Privacy and cookie policy

Fit for Work Scotland (FFWS) is delivered by NHSScotland on behalf of the Department of Work and Pensions (DWP).

This policy outlines what data we collect about you when you access the service, how we store this data securely and who we share it with. This policy is compliant with the Data Protection Act 1998 (DPA), and we're committed to compliance procedures that demonstrate this.

Data collection
Data storage
Data sharing
Data protection and security
Accessing your data
Audit and evaluation of the service
Cookies policy
Contact us

Data collection

FFWS operates an advice and assessment service to support people back to work. The types of data we collect will depend on how you access and interact with the service.

FFWS deals with personal and sensitive data, as classified under the DPA.

Advice service

The advice service is provided through the FFWS website and a telephone advice line.

If you phone the advice line, or use our contact form, we will record your:

  • Name
  • Telephone number
  • Email address

Assessment service

To access the assessment service, an individual must be referred by their employer, or GP. Consent for this referral must be obtained from the individual.

A referral can be made using our online referral form, and we'll record the following to help with the assessment:

Employer details

  • Company name
  • Name of the person making the referral
  • Email address
  • Unique Tax Reference
  • Details of occupational health already provided

Employee details

  • Name of the employee
  • Address
  • Date of birth
  • Contact telephone number
  • Email address

Conditions and requirements

  • The employee's reason for being off work as noted on their fit note
  • Date of absence
  • End date of their current fit note
  • Additional support requirements
  • Employee's top 5 daily activities
  • Employee's normal working hours
  • Any specific occupational health questions relating to the employee

This service is managed by Salus Occupational Health / NHS Lanarkshire on behalf of FFWS.

Return to work plan

Following an assessment, a return to work plan (RTWP) will be created. We'll share this plan with the employee and, if the employee gives their consent, their GP and employer.

During the assessment, and in addition to the data already collected through the referral process, we'll collect the following to help create a RTWP:

  • Condition causing their absence from work, and the impact this has on their ability to do their job
  • The assessor’s assessment, and recommendations for the individual
  • The assessor’s recommendations
  • How long this assessment applies for
  • The individual’s current circumstances in relation to disability provisions of the Equality Act 2010
  • Details of any specific queries raised by the referrer, and the assessor’s response to these queries
  • Details of the employee’s consent to share the RTWP with their employer
  • Details of the employee’s consent for further contact with the service and, if applicable, when this is to take place
  • The assessor’s name and date of the assessment.


During the assessment, we use an individual's Community Health Index (CHI) number to identify and track them through the process. This number is recorded internally by NHSScotland prior to the initial assessment.

Data storage

Any data we collect will be stored securely in an NHSScotland database, which has been formally risk assessed and accredited in accordance with the DPA. No third party will have access to this.

This data will be kept no longer than is necessary and reasonable to do so. After this period, the data will be deleted.

Loss and misuse of data

We take reasonable technical and organisational precautions to prevent the loss, misuse or alteration of your personal data.

Data sharing

Any data we collect will only be shared for the purpose of:

  • Sharing an individual's return to work plan
  • Auditing and evaluating the service
  • Monitoring the performance of the service.

Sharing a RTWP

An individual will be asked if they wish to give their consent for their RTWP to be shared with their employer and GP. Only if consent is explicitly given will the RTWP be shared.

No other personal data will be shared outwith the service without the explicit consent of the individual concerned.

Audit and evaluation

To help us evaluate the service, any contact details you provide – including name, address, telephone number and email address – may be passed to a third party for auditing and evaluation purposes.

More about how we evaluate the service

Performance management

To help us monitor the performance of the service, statistical data will be shared with National Services Scotland (NSS), the Scottish Government and DWP for the purposes of performance management.

This data will be completely anonymised to ensure that individuals can't be identified.

Data protection and security

In relation to personal data collected, stored and shared by FFWS, the Scottish Government, DWP, NHS Health Scotland, and NHS 24 are data controllers for the purposes of the DPA.

