Home > Draft privacy policy v2

Privacy Policies

Listed below are the Privacy Statements for St Oswald’s Hospice Limited and St Oswald's Hospice Promotions Limited.

St Oswald’s Hospice Limited Privacy Statement

This is the Privacy Policy of St Oswald’s Hospice, registered address: Regent Avenue, Gosforth, NE3 1EE. Charity number 503386. Company Number 1166239. ICO Registration number ZB163587.

We at St Oswald’s Hospice aim to be as transparent as we can about how and why we communicate with you and how we will use your personal information.

St Oswald's Hospice is committed to protecting the personal information of all those who provide it, regardless of the reason, whether it is provided online or offline.

In this statement we will tell you

  • why we are able to process your information
  • what purpose we are processing it for
  • whether you have to provide it to us
  • how long we store it for
  • who we share it with

St Oswald’s Hospice is the data controller (based on the definitions in the General Data Protection Regulations - GDPR) for the personal information we process, unless otherwise stated.

There are many ways you can contact us, including by phone, email and post.

Our postal address:

Data Protection Officer
St Oswald’s Hospice
Regent Avenue
Gosforth
Newcastle upon Tyne
NE3 1EE

Switchboard Number: 0191 2850063

Email: dataprotectionofficer@stoswaldsuk.org

Regardless of your status you can contact us about any of the data issues below at any time at any of the contact details above.

Please mark any correspondence for the attention of the Data Protection Officer.

Most of the personal information we process is provided to us directly by you for one of the following reasons:

  • You have been referred to one of our clinical services (this information will usually be provided initially by another health provider such as your GP).
  • You are a family member of a patient using our services.
  • You have made a complaint or enquiry to us.
  • You have made a donation to us, either money or goods and maybe gift aid.
  • You wish to attend, or have attended, an event.
  • You subscribe to one of our newsletters.
  • You have applied for a job or secondment with us or continue to work for us as a member of staff or a volunteer.
  • You are representative of your company/organisation/association.
  • Suppliers/Contractors.

You may fit into more than one category so please read any sections that apply to you.

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information. If you wish to contact us about any of the rights described above please do so. We do have a form which can be returned via email to dataprotectionofficer@stoswaldsuk.org, however you can make this request in any format and  an email or letter would also suffice as long as you provide sufficient information to enable us to complete this request.

You are not required to pay any charge for exercising your rights.

Please note that we may ask for proof of identification before processing any request.

You have the right to ask for a copy of the personal information St Oswald’s Hospice holds about you.

Please direct any requests to access personal data to the data protection officer at dataprotectionofficer@stoswaldsuk.org, or on 0191 2850063.

When requesting clinical information, a consultant with specialist training (the Caldicott Guardian) will review the information before it is disclosed to ensure that no information is shared inappropriately.

We will aim to respond to your request within one month however if it is a complex request we will keep you informed of any potential delay.

You can read more about subject access requests on the ICO website by clicking this link.

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

When you ask us to rectify any information we hold about you we will take reasonable steps to investigate whether the data is already accurate or needs to be amended.

We will then contact you to confirm the data has been corrected, deleted or added to. If we believe the data is accurate and therefore disagree with your request we will write to you to inform you of our decision and rationale.

The ICO offers additional guidance about this, which you can access here

You have the right to ask us to erase your personal information in certain circumstances. However, there are exclusions to this including:

  • Where we have a legal obligation to keep hold of your data, such as healthcare regulations, employment law, financial regulations.
  • When keeping your data is necessary for establishing, exercising or defending legal claims.
  • If your request relates to clinical information recorded we are not allowed to delete certain notes from your clinical record however in these instances we will make a note that you disagree with the content.

When making a request to be erased from our systems we will confirm that this has been carried out or advise you of the legal reason for not proceeding with your request.

The ICO provides additional guidance on this and you can read more about it here

You have the right to ask us to restrict the processing of your information in certain circumstances for example if you are concerned about the accuracy of data or how it is being used.

The ICO provides additional guidance on this and you can read more about this right here.

You have the right to object to our processing of your data where it relates to processing for our legitimate interests or for direct marketing. If this is the case please contact us using the contact details above and provide us with information about your objections.

The ICO provides useful guidance on this right. You can read more about this right here.

We would always attempt to accommodate requests to access your data in a portable version, however we do not currently have any systems that would support the electronic transfer of data as outlined in GDPR. Healthcare records can be shared with consent via SystmOne, the national Summary Care Record or via sending paper notes if systems are incompatible. However, we will consider on a case-by-case basis and do our best to respond where we can.

