HAAS Privacy Notice

This Privacy Notice was last reviewed October 2025.

Who are we?

Ingeus UK Ltd has been commissioned by the Department for Work and Pensions (DWP) to provide the Health Assessment Advisory Service (HAAS) in the Lot 4 region which covers London, East Anglia and the South-East of England. Our partners Advo Health and PFAS deliver some of the assessments on our behalf. 

The Health Assessment Advisory Service arranges and carries out assessments for DWP. The purpose of the assessment is to understand how an illness or disability affects a person’s daily life. After the assessment, DWP makes the decision as to whether the individual will receive any benefits. The Health Assessment Advisory Service is delivered on behalf of DWP by Ingeus.

DWP are Data Controllers for the processing of claimant personal data in relation to HAAS. Ingeus is acting as a data processor. 

If you wish to know more detail about how DWP handle your personal data, you should visit GOV.UK and view the DWP Personal Information Charter

Please note – there is a separate privacy notice for potential employees and employees available through our intranet site.   

How do we collect your information?

The DWP relay to Ingeus UK LTD Personal Data required in order to provide the service. 

We will gather further information about you during the assessment process which will be collected from you directly.  

What Personal Data do we collect from you?

We collect different types of personal data from you directly through the assessment process. This may include 

• Medical and other information to support the assessment 
• Bank Details so we can process expenses
• Details of family members and others who are supporting you with the assessment  

We only ever collect the minimum amount of data we need to, in order to meet the requirements of the DWP and the HAAS contract.  

What we use your information for

All organisations must have a valid, lawful reason to process your information. Ingeus UK and its Delivery Partners will only collect and use your information for the lawful purposes of administering the services that we are contracted to deliver on behalf of DWP. We ask you for information about yourself, so that we can deliver the HAAS effectively.
 
 Your information may also be used for:

• Performance monitoring and analysis to help us assess the quality and standard of our services
• Conducting investigations in response to a complaint or enquiry
• Accounting and record keeping e.g. keeping accounts related to business activities and financial management
• Research and evaluation such as participating in feedback surveys

Research and evaluation

In order to ensure that we provide you with the best possible service, we may from time-to -time conduct research and evaluation. Sometimes we will do this by aggregating and anonymising the data, which means that no one can identify you. On occasion we may ask you to take part in a new piece of research and provide additional information or share your information with a third party for the purpose of research, this will only ever be done with your knowledge and consent. Additionally, DWP may undertake their own activities. This will undertaken as per their Personal Information Charter. 

What is the Lawful Basis for processing your Personal Data? 

The law protecting your personal information is the General Data Protection Regulation (GDPR).  As custodians of your personal information, Ingeus UK are committed to ensuring that your personal data is processed lawfully and respectfully, and by ensuring that we are compliant with the GDPR.

In accordance with the GDPR, Ingeus UK Ltd and delivery partners must have a valid lawful reason to process your information. 

The law on data protection sets out a number of different reasons for which businesses may collect and process your personal data. For HAAS these are:

1. To Meet Contractual Obligations

We are required by the DWP your personal data

2. To Meet Legal Obligations

In some circumstances we are required to pass on details to law enforcement of people who are involved in certain kinds of illegal or criminal activity. This includes disclosure under the requirements of Prevent and Safeguarding legislation. 

3. Legitimate interest

In order for us to provide the Health Assessment Advisory Service to you. 

How long is your information kept by Ingeus UK? 

We regularly review how long we keep your Personal Data; however, we do have certain legal obligations to retain some types of information for specific periods of time. We only hold on to Personal Data for as long as is necessary in order to process it for the relevant activity, or for as long as is set out in the HAAS contract with have with DWP. 

Who has access to your Personal Data? 

• HAAS staff employed by Ingeus who undertake or administer the assessment 
• HAAS staff employed by our delivery partners who undertake or administer the assessment

All staff accessing data have been security cleared and have completed data security training. 

Third Party Providers

When required to do so, we may share your information with DWP as per contractual obligations and in accordance with the GDPR.

• Where applicable, we may contact GPs or other relevant parties for additional information that supports the assessment  
• When necessary, for example, in the unlikely event for emergencies or safeguarding concerns, it may be in your vital interest to share your information with your GP, other Health Professionals or refer to external services that will provide help.

We will not share your information with others unless required to do so by law and unless we obtain your consent.

We do not transfer your personal information outside the UK.  

Consent 

Where we need your agreement to process your information we will ask for you to confirm this. Please note the DWP Personal information Charter provides full detail.  

Your rights

1.    The right to Information Access

You have the right to access the information held about you in relation to your assessment and the assessment process. As DWP is the data controller, these should directed to rightofaccess.requests@dwp.gov.uk who will manage the process. 

2.    The right to Data Portability

You have the right to move, copy or transfer the Personal Data we hold from one IT environment to another in a safe and secure manner. Please be aware, this only relates to electronic information and not paper files. The DWP Personal Information Charter details the process for enacting this right. DWP Personal Information Charter

3. The right to Rectification

You have the right to correct any personal information that we hold that may be incorrect. To ensure that the information we hold about you is always as accurate as possible, please get in touch. The DWP Personal Information Charter details the process for enacting this right. DWP Personal Information Charter

4. The right to Object to Processing

This right allows you to prevent the use of your Personal Data. Please note, there are exceptions to this right that may mean that we can deny your request. The DWP Personal Information Charter details the process for enacting this right. DWP Personal Information Charter

5. The right to Erasure (Right To Be Forgotten)

You can use this right in certain circumstances, to ask us to erase any personal data held about you. The DWP Personal Information Charter details the process for enacting this right. DWP Personal Information Charter 

6. The right to Restriction of Processing

You have the right to restrict the processing of your Personal Data. This means you can limit the way your personal data is processed in certain circumstances. 

The DWP Personal Information Charter details the process for enacting this right. DWP Personal Information CharterFurther information or queries 

Please contact

Ingeus Data Protection Officer 

Second Floor, 

66-68 East Smithfield

Royal Pharmaceutical Building

London, E1W 1AW

Or Email  

DataProtectionOfficer@ingeus.co.uk