We take the protection of your privacy seriously. This is why Barona Occupational Health Services (hereinafter Barona) has undertaken to protect your privacy in the best way possible and to process your personal data transparently in accordance with valid law and good data protection practices.

 This Privacy Policy describes how we collect, process and protect your personal data in the delivery of vocational rehabilitation services and guidance to new career paths. We need your personal data for service production so that we can provide you with career guidance, for example, as well as explore employment and training paths and help you look for work trial opportunities.

 The collection and processing of personal data is based on your consent, which we will request from you during the initial stages of the service. You may withdraw your consent at any time, at which point all of your personal data will be deleted from our filing system. You also have the right to check and rectify the data we have collected on you, or to object to its processing, or to request the temporary restriction of such processing if you suspect that some part of the data is inaccurate. In certain situations, you also have the right to be forgotten, in which case we will erase all data pertaining to you, provided that it is no longer needed for its original purpose. You also have the right to lodge a complaint on the processing of your personal data. The use and processing of personal data, as well as your rights, are described in more detail below.


Your personal data is used in the delivery of vocational rehabilitation services and guidance to new career paths. We collect and process your personal data only to the extent necessary for the production and development of our services.

Your consent to the processing of your personal data is voluntary, rather than an obligation laid down in the law or determined in a contract. The delivery of our services requires the processing of your personal data, and if you not provide us with your consent or choose to withdraw your consent, we cannot deliver the services to you anymore.  The personal data is collected from you and from other sources specified separately on the consent form. The data obtained from other sources is collected on the basis of your consent or within the scope permitted by law over the course of our customer relationship. When necessary, we can also collect data from your medical care provider, as long as this has been agreed upon with you separately.

The purpose of the processing determines what kind of information we collect in any given situation and for what purpose. To advance your guidance or rehabilitation and to deliver our services, we collect, with your consent, contact details from you, as well as other information necessary for the following measures:

  • The exploration of rehabilitation possibilities and/or the preparation and implementation of a rehabilitation or guidance plan. To draw up the plan, we collect data on your livelihood, any challenges to your working ability, and your work and educational history directly from you.
  • Enterprise resource planning, analysis and quality assurance. We collect your data to our ERP system to be able to provide quality services. In addition to your contact details, we collect data on the progress of the service, details on your livelihood and the limitation of an assignment. Access to the system has been restricted solely to the persons whose work requires them to be able to access it.
  • The management and invoicing of a client relationship. We need your identifying data – such as your name and personal identity code – so that we can report on the progress of your assignment and provide the client with details on the allocation of an invoice.

The processing of your personal data is not subject to automated decision-making. Automated decision-making refers to a decision made entirely automatically, without the input of a human being.


The data saved and stored in the filing system includes your name and personal identity code as well as your contact details, such as your phone number, email address and place of residence. We also save and store background and order data related to guidance services, such as information on your livelihood and any possible injury number specified by an accident insurance company, or background information provided by a pension insurance institution, including any information on support for a training line leading to physically easy duties.

Some of the data we collect is sensitive in nature, and we store such sensitive personal data for the production of guidance services related to vocational rehabilitation, working ability and guidance to new career paths, as well as for the purposes of enterprise resource planning. Special categories of personal data – also referred to as “sensitive personal data” – means personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and genetic data, biometric data, data concerning the health or sex life or sexual orientation of a natural person.

The sensitive personal data saved and stored in our filing system include: livelihood (such as rehabilitation support and its validity), injury numbers (cases involving accidents) and the limitation of assignments.  Sensitive data is processed with due diligence and on the basis of point (a) of Article 9(2) of the General Data Protection Regulation. We process your sensitive data only on the basis of your explicit consent.


We process your data confidentially and do not disclose it to third parties in any situations other than those specified in the following:

  • With your separate consent, the data can be transferred to contractual partners producing rehabilitation work within the context of a psychological assessment or to Barona’s internal operators. The Group’s internal operators may include the Group’s psychologists and the recruiters of various industries, provided that we have a separate agreement with you on these persons’ involvement in the process. In this context, contractual partners refer to external network psychologists who can produce psychological assessments for the support of rehabilitation work.
  • When necessary and at your consent, the data may be transferred to the employer offering you a work trial or job coaching for the purposes of finding a job suitable for you.
  • We may have to disclose certain data to the authorities or judicial bodies when so required by law. We will do this only on the basis of a valid decision given by a court of law or an order given by, or at the summons of, an official authority.
  • In the context of any possible corporate acquisitions or arrangement, the buying party may gain access to material customer data. In such cases, the confidentiality of all personal data is guaranteed with non-disclosure agreements.
  • We can disclose your personal data to other third parties, provided that you have given your consent to such disclosure.