This privacy notice does not cover how any partner organisations processes personal information; this includes any external links connected to our website. We encourage you to read the privacy notices on the other websites you visit. We do work with partner organisations to ensure that appropriate data sharing agreements or appropriate terms and conditions are in place to ensure that they are equally compliant in keeping your data as safe as we do.

We work to high standards when it comes to processing your personal information. If you have queries or concerns about St Oswald’s Hospice handling of your data or that of anyone working on our behalf, please contact us at dataprotection officer@stoswaldsuk.org.

If you remain dissatisfied with any immediate response to a particular situation, we will escalate this using our complaints policy.  If you continue to have concerns you can report them with the ICO at https://ico.org.uk/make-a-complaint/

Your personal data is held on secure servers operated by both St Oswald’s Hospice and agencies contracted by us. We do not transfer your data outside the European Economic Area (EEA) and we comply with the protection offered to you under the GDPR and the Privacy and Electronic Communications Regulations 2003 EC Directive (PECR).

Personal data is collected and stored securely subject to stringent security measures and is protected against misuse. When we use external data processing services, we do so only under strict contractual terms to mirror the security policies that we have in place.

The information we collect will depend entirely on our relationship with you.

As clinical, fundraising and internal human resources information is collected for entirely different purposes, we do not pass information between the different systems in order to protect your confidentiality unless you have given consent for us to do so. The only exception to this is when a patient dies we will inform our fundraising team with the sole purpose of ensuring that any supporters who have died while receiving care with St Oswald’s Hospice are not contacted inappropriately causing distress to the family.

Purpose and lawful basis for processing

If you are referred to St Oswald’s Hospice clinical services, the purpose of collecting your personal and sensitive health information is to provide you with appropriate and safe healthcare.  We may from time to time also ask you for additional information for the purposes of audit or research.

We do have a legal obligation to maintain healthcare records as set out in Regulation 17 or the Health and Social Care Act 2008, Regulations 2014, and as such, we need to capture information about you and your care to provide you with safe and effective treatment. The provision of healthcare is also accommodated in section 9(2)h of the GDPR.

When starting to use our services, a member of the clinical team will seek your consent to share this information with other healthcare professionals involved in your care. We will seek additional consent in the event of your participation in any additional activities outside of this purpose, for example the use of photographs for teaching materials. We may also ask your consent to use any photographs for marketing purposes and this will be done very explicitly, no photographs or data will be used for this purpose without your consent.

What we need

If you are a patient we will need to collect information about you, your condition and others involved in your care in order for us to be able provide the best possible care to you.

The Data Protection legislation splits data into categories including personal and sensitive data, we will collect both kinds of data from you as set out below.

Personal information

The personal information we hold about you may include the following:

  • Name, address, date of birth.
  • Telephone numbers.
  • Next of kin / emergency contact.

Sensitive Personal Information (special category data)

The sensitive personal information we hold about you may include the following:

  • Details of your current or former physical or mental health. This may include information about any health care you have received or need, including about clinic and hospital visits and medicines administered.
  • Details of services you have received from us.
  • Information relevant to your continued care from other people who care for you or know you well, such as other health professionals and relatives.
  • Details of your race and/or ethnicity.
  • Details about any disabilities.
  • Details about your language preferences.
  • Details of your religion.
  • Details of any relevant genetic data or biometric data relating to you.
  • Data concerning your sexual orientation.

The confidentiality of your medical information is of paramount important to us, therefore we make every effort to prevent unauthorised access to and use of information relating to your current or former physical and mental health.

Why we need it

We are obliged by Health Care legislation to keep ongoing records of the treatment provided to you. It is also an important tool to be able to share plans and progress between the team members involved in your care.

What we do with it

We gather health information about you from a number of sources including

  • directly from you,
  • from the person referring you to our service
  • from other people involved in your care

We keep your data primarily on a patient information system called SystmOne which is a product used by many NHS providers and allows us the capability to share appropriate information, with your consent, with other users of the system involved in your care.

Some services also keep paper notes for the day-to-day elements of care.

All clinical notes are reviewed and updated by the clinical team looking after you.

We may from time to time offer you the opportunity to become involved with research projects linked to St Oswald’s, in these cases your direct consent will be obtained and the care of your data will be outlined as part of the project as it may differ from project to project.

