How E-DOB handles medical and special category data

Medical information is "special category data" under UK GDPR — health data that carries stricter legal protection than an ordinary incident record, because of the harm its exposure could cause someone.

E-DOB reflects that with an extra layer of control on top of normal incident permissions. A medical report can be exported as a confidential PDF, clearly marked with a CONFIDENTIAL header — and the patient's name is deliberately excluded from the exported filename, so a file left on a desk does not identify anyone by its filename alone.

Medical report permissions are a separate, narrower grant from general incident access. Only staff who genuinely need to see medical detail — a first aid lead, a duty manager, a designated safeguarding contact — should have it.