We also use subcontractors and service providers in the processing of the data we collect for the purposes of technical maintenance and development. These include the designated engineers of Wunderdog, who have the right to process your data only to the extent required by the services agreed upon. This means that they may not use your data for their own purposes. We obligate them to ensure an adequate level of data protection and the legality of the processing through contractual means.

Your personal data is not transferred to third parties located outside the European Union or the European Economic Area.


We have appropriate technical and organisational information security means in place to protect your personal data from accidental loss, misuse or other unauthorised access of this kind.  These means include the use of firewalls, monitoring, encryption technologies and secure hardware facilities.

Access to your personal data is restricted internally as well, by means of access control and the granting and monitoring of access rights.  Your personal data is processed solely by the employees entitled to do so within the framework of their duties.


You have the right to check the data pertaining to you in our filing system and to influence how we use said data. In certain cases, you have the right to be forgotten or to request the transfer of your data to another controller. The following contains a description of your rights within the framework of valid legislation:

  • Right to withdraw consent

When the processing of personal data is based on your consent, you have the right to withdraw your consent at any time. You can withdraw your consent by informing the controller of the matter. (Send an email to or a letter to Töölönlahdenkatu 3 B  2nd floor, 00100 Helsinki, Finland). If you withdraw your consent, the provision of the services will be suspended.

  • Right to check and rectify your data

You have the right, at any time, to check the data we have collected on you or to receive confirmation that our filing system does not contain any personal data concerning you.  If your personal data in our filing system is inaccurate or incomplete, you can send us a rectification or completion request.

  • Right to restrict or object to processing

If some part of your data is inaccurate, you have the right to request the temporary restriction of its processing until such time as we have ascertained the accuracy of the data in question.

  • Right to be forgotten

You have the right to be forgotten in certain cases. We will erase or anonymise all data we have collected on you, provided that the data is no longer needed for the purposes it was originally collected for and that we are not subject to a special statutory obligation to store the data. We will also erase your data if the processing of the personal data has been based on your consent and you withdraw this consent, or if you object to the processing of your personal data, provided that there are no other grounds for the processing.

  • Right to data portability

You may request the transfer of your personal data, in which case we will provide you with your personal data in a machine-readable format for you to store yourself or transfer to another controller (e.g. another service provider). If technically possible, we can also transfer your data directly to another controller at your request. This is possible only in situations where we process your personal data on the basis of your consent or a contract, and applies solely to data that you yourself have supplied to us.

  • Right to lodge a complaint

In addition to your aforementioned rights, you have the right to lodge a complaint on the processing of your personal data with the local data protection authority. We nevertheless recommend that you first contact the controller’s contact person specified at the end of this Privacy Policy.

You can send any checking or erasure requests, and requests related to the restriction of processing or transfers via email to

or by post to 
Barona Occupational Health Services
Kalle Pulkkanen / Data Protection
Töölönlahdenkatu 3 B  2nd floor 
00100 Helsinki, Finland

Your request must contain your name, contact details and personal identity code for the purposes of the retrieval of your data and the verification of your request. We will respond to your request within a month in the manner you prefer, either via email or by post, delivered to the address provided by you.

If you have any questions related to your aforementioned rights, please contact us:
Barona Occupational Health Services
Kalle Pulkkanen / Data Protection
Töölönlahdenkatu 3 B  2nd floor
00100 Helsinki, Finland


We will store your data only for as long as necessary to implement the purposes specified under section [1], always within the framework of valid legislation, or until we receive an erasure request from you.

Your personal data will be rendered anonymous by converting it irreversibly into a format from which an individual person is no longer identifiable one year as of the end of the customer relationship. At your consent, documents including personal data can also be processed over the course of processes related to vocational rehabilitation, career maintenance and re-guidance services. Said documents include job applications and CVs in the context of job-search coaching or the pursuit of work try-out opportunities. All documents of this kind are erased permanently within three (3) months of the end of your customer relationship.

A year after your customer relationship has ended we will anonymise your data in such a way that it can no longer be linked to you personally. We will store the anonymised data for the purposes of analysis and the development of our services.


We develop our data protection policies on a continuous basis, due to which we may change this Privacy Policy from time to time. The changes may also be based on legislative amendments. When necessary, we may inform you directly of any changes.


Contact person in charge of the filing system: Barona Occupational Health Services
Kalle Pulkkanen

Barona is the controller of your personal data. 
If you have any questions or comments, please contact us:
Barona Occupational Health Services

Business ID 1970081-6

Töölönlahdenkatu 3 B  2nd floor

00100 Helsinki, Finland

Tel. +358 20 198 3460 (switchboard)