In order to continue to improve our services and respond to the changing needs of service users we may from time to time contact you to contribute to surveys or focus groups. Participation is always voluntary and where possible anonymous.

How long we keep it

We will keep you clinical record for 8 years after your discharge from the service, or for 25 years if you are a child using our service. Your notes may be kept for longer in very particular circumstances such as involvement in a clinical trial but in these instances specific consent would be obtained.

Data collected from surveys are retained anonymously and destroyed after they have been summarised and any feedback analysed.

Purpose and lawful basis for processing

We collect the details of family members and emergency contacts for patients in our care. We do this under the grounds of Legitimate Interest of the person in our care to provide the best possible support to them and their loved ones. There is also the Legitimate Interest of the family members who require support as a carer in their own right or become bereaved who may choose to receive support from our bereavement team.

 

What we need

Names and contact details of your next of kin or emergency contact as well as other people important to you.

Why we need it

As a Hospice we provide holistic care to palliative care patients and also support for families and carers. As such it is important to understand family dynamics, who information is to be shared with and also identify who may need to be referred for additional support within our carer support or bereavement services.

What we do with it

We record this information as part of the clinical record of the patient. If you are referred for carer or bereavement support you will be registered as a patient / client in your own right and the details given in the section about patient data above will also apply.

We will use the data to invite you to a memorial service or advise you of other services that may be of benefit to you following the death of a loved one.

We will not pass your data on to our fundraising department.

We may occasionally invite you to contribute to surveys or focus groups so that we can better understand the needs of friends and families when their loved one is accessing services at St. Oswald’s. Participation will be voluntary and often anonymous.

Very occasionally, you may be approached to participate in research in the interests of improving services and Palliative Care more broadly. This will always be explained in full and your explicit consent gathered for any research project.

How long we keep it     

As your data forms part of the clinical record, it will be kept for 8 years after the patient is discharged or 25 years if they are a child.

Any survey data will be destroyed after it has been analysed and all reports will be completely anonymous.

Purpose and lawful basis for processing

We use the information we have collected in order to;

  • manage the recruitment process
  • assess and confirm a candidate's suitability for the role and decide who will be appointed
  • to make reasonable adjustments to the recruitment process for candidates who have a disability in line with our legal obligations
  • to ensure effective general HR/Volunteer administration
  • to respond to and defend against legal claims
  • information such as ethnic origin, sexual orientation, religion or belief, is used for the purposes of equal opportunities monitoring with the explicit consent of applicants, which can be withdrawn at any time.

Please note: This list is not exhaustive and we will update it periodically to reflect any major changes.

We will not use your data for any purpose other than the recruitment exercise for which you have applied.

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are;

  • legitimate interest – we need the information to enable us to assess your suitability for the position you have applied for prior to entering into a contract or volunteer/employment/work placement relationship with you
  • we have a legal obligation - for example we must check eligibility to work in the UK before employment starts

What we need

The list below shows the main categories of personal data we may collect:

  • personal identifiers i.e. name, home address, personal telephone number/e-mail address
  • details of your qualifications, professional membership, skills, experience and work history
  • information about your current level of remuneration (only for paid roles)
  • whether or not you have a disability for which we need to make reasonable adjustments during the recruitment process
  • gender
  • marital status
  • if you have any cautions or convictions which may show on a criminal record check with the Disclosure & Barring Service
  • information relating to your health
  • information about your right to work in the UK
  • personal data which you otherwise voluntarily provide, e.g. ethnicity*, religion*

Please note: This list is not exhaustive and we will update it periodically to reflect any major changes.

Most of the personal data we process is collected directly from you i.e. through CV’s, application forms or collected through interviews or other forms of assessment (including online testing e.g. psychometrics). Occasionally we may be provided with data from recruitment agencies or work placement organisations who you have asked to act on your behalf.

For all paid job applicants we will only seek information from third parties e.g. references, health screening and criminal record checks once a conditional job offer has been made.

For volunteer applicants we will seek references once we have received your completed application form but we will not seek criminal record information (if relevant) until you have been offered a role.

Some personal data is considered highly sensitive and is subject to additional safeguards. The Hospice aims to limit the special categories of personal data which it processes as follows:

  • Health Information

We process health information if we need to make reasonable adjustments to the   recruitment process for applicants who have a disability e.g. whether adjustments need to be made during a test or interview. This is to carry out our obligations and exercise specific rights in relation to employment.