Data security

As FFWS is delivered through NHSScotland, we adhere to all data security standards and protocols that apply within NHSScotland.

In addition, all systems that operate as part of FFWS have had a detailed system security policy assessment in line with national recommended standards. The outcomes of this assessment were accredited in April 2015 by Scottish Government eHealth and this has been endorsed by the security department at the DWP.

Processing data

The process of collecting data as part of the assessment service meets Information Systems Security Standards (ISSS) preventing unauthorised access and malicious misuse.

Times and dates are recorded and stored at each stage of the process.

Disclosure checks

All health professionals who handle personal data within FFWS undergo Disclosure Scotland checks prior to employment, and at specified intervals throughout their NHS employment.

Training and registration

All health professionals working within FFWS receive confidentiality and data protection training during induction, and must be fully registered with the relevant professional body for their position:

  • Nursing and Midwifery Council (NMC) for nurses
  • Health Professions Council (HPC) for allied health professionals

Accessing your data

You've a right to know what data we collect about you, and to access, modify and request that we delete this data at any time.

You can request access to this data, or have it deleted at any time, by contacting the site administrator.

Audit and evaluation of the service

FFWS is routinely audited and evaluated to make sure we're delivering the best service for employees, employers and GPs.

Clinical audit

A routine internal clinical audit of all records processed by FFWS will be carried out by designated staff from each of the services involved (NHS 24, NHS Lanarkshire and NHS Health Scotland).

This will involve an agreed standard process and only designated staff who've been briefed, trained and security checked within NHSScotland will carry out these audits.

Following this audit, anonymous reports will be shared with:

  • NSS
  • The Scottish Government
  • DWP.

Audit of employer and GP satisfaction

In addition, an audit of employer and GP satisfaction will be carried out by an independent auditor contracted by the DWP.

The contact details of employers and GPs who've made referrals and/or received RTWPs will be shared with this contractor for this purpose. The name of the employee referred to the service won't be disclosed.

All contact details will be relayed through a secure email.


FFWS will be evaluated by a third party working on behalf of the DWP. Individuals who've received an assessment may be contacted by this organisation for the purpose of this evaluation.

If selected for evaluation, an individual's name, address, phone number and email address, will be provided by FFWS enrolment and assessment staff to the evaluation team.

Only an individual's name, phone number and email address will be relayed through a secure email.

The DWP evaluation provider will obtain further consent regarding the data required for the evaluation when they make contact with those selected.


We use cookies to collect information about you each time you visit the FFWS website.

By using our website and agreeing to this policy, you consent to for us to use cookies to collect this information in accordance with the terms of this policy.

What is a cookie?

A cookie is a small amount of data placed on your computer or mobile phone by a website.

Cookies can be:

  • persistent — meaning they're stored by your web browser and will remain valid until a set expiry date
  • session — meaning they'll expire when your web browser is closed.

We only use persistent cookies on this website.

What information do we collect?

When you visit this site, we'll collect information about:

  • your computer
  • your visits
  • how you use this website.

Our cookies don't collect or store any information that personally identifies you.

Why do we collect this information?

We use this information to understand how you use this site and to make it faster and easier to use each time you visit.

Blocking or deleting cookies

Blocking or deleting cookies may have a negative impact on how you use this website and could prevent some of the features from working.

Find out how to delete cookies on

What cookies do we use?

We use the following cookies on this website:

Cookie name

Expiration time



2 years

Used to distinguish users


10 minutes

Used to throttle request rate

These are first-party cookies used by Google's Universal Analytics.

How to contact us

This website is maintained by NHS 24 on behalf of the Scottish Government and DWP.

If you've a question or comment about our privacy policy, or would like access to your personal information, contact the site administrator:

  • using our contact form
  • by post — Fit for Work Scotland, NHS 24, Golden Jubilee Hospital, Clydebank, G81 4DY