For HR, privacy & wellbeing leads

Anonymity, consent and employee data in workplace skin screening

Health screening at work fails when people suspect the results reach their manager. This page explains exactly what an employer sees in an anonymous screening round, how consent is handled, and the wording that gets that message across to a sceptical workforce.

Individual results shared with the employer
0Individual results shared with the employer
Employee accounts to create or administer
0Employee accounts to create or administer
Shared link and QR code for the whole workforce
1Shared link and QR code for the whole workforce
Voluntary participation
100%Voluntary participation

What the employer can and cannot see

Swipe the table sideways to see all columns

Employer visibility in an anonymous screening round
DataVisible to the employer?Notes
Number of scans used from the packYesShown on your order at /workplace-screening/manage
Scans remaining and expiry dateYesUsed to plan top-ups before the 12-month expiry
Employee names or IDsNoNever collected in the anonymous flow
Individual screening resultsNoReturned to the participant only
Photos or imagesNoNot shared with the organisation
Who declined to take partNoNon-participation is invisible by design

Why anonymity raises participation

Employees weigh a health check against a simple question: could this affect how I am seen at work? If the answer is uncertain, most quietly opt out — and the people who opt out are often those with the exposure history that matters most.

Removing identity from the process removes the calculation. There is no result to be disclosed, no record attached to a personnel file, and nothing for a manager to ask about.

The one sentence to include

"The company pays for the scans. The company never sees who used them or what any result says." Put that in the email subject area, on the poster and in the toolbox talk.

Governance questions your privacy team will ask

  1. Is the employer a controller of health data here?

    The anonymous flow is designed so the employer does not receive identifiable health information. The organisation funds access; it does not collect results.

  2. Can results be reverse-engineered from usage counts?

    Counts are aggregate and carry no result content. Avoid publishing counts for very small teams if you want to remove even the perception of inference.

  3. What is shared with managers?

    Nothing about individuals. Managers should be briefed to encourage participation and never to ask about outcomes.

  4. How do we document it?

    Treat it as a funded wellbeing benefit in your programme records, and reference our privacy policy and terms for how the screening service itself handles data.

Communicating it to the workforce

  • Lead with anonymity, not with the technology
  • Name the sponsor — a safety rep or trusted supervisor beats an all-staff HR mailbox
  • Be explicit that declining has no consequence and cannot be observed
  • Tell people what they will get back: guidance on whether to see a doctor
  • Repeat the clinical caveat: this is screening and education, not a diagnosis

Where this differs from other workplace health checks

Occupational health assessments, biometric screenings and insurer-run wellness programmes usually depend on identifying the participant, and often feed data back in some aggregated or individual form. That is a legitimate model, but it carries a trust cost.

An anonymous screening pack is deliberately narrower: it buys access and education at scale, and it accepts that the employer will never know the clinical outcome. For skin checks — where the goal is simply getting someone to a clinician sooner — that trade is usually the right one.

Frequently asked questions

Offer a health benefit without collecting health data

Anonymous participation, no employee accounts, and no individual results returned to the employer.