  • Disclosure and Barring Service(DBS) checks/information

Given the nature of our organisation, DBS clearance is required in most roles. All applicants selected for assessment/interview will be asked if they have any cautions or convictions that may show up on a criminal record check.  We will only seek a DBS check (if applicable) once the offer of a role is made and accepted. The HR/Volunteer Department can provide further guidance to applicants on request.

  • Equal Opportunities Monitoring

The Hospice is committed to providing equal opportunities for all applicants and we will process information relating to ethnic origin, race, nationality, sexual orientation, disability etc., alongside information relating to gender and age, for the purposes of equal opportunities monitoring.

. Applicants are entirely free to decide whether or not to provide such data and there are no consequence of failing to do so.

All special categories of data are confidential and will only be shared internally where there is a specific and legitimate purpose to do so.

Why we need it

We use the information we have collected in order to;

  • manage the recruitment process
  • assess and confirm a candidate's suitability for the role and decide who will be appointed
  • to make reasonable adjustments to the recruitment process for candidates who have a disability in line with our legal obligations
  • to ensure effective general HR/Volunteer administration
  • to respond to and defend against legal claimsinformation such as ethnic origin, sexual orientation, religion or belief, is used for the purposes of equal opportunities monitoring and is purely voluntary.

Please note: This list is not exhaustive and we will update it periodically to reflect any major changes.

We will not use your data for any purpose other than the recruitment exercise for which you have applied.

 

What we do with it

Your information will be shared internally for the purposes of the recruitment exercise. This includes members of the HR/Volunteer team, interviewers involved in the recruitment process and managers in the business area with a vacancy.

No automated decision making is involved in our recruitment process.

How long will we keep it

The Hospice takes the security of your data seriously, we have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed and it is not accessed except by those authorised to do so in the performance of their duties.

Paper information is stored in locked cabinets and access is strictly limited to the HR/Volunteer Team, interviewers involved in the recruitment process, managers in the business area with a vacancy and in certain emergency situations the Hospice Management Team (HMT) or Duty coordinator.

Electronic data is stored on the HR/Volunteer Database and Hospice IT systems, including email, with access strictly limited to the HR/Volunteer Team, interviewers involved in the recruitment process, managers in the business area with a vacancy and in certain emergency situations HMT, the Duty coordinator or IM&T Manager.

The Hospice policy is to retain personal data only for as long as needed to fulfil the purpose for which it was collected or otherwise as required under applicable laws and regulations.

If your application is unsuccessful we will keep your personal data on file for:

  • twelve months if you are applying for a paid role
  • six months if you are applying for a volunteer role
  • three months if you are applying for a work placement.

Purpose and lawful grounds for processing

We need the information to enable us to fulfil our obligations as your employer. Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are;

  • we have a contractual obligation for some data;
  • we have a legal obligation for other data items
  • you also have the option to provide some data such as sexuality, ethnicity or disability status for the purposes of equality monitoring. (see * items in the list below)

 

What we need

The list below shows the main categories of personal data we may collect:

  • personal identifiers i.e. name, home address, personal telephone number/e-mail address
  • date of birth
  • driving licence number (if applicable)
  • gender
  • marital status
  • emergency contact information
  • criminal record information
  • information relating to your health
  • photograph (for identification purposes stored on the HR Database* and/or for the issue of a Smartcard)
  • documents evidencing your right to work in the UK
  • bank account details and national insurance number
  • documents gathered during recruitment i.e. cv, application form, references, qualifications
  • documents relating to professional memberships, insurance, essential qualifications, statutory and mandatory training and revalidation.
  • general employment records including details of training, disciplinary and grievance matters, benefits, holiday, other absences, employment contract, performance records (including appraisals)
  • information gathered through the Hospice's monitoring of its IT systems and CCTV recording
  • personal data which you otherwise voluntarily provide, e.g. ethnicity*, religion*

Please note: This list is not exhaustive and we will update it periodically to reflect any major changes.

Most of the personal data we process is collected directly from you i.e. through CV’s, application forms, passport or other identity documents or during meetings held with you. We may also receive personal information indirectly from third parties, such as;

  • previous employers when taking up references
  • medical professionals to assess health before and during employment
  • the Disclosure & Barring Service (Criminal Record Information) to meet our legal obligations in relation to working in an environment with vulnerable adults and/or children.

