Hello! Let's get you signed up

Optum Health Solutions (UK) Limited ("Optum UK"), and its subsidiaries and affiliated companies (collectively, the "Company", "We", or "Us") strive to properly address applicable data protection requirements.

This Employee Assistance Program ("EAP") and Wellness Privacy Notice ("Notice") provides the individuals who receive our services, including but not limited to, telephonic counseling sessions, in-person counseling sessions, wellness services, and critical incident management assistance ("You" or "Participant") with certain important information about how the Company handles his/her Personal Data (including Sensitive Personal Data). Optum UK is the primary data controller for processing of Personal Data.

Personal Data processed might include the following types of data:

• Employer group;
• Name;
• Address;
• Telephone number (landline and mobile);
• Email address;
• User name;
• Employee status;
• Highest level of education;
• Gender;
• Job title;
• Participant status (employee or family);
• Work shift;
• Date of birth;
• Information concerning your physical and emotional health and wellbeing; including treatment;
• Marital status;
• Length of service;
• Nationality;
• Place of birth;
• Sexual orientation;
• Trade union membership;
• Political affiliation;
• Religious affiliation;
• Genetic data;
• Criminal convictions; and,
• For critical incidents and management referrals, manager/HR contact information.

Our use and processing of Personal Data - The Company will use and otherwise process Personal Data:

• Of Participants to provide the EAP and wellness services that the Participant request (e.g., to assist in determining the appropriate provider or counselor to whom the EAP participant should be referred as well as the case management and wellbeing management associated with telephonic counseling sessions, in-person counseling sessions and critical incident management assistance);
• Of Participants to administer the EAP and wellness programs (e.g., quality management and business administration);
• Of Participants to meet legal requirements and comply with applicable law; and,
• Of Participants to respond to his/her instruction and authorization for release of information.

The legal basis of our Personal Data processing - The Company’s legal basis to process Personal Data includes processing that is:

• Necessary for the Company’s legitimate interests, including those described above;
• Necessary for compliance with Company’s legal obligations, including the provision of EAP and wellness services to Participants;
• Necessary for the purposes of preventative or occupational medicine, for the assessment of the working capacity of employees (Participants);
• Necessary for medical diagnosis, the provision of health or social care or treatment of the management of health or social care systems or services;
• Necessary for the establishment, exercise or defense of legal claims;
• Necessary in order to protect the vital interests of the Participant of another natural person;
• Necessary for reasons of public interest in the area of public health; or,
• Based on consent by the Participants, which may subsequently be withdrawn at any time by contacting us at the address listed below in the "Contact Information" section without affecting the lawfulness of processing based on consent before its withdrawal.

Third Parties, Optum Partners, Optum Personnel and Cross-border Transfers - The Company discloses your Personal Data to third parties ("Optum Partners"), such as providers and counselors, who help us to deliver the EAP and wellness services requested by Participants. Optum Partners also share Personal Data with us for these purposes. Company personnel may access (on a need-to-know only basis) and process Personal Data in connection with their job responsibilities or contractual obligations. Such access includes those individuals who are in charge of the administration of the EAP and wellness programs, such as case management, wellbeing management, quality management, business administration, and IT services as well as senior executive company managers. Some third parties, Optum Partners, and Company personnel are located outside of the EEA, including in countries that may not provide the same level of data protection as the home country of the EAP and wellness Participants, such as the United States of America. We take appropriate steps to ensure that such entities are bound to duties of confidentiality and we implement measures such as standard data protection contractual clauses to ensure that any transferred Personal Data remains protected and secure. A copy of these clauses can be obtained by contacting us at the address listed below in the "Contact Information" section.

Our reporting of aggregated, non-personally identifiable information or de-identified information - The Company provides reports to its employer clients ("Employer Reports"). The Employer Reports demonstrate the delivery of the EAP and wellness services that we provided to those participants who make use of such services that our employer clients provide to employees. Only aggregated, non-personally identifiable information or de-identified information is included in the Employer Reports that we prepare.

