Clinical judgement, accuracy and professional responsibility for any use of Susan’s output remain with the practitioner
• Within our own clinical service, Susan is used by our treating clinician under the same safeguards, and all AI-assisted reports are reviewed and approved by the clinician before release to an employer

11.3 Usage Records and Question Limits

Free plans include 10 questions per calendar month. For every subscriber, free or paid, we record each question that Susan answers: which account asked, whether it was HR or Clinical, and when. The record does not include the question. We use these records to apply the free-plan limit, manage your account and plan, and understand how the service is used. They are kept for 12 months.

11.4 Stored Questions and Quality Review

• We store the text of the questions you ask Susan for 90 days, then delete them automatically
• Stored questions are encrypted and can be read only by our lead clinician, a registered nurse bound by professional confidentiality. Every access is recorded in our audit log
• We use them solely to check the accuracy and safety of Susan’s answers, and to improve our knowledge base and guidance
• Stored questions are never shared with employers or any other party, never used for marketing, and never used to train AI models
• You can ask us to delete your stored questions at any time by contacting dpa@ohspecialistshub.co.uk

12. Children’s Privacy

Our services are not directed at individuals under 16. We do not knowingly collect personal information from children under 16 without verified parental or guardian consent. Where a pre-employment medical is carried out for someone aged 16 or 17, additional consent safeguards apply.

13. Cookies

The clinical platform and the OH Advisor Pro portal use only what is strictly necessary to keep you signed in securely. We do not use analytics or advertising cookies on the clinical platform or on ohadvisor.pro.

On ohadvisor.pro, with your permission, we set one functional cookie, ohsh_affiliate, when you arrive through an affiliate referral link. It stores the affiliate’s reference code only, lasts 30 days, and is used solely to credit the affiliate if you upgrade to a paid plan. See our Cookie Policy for details.

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technology or legal requirements. We will notify registered users of material changes by email and by posting the updated Policy on our websites. The version and date at the top of this Policy show when it was last revised.

15. Contact Us

OH Specialists Hub Ltd — Data Protection Officer: Craig Page RGN DipOH

4 Haughton Road, Darlington, DL1 1SS

Email: dpa@ohspecialistshub.co.uk

By using our services, you acknowledge that you have read and understood this Privacy Policy.