Data Protection Complaints Policy

Intelligent OH Ltd takes data protection seriously. We are committed to handling personal data, including occupational health information processed through Genius, lawfully, fairly, transparently and securely.

If an individual or Genius user is concerned that we have not handled personal data properly, they can raise a data protection complaint with us. This policy explains how Intelligent OH Ltd will recognise, investigate and respond to those complaints.

Individuals also have the right to complain to the Information Commissioner’s Office, known as the ICO, or to take legal action where they consider this appropriate.

This policy applies to data protection complaints made by any individual whose personal data we handle. This may include employees referred for occupational health assessment, customer contacts, customer administrators, suppliers, contractors, website users, job applicants, employees and other business contacts. It also applies to complaints made by someone authorised to act on another person’s behalf, including a representative or other authorised third party where appropriate.

This policy should be read alongside our privacy information, data protection policies, data retention arrangements, personal data breach procedure, individual rights process and any relevant customer contracts or data processing agreements.

What is a data protection complaint?

A data protection complaint is a complaint about the way Intelligent OH Ltd handles personal data, including personal data processed within Genius or as part of the occupational health services and software support we provide.

 This may include concerns about: 

·       how we collect, use, store, access, transfer or share personal data within Genius or our wider business systems;

·       how we respond to requests for access, correction, deletion, restriction, objection or other data protection rights;

·       whether personal, employment, referral or occupational health information held in Genius or our records is accurate;

·       how long we keep personal data, assessment records, support records or audit information;

·       the security, confidentiality or appropriate access control of personal data;

a suspected personal data breach;

·       concerns about user permissions, account access, audit trails or the visibility of information within Genius;

·       our privacy notices, data protection policies, customer instructions, data processing arrangements or contractual commitments; or

direct marketing or communication preferences.

A complaint does not need to mention data protection law, the UK GDPR or the Data Protection Act 2018. If the complaint appears to be about the way we have handled personal data, we will treat it as a data protection complaint. 

Some complaints may include both data protection issues and other issues, such as service, clinical, employment, contractual, technical support or account administration concerns. Where that happens, we will deal with the data protection parts under this policy. Other issues may be dealt with under another relevant procedure or support process. 

Who is responsible for handling complaints? 

Our Data Protection Lead is responsible for coordinating data protection complaints. All Intelligent OH Ltd employees must be able to recognise a possible data protection complaint and pass it promptly to the Data Protection Lead. Employees should not ignore a complaint simply because it does not use formal data protection language.

Employees must also cooperate with any investigation and provide relevant information when asked. Refusal to do so would constitute a serious breach of policy and the individual would be subject to disciplinary action. 

How to make a complaint

A data protection complaint would ideally be submitted via our online form here.

Alternative, it can also be made using the following details:

Email: [email protected]
Post: Intelligent OH Ltd, Pegasus House, Pegasus Court, Olympus Avenue, Warwick CV34 6LW
Telephone: 01926 352500
Contact: Tracey Hudson 

Complaints can also be made through our usual contact channels, including Genius support routes where applicable. If a complaint is received by anyone in the Intelligent OH team, it will be passed to the Data Protection Lead or other appropriate person without unnecessary delay.

 To help us deal with the complaint, we may ask the complainant to provide:

their name and contact details;

a summary of the concern;

·       the personal data, Genius record, referral, assessment, account, or activity the complaint relates to;

any relevant dates, documents or correspondence;

the outcome they are seeking; and

where they are acting for someone else, evidence that they are authorised to do so.

We will only ask for information that is reasonable and necessary to consider the complaint.

Complaints made on behalf of someone else

If a complaint is made on behalf of another person, we may need to check that the person making the complaint has authority to act for them.

 This may include asking for a signed letter of authority, power of attorney, evidence of parental responsibility or other suitable confirmation.

We may be unable to investigate or respond substantively until we have enough information to confirm that authority.

Complaints from children or vulnerable individuals

If a complaint is made by or on behalf of a child or vulnerable individual, we will take reasonable steps to make the process accessible and appropriate. 