Participants are not required to share Personal Data - Participants are not required as a statutory requirement to provide us with Personal Data for processing as described above. If a Participant does not provide us with Personal Data, we are unable to provide the EAP or wellness service that the Participant might request. If Participant, provides us with data of third parties (such as information from financial institutions, information or advice from solicitors, etc.) it is the responsibility of the Participant to ensure that the communication of such data to us and further processing by us is lawful.

Direct Marketing - We will not use Participants Personal Information for direct marketing purposes without obtaining your consent prior to doing so. If you provide your consent for direct marketing, you may request to withdraw your consent at any time. On each item of marketing collateral will appear instructions for withdrawing your consent to direct marketing. You may request to withdraw your consent to direct marketing by following the instructions on the marketing collateral or by contacting us following the instructions in the "Contact Information" section below.

Personal Data will be retained only for so long as reasonably necessary for the purposes set out above, in accordance with applicable laws.

The Company maintains reasonable security measures to safeguard Personal Data from loss, interference, misuse, unauthorized access, disclosure, alteration or destruction. The Company also maintains reasonable procedures to help ensure that such data is reliable for its intended use and is accurate, complete and current.

Participants may contact the Company, at the address listed below in the "Contact Information" section, to request access to the Personal Data we process about them, to correct any mistakes, to request deletion of this data or to withdraw consent to the processing of Personal Data, in accordance with applicable law.

The Company might be unable to comply with such a request where doing so would place it in breach of its obligations under applicable laws, regulation or codes of practice. However, in some circumstances, you might be able to request that your data be blocked from further processing. You might also have a right to data portability to another Data Controller under certain circumstances. Where we rely on consent to process Personal Data, consent may be withdrawn at any time, although the withdrawal might impact or disrupt the services we provide. Whether we comply with your request or do not comply with your request, we will prepare a response within the time permitted by law, generally within a month of receiving your request, subject to extension, when permitted, in certain situations.

If a Participant is aware of changes or inaccuracies in his or her Personal Data, he/she should inform the Company of such changes so that the Personal Data can be updated or corrected.

Participants may lodge a complaint with a supervisory authority if he/she considers that Company’s processing of their Personal Data infringes applicable law.

Regardless of any other provisions in this Privacy Notice, the Company may disclose or otherwise process Personal Data in the context of any sale or transaction involving all or a portion of the business, or as might be required or permitted by law or required for the purposes of any regulatory audit to which the Company may be subject from time to time.

The Effective Date of this Privacy Policy is August 04, 2021. The Company might revise its Privacy Policy from time to time to reflect changes that we undertake in Persona Data processing. We will notify you of significant changes.

I represent that I am:

• The Participant in the EAP and wellness services; or
• The legal guardian/custodian of the Participant, who has not attained the age of majority in the applicable jurisdiction and I am legally authorized to act on the Participant’s behalf; or
• The legal guardian/custodian of the Participant, who is otherwise unable to provide informed consent and I am legally authorized to act on the Participant’s behalf.

I read and understand the Personal Data processing practices described in this Privacy Policy. I consent to these practices and request EAP and wellness services. I understand that this consent is valid for the duration of the requested EAP and wellness services for the immediate presenting issue. I understand that an additional consent will be required if additional services are sought for other concerns in the future. I understand that I can withdraw this consent at any time by contacting the Company as explained in the Privacy Policy. Finally, I understand that when consent is withdrawn, the Company (and Optum Partners) will no longer be able to provide EAP and wellness services.

____________________________ ________________________ __________________

Client #1 Printed Name Signature Date

(Guardian/Custodian (such as a parent) if Participant requesting EAP and wellness services is a minor child – as defined under local law)

____________________________ ________________________ __________________

Client #2 (as applicable) Printed Name Signature Date