Wellbeing programme record redaction is the removal of medical data from a participation file for an employee wellbeing scheme. Screening results are special category under UK GDPR Art. 9(1); processing them at scale triggers a data protection impact assessment under Art. 35(3)(b), and the Equality Act 2010 guards against using the results to disadvantage a disabled worker. anonym.plus marks each item on your device, so the record stays usable while protected detail goes.
When this applies
A wellbeing file may capture a clinical questionnaire, a biometric reading, and a name. You strip the medical detail before any aggregate analysis runs, so the report shows patterns rather than people.
How anonym.plus handles it
- Open the participation file in anonym.plus on your device.
- Local OCR reads a scanned screening questionnaire.
- The tool flags clinical notes, readings, and names.
- Keep the de-identified totals an analyst needs.
- Swap or black out the confirmed items.
- Save the clean copy locally.
What you need to provide
- The participation file (PDF, DOCX, scan, CSV).
- An operator (Replace keeps the totals readable).
- Optional batch for a programme-wide set.
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | participant N. Boateng → [PARTICIPANT] |
| Health | MEDICAL_CONDITION | clinical note → [CONDITION] |
| Health | MEDICAL_CONDITION | BMI reading → [METRIC] |
| NI number | UK_NINO | QQ 60 22 44 B → [NINO] |
| Dates | DATE_TIME | screen 02/2026 → [DATE] |
| Contact | EMAIL_ADDRESS | n.boateng@example.co.uk → [EMAIL] |
Compliance achieved
- Treats screening results as special category data under UK GDPR Art. 9(1), with Art. 9(2)(h) covering an occupational health purpose.
- Supports the data protection impact assessment that UK GDPR Art. 35(3)(b) requires for large-scale processing of health data — minimising first shrinks the risk you have to assess.
- Guards against detriment to a disabled worker under Equality Act 2010 s.13 and s.19, and keeps the functional detail that supports the s.20 adjustment duty.
- Recognises that consent at work is rarely freely given (UK GDPR Art. 7(4)): keep participation optional and report only de-identified aggregates.
Anonymise wellbeing programme records offline — see plans & start free →
Limitations & cautions
A rare clinical note can still point to a person even after the name goes. The tool flags named items, yet you should review free-text history before any analysis, share only de-identified aggregates, and complete a DPIA where Art. 35 applies.
Frequently asked questions
Does a wellbeing scheme need a DPIA?
Usually yes. UK GDPR Art. 35(3)(b) names large-scale processing of special category data as a trigger, and health screening is exactly that. De-identifying before analysis reduces the residual risk the DPIA records.
Can wellbeing data be used in management decisions?
Doing so risks direct or indirect discrimination under Equality Act 2010 ss.13 and 19. Keep the analysis aggregated, and route any individual need through the s.20 adjustment process instead.
Is the file uploaded?
No. The app is fully offline, so the health data stays on your device.