Work Ability Management Services


This privacy notice is valid starting April 22nd, 2025.

This data protection notice supplements Barona’s Employee Data Protection Notice, which is available at https://policies.barona.fi/employee/.

Description of the processing of personal data 

Work ability management at Barona covers all measures aimed at maintaining and promoting employees’ work ability, taking into account different aspects of life. This includes preventive measures, the provision of early support and individual support and guidance for employees at risk of incapacity for work, employees with partial work ability and employees who are incapable of work. Work ability management is a key part of supervisory work and requires close cooperation with various stakeholders, such as the well-being team, a work ability specialist, HR, occupational health care and pension insurance companies. Work ability management covers Barona’s own personnel, employees in Barona’s work supervision and Barona employees working at client companies. 

Barona’s occupational health care service provider is Terveystalo. Terveystalo processes personal data related to the provision of occupational health care services as an independent data controller and will not disclose to Barona data on appointments and procedures that can lead to the identification of an employee, for example. Terveystalo’s own privacy statement will apply to the services provided by Terveystalo (https://www.terveystalo.com/en/privacy-statement/private-customer ).  

Purposes of processing personal data:

  • Processing of absences due to sickness  
  • Early support measures 
  • Providing support to employees 
  • Supporting employees at risk of incapacity for work 
  • Organising work ability negotiations 
  • Coordination of occupational health care services 
  • Assessment and monitoring of work ability 
  • Monitoring in accordance with the Occupational Safety and Health Act and occupational safety and health regulations 
  • Processing insurance and accident reports 
  • Implementation of rehabilitation processes 
  • Processing related to disability pension 

Types of data processed:

  • Name  
  • Employee number  
  • Phone number  
  • Email address 
  • Home address 
  • Personal identity code 
  • Data on absences due to sickness 
  • Self-reported absences  
  • Occupational health care statements and recommendations 
  • Work ability assessments 
  • Occupational accident reports  
  • Information on measures related to supporting work ability (e.g. early support discussions) 
  • Call information and call recordings related to absences 
  • Instructions related to absences 
  • Pension estimates 

Personal data retention periods: 

We will only retain your personal data for as long as is necessary for fulfilling the purposes for which we process your personal data, unless the law obligates us to retain it for a longer period.  

  • The employee’s basic data is retained for the purpose of arranging occupational health care for the duration of the employment relationship 
  • The employee’s personal data will be retained for four years after the end of the employment relationship (in the Sirius health system) for the purpose of arranging support for work ability 
  • Sick leave certificates will be retained for two years 
  • Absence data will be retained for the purpose of arranging support for work ability for four years after the end of the employment relationship (in the Sirius health system) 
  • Documents on exposure to biological agents will be retained for 10 years (in the Sirius health system) 
  • Data on calls concerning self-reported absences will be retained for two years and call recordings for six months 
  • Occupational health care statements and recommendations as well as information related to supporting work ability will be retained for as long as they are necessary for assessing and supporting the employee’s work ability. The need for continued retention will be assessed regularly.

Transfers of personal data to data processors and disclosures to other data controllers

The provision of work ability management services involves the use of, for example, system suppliers that process personal data on behalf of Barona in the role of data processor. The service providers are contractually obligated to process personal data in accordance with the legislation and the data protection requirements specified by Barona.  Service providers have access to personal data only to the extent necessary for the implementation of the service. Personal data is only processed within the EU/EEA.  

Personal data may also be disclosed to other data controllers on the basis of legislation, for example. Personal data will only be disclosed to the extent necessary for the purpose of use. Personal data may be disclosed to, for example, the following parties: 

  • Insurance companies: Personal data may be transferred to insurance companies for the processing of accident and health insurance, for example. 
  • Occupational health care service providers: Personal data may be transferred to occupational health care service providers for the purpose of organising occupational health care as well as assessing and supporting work ability. The employee may also, on their own initiative, seek supplementary services that support work ability, in which case the personal data necessary for providing the service may be disclosed to the service provider. 
  • Pension insurance companies: Personal data may be transferred to pension insurance companies for the processing of pensions and other benefits.