This may include using clearer language, allowing extra support, checking whether someone has authority to act on their behalf, and considering whether the complaint should be prioritised. We will make reasonable adjustments where needed to help individuals make or pursue a complaint.

Complaints made through insecure channels

If a complaint is made through social media or another public or insecure channel, we will ask the complainant to continue the complaint through a more secure method.

We will not usually discuss personal data publicly or through an insecure channel.

Acknowledging complaints

We will acknowledge receipt of a data protection complaint without undue delay and normally within 30 days of receiving it.

Our acknowledgement will normally confirm that we have received the complaint and explain what will happen next. If we need more information to investigate the complaint, we will say so.

Investigating complaints

We will consider data protection complaints fairly, carefully and without undue delay, taking account of our role in relation to the data. In some cases, Intelligent OH Ltd may act as controller. In other cases, particularly where we process data in Genius on behalf of a customer, we may act as processor and need to involve or refer the matter to the relevant customer organisation.

The steps we take will depend on the nature and seriousness of the complaint, but may include:

reviewing the complaint and any documents provided;

·       checking relevant records, Genius audit information, support tickets and business systems;

·       speaking to relevant Intelligent OH Ltd team members or authorised customer contacts where appropriate;

·       reviewing relevant policies, privacy notices, support procedures, system access arrangements or contractual terms;

considering whether any data protection rights request is involved;

considering whether there has been a personal data breach; and

deciding whether any action is needed to put things right.

We will take reasonable and proportionate steps. More complex complaints may take longer to investigate, but we will keep the complainant informed where there is likely to be a delay.

If the complaint includes a request to exercise data protection rights, such as access, correction, deletion, restriction or objection, we will also handle that request under our individual rights process. Where the request relates to data we process on behalf of a customer, we will act in line with the relevant contract and customer instructions.

If the complaint suggests that a personal data breach may have occurred, we will also consider whether our personal data breach procedure needs to be followed.

Keeping complainants informed

We will keep the complainant informed of progress where appropriate.

If we need more information, we will explain what we need and why. If the complaint is complex or cannot be resolved quickly, we will provide updates where appropriate and explain the expected next steps.

Outcome of the complaint

Once we have completed our investigation, we will tell the complainant the outcome without undue delay.

Our response will usually explain:

what we have considered;

our findings;

whether the complaint is upheld, partly upheld or not upheld;

any action we have taken or intend to take; and

what the complainant can do if they remain unhappy. 

Where we have made a mistake, we will say so and explain what we are doing to put things right where appropriate. This may include correcting information, deleting information, restricting access, updating permissions, improving a process, providing staff guidance or training, apologising, or taking other appropriate steps.

If the complainant remains unhappy

If the complainant is unhappy with our response, we will remind the complainant that they have the right to complain to the ICO. They can contact the ICO using the following details:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: ico.org.uk
Telephone: 0303 123 1113

Individuals can complain to the ICO at any time. They do not have to wait for our process to finish before doing so.

Complaints involving service providers

If a complaint involves a service provider, hosting provider, software supplier, professional adviser or other third party that processes personal data for us, we may ask them to provide information or assistance so that we can investigate and respond to the complaint.

Where we process personal data on behalf of another organisation, including customer data held in Genius, we will handle, support or refer the complaint in accordance with our contract, data processing agreement and the customer’s documented instructions.

Record keeping

We will keep appropriate records of data protection complaints.

These may include:

the date the complaint was received;

the nature of the complaint;

any acknowledgement sent;

relevant correspondence and documents;

the steps taken to investigate the complaint;

the outcome;

any action taken; and

any lessons learned.

Complaint records will be kept only for as long as necessary and in accordance with our data retention and data protection policies.

Learning from complaints 

We will use data protection complaints as an opportunity to improve. Where appropriate, we will consider whether we need to update our privacy information, improve Genius processes or user guidance, strengthen access controls, provide staff training, change how we use personal data, improve customer communications, or take other steps to reduce the risk of similar issues happening again.

This policy is effective as of 19th June 2026.