St Wilfrid's Hospice is committed to being fair, open, honest and transparent in relation to the collection, processing and sharing of your personal data - in full accordance with the new General Data Protection Regulations (GDPR).
This privacy notice covers all areas of data collection including: staff and volunteers, clinical care
(patients, relatives and carers ), donors and fundraising and business and retail.
Your data: the personal information we collect
We will normally keep your information in an electronic format. This includes:
Personal details, such as:
- Name, home address and email address
- Telephone number
- Date of birth
- Next of kin and relevant relationships
For people referred for care: health information, including:
- Referral requests, health records and reports about your health condition
- Your treatment and care including your medication
- Results of tests or investigations
- Your General Practitioner (GP) details
Financial information (where you have shared this with our fundraising team or if you are an employee), such as:
- Your credit card or bank account details
If you are an employee within the organisation then we are likely to hold further information such as
- National Insurance number and where applicable professional registration details
- Previous employment references
- Occupational health communication
- Pension scheme details
- Equal Opportunities Monitoring (ethnicity, religion, disability )
Information relating to employees and volunteers is obtained during application and recruitment.
For supporters - we collect personal data when you ask us to send you publications or newsletters, order products and services from us, make a donation to us, sign up for Gift Aid, fundraise on our behalf, or otherwise give us information. We can then ensure that we send information which matches personal interests (eg social or sporting fundraising events, campaigns and volunteering).
Our fundraising team will ask supporters for their communication preferences. We usually contact you by post, occasionally by phone and, where you have specifically agreed to this, by email.
We also collect information about your use of our website, including your Internet Protocol (IP) address, how much time you spend on the site, and what you like or view on our site.
Legal Basis for processing
St Wilfrid’s Hospice fairly processes personal information by ensuring it is being used following consent being given or because there is a legal obligation or interests.
In many cases an individual will have consented to the process, such as:
- Having an electronic health care record created as a patient
- When applying for a position of employment or to volunteer
- When submitting a Gift Aid declaration, joining the Hospice Lottery or donating items where sales will go through the Gift Aid process.
Sometimes it is necessary to process your data for us to comply with our legal obligations, such as:
- Sending Gift Aid information to HMRC
- Any incidents, events or occurrences that require notification to the Care Quality Commission (CQC)
- Statutory requirements to register Trustees with the Charity Commission or Companies House
There may also be occasions where the individual has asked for something to be done, such as:
- Room hire booking
- Asking us to respond to a complaint
- Making a general enquiry
- Requesting some form of training or education
- Requesting information in order to pursue a claim
The hospice will process certain information under the basis of ‘legitimate interests’ in circumstances where any individual would reasonably expect us to be using their information. St Wilfrid’s Hospice will still protect your rights and interests, ensuring that processing remains lawful, fair, and necessary, without causing harm and where there is no less intrusive way to achieve the same result. Examples include:
- Inviting people to remembrance services
- Holding contact details (and their relationship) to a patient under our care eg next of kin
- Holding contact details of those sponsoring a fundraiser on our behalf
- For the administration of those requiring hair and beauty treatments
- Sending you direct marketing in relation to donations and fundraising events in cases where you have supported us previously and are happy to continue receiving communications from us.
- CCTV security
The hospice will carry out a Legitimate Interest Assessment (LIA) for cases where legitimate interest is being used as the basis for processing information.
Are you required to provide data and what happens if you don’t?
For donors you are not required to provide personal data to us. If you don’t provide personal data this may affect our ability to provide the services you request. For example, we may not be able to receive a donation from you if you do not provide your payment information and we would be unable to claim the potential addition of Gift Aid funding.
If you register to receive services from our clinical teams then we have to obtain personal information from you in order for us to deliver safe care and treatment.
Further processing of your data
When you give us your personal information in connection with making a donation we will also use this information, apart from your financial information, for internal reporting and analysis.
Patient data used for the care and treatment of a service user will be anonymised, aggregated and reported regularly (monthly, quarterly, annually) for analysis and planning of services. This will not identify individuals.
Data sharing and transfer
Fundraising is essential to our organisation’s survival. To help us fundraise more efficiently (leaving us with more time and resources for the important work we do), we engage third parties to improve our address data eg to identify missing postcodes or to correct partial addresses.
We will never sell, rent, or trade your personal data.
The details of those joining the Hospice Lottery are shared with Local Hospice Lottery Ltd (who run the lottery on our behalf.)
Donors making Gift Aid declarations will have their details passed to HMRC in order for us to claim these funds.
Those making a regular donation will have the details of their standing order passed to our bank.
In terms of ongoing patient care, if appropriate, it may be necessary to share information with organisations who provide care to ensure you continue to get the care and treatment you need. We will share information with your GP, District Nurse, NHS hospital or community teams, Adult Social Care, Continuing Healthcare and Community Care agencies.
For patients requiring medical supplies or equipment, their contact details may be passed to the suppliers.
For employees, the hospice will contact the appropriate bank and pension company in order to pay staff and facilitate pension contributions.
In order to satisfy statutory requirements of the Charity Commission and Companies House the hospice will pass on details of Trustees and Company Directors.
Holding and protecting your data
Everyone working at St Wilfrid’s Hospice has a legal and professional duty to keep information about you confidential. We follow strict guidelines about how information is collected, stored and shared.
Your information is further protected by St Wilfrid’s Hospice’s compliance with the requirements of the:
- Data Protection Act (1988) - replaced by the General Data Protection Regulation (GDPR)
- Regulators Code of Fundraising Practice (2016)
- Care Quality Commission
Patient confidentiality is monitored by our Caldicott Guardian, a senior clinician who ensures St Wilfrid’s Hospice protects patients’ right to confidentiality.
How long do we hold your data for?
We will follow national guidance or best practice and retention periods will vary according to the nature of the record.
Record retention periods are:
- Patient records where they have received a blood transfusion under our care - 30 years
- Patient records - 8 years
- Finance records - 7 years
- Declarations of Gift Aid transactions - 6 years
- Legacy letters or copies of wills -14 years
- Duty rosters - 4 years
- Any incidents, events of occurrences that require notification to the CQC - 3 years
- Staff employment records (after termination) - 3 years
- CVs non exec Directors (successful) – 5 years
- CVs non exec Directors (unsuccessful) – 2 years
- Job Application (successful) – 3 years
- Job Application (unsuccessful) – 1 year
- Volunteer records ( Leavers ) - 7 years
- Volunteer applicants ( non-starters ) - 1 year
- Donation letters/event forms/raffle tickets etc - 7 years
- Customer details for collection/delivery by retail team - 3 months
As an individual you have the following rights:
Right of Access - Declare that we have your data. Give you a copy of your data.
Right to Rectify - Correct your data.
Right of Erasure - Delete your data.
Right to Restrict Processing - Stop processing your data, but not delete.
Right of Portability - Give you your data in a common, machine readable format.
Right to Object - to direct marketing, to processing for scientific, historical research or statistics, to processing based on legitimate interests or public interest
Right not to be Profiled - Not be subject to a decision based on automated processing.
Right to Withdraw Consent – if we rely on consent as the legal basis for processing.
Right to Complain - to the Information Commissioners Office
What should I do if I have concerns?
If you have any questions or concerns about how we use your health, financial and personal information please contact us via email to Hospice@stwhospice.org or via telephone ( 01323 434200 ).
Subject access requests (for access to personal data ) can be made to Colin Twomey – Senior Information Risk Owner. Completion of a request form is required as per Appendix 1 of the Subject Access Policy & Procedure.
Whilst St Wilfrid’s Hospice is not currently required to appoint a legally defined role of Data Protection Officer, we continue to demonstrate our strong commitment to data protection, security and confidentiality with the following key IG roles in place:
Dr David Barclay – Caldicott Guardian
Colin Twomey – Senior Information Risk Officer (SIRO )
Steve Clarke – IG Lead
For specific queries in relation any donor and fundraising data concerns you can write to:
John Summers - Donor Development Manager
email@example.com or by calling 01323 434281 or at the address below:
Donor Development Manager
St Wilfrid’s Hospice
1 Broadwater Way
For queries relating to our trading company you can email to firstname.lastname@example.org