Special Category Data: Some personal data is considered highly sensitive and is subject to additional safeguards. The Hospice aims to limit the special categories of personal data which it processes as follows:

  • Health Information

The Hospice may process information about an employee's physical or mental health in compliance with its obligations in connection with employment, in particular

  • to administer sick pay entitlements
  • to comply with obligations owed to disabled employees
  • to comply with patient care, health regulatory and health and safety obligations
  • to maintain a sickness absence record
  • to obtain health advice and support from our external Occupational Health Service Provider

All health information is confidential and it will only be shared internally where there is a specific and legitimate purpose to do so. We have implemented appropriate physical, technical, and organisational security measures to secure your personal data against accidental loss and unauthorised access, use, alteration, or disclosure.

  • Disclosure and Barring checks/information (DBS)

Given the nature of our organisation, DBS requirements apply to most employees.

We are required to carry out DBS checks for roles as described in the Criminal Records policy.  In all cases, we carry out the checks in line with the applicable law.

DBS checks will be repeated periodically during the course of employment in line with Hospice protocols.

We will always treat DBS information as confidential and it will only be shared internally where there is a specific and legitimate purpose to do so. We have implemented appropriate physical, technical, and organisational security measures to secure your personal data against accidental loss and unauthorised access, use, alteration, or disclosure.

DBS information will be stored in compliance with DBS rules. DBS information will typically be retained for a maximum period of 6 months or until the next CQC inspection, whichever is the longer, although the date, certificate number, level of check and outcome will remain on the employee's record.

  • Equal Opportunities Monitoring

The Hospice is committed to providing equal opportunities for employment and progression to all of its employees and from time to time we will process information relating to ethnic origin, race, nationality, sexual orientation and disability, alongside information relating to gender and age, for the purposes of equal opportunities monitoring and gender pay gap reporting.

We have implemented appropriate physical, technical, and organisational security measures designed to secure your personal data against accidental loss and unauthorised access, use, alteration, or disclosure.

In addition, this monitoring will always take place in accordance with appropriate safeguards as required under applicable law, including:

  • the provision of information relating to ethnic origin, race, nationality, sexual orientation and disability for the purposes of monitoring will be voluntary and processed for this purpose only
  • the monitoring will be conducted on the basis of using anonymised data so individual employees cannot be identified.

What we do with it

We use the information we have collected in order to;

  • pay your wages and administer any benefits under the employment contract v
  • manage day to day tasks and responsibilities
  • manage and assess performance, including the conduct of annual appraisals
  • consider eligibility for promotion or alternative roles
  • comply with legal requirements, such as reporting to the local tax authority or professional regulators
  • address disciplinary, grievance or health issues with individual employees
  • monitor the proper use of Hospice IT systems
  • prevent fraud or any illegal activity
  • meet our legal obligations in respect of health and safety and disability legislation
  • to ensure effective general HR administration
  • to record all types of absence and leave to ensure effective workforce management and compliance with duties in relation to entitlements and pay/benefits.

Please note: This list is not exhaustive and we will update it periodically to reflect any major changes.

We may share some of this information with;

  • your line manager, certain members of the finance team and/or the relevant Director for your role.
  • the Disclosure & Barring Service
  • the Independent Safeguarding Authority
  • the Care Quality Commission
  • Regulatory bodies i.e. the Nursing & Midwifery Council, or General Medical Council
  • Occupational health and/or external counseling providers
  • our Legal representatives
  • Pension providers
  • HMRC or any appropriate government body

In all cases not governed by regulation or legislation, the employee personal data is shared under the terms of a written agreement between the Hospice and the third party which includes appropriate security measures to protect the personal data in line with this Notice and our obligations. The third parties are permitted to use the personal data only for the purposes which we have identified or as permitted by law, and not for their own purposes, and they are not permitted to further share the data without our express permission.

None of your data will be used for automated decision making.

How long we keep it

The Hospice takes the security of your data seriously, we have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed and it is not accessed except by those authorised to do so in the performance of their duties.

Paper information is stored in locked cabinets and access is strictly limited to the HR Team, your line manager and in certain emergency situations the Hospice Management Team (HMT) or Duty Co-ordinator.

Electronic data is stored on the HR Database and Hospice IT systems,  including email, with access strictly limited to the HR Team, your line manager and in certain emergency situations HMT, the Duty Co-ordinator or IM&T Manager.

The Hospice policy is to retain personal data only for as long as needed to fulfil the purpose for which it was collected or otherwise as required under applicable laws and regulations Current retention periods are shown in the Standard Operating Procedure Library, Document Retention Procedures in Sharepoint. Under some circumstances we may anonymise your personal data so that it can no longer be associated with you.  We reserve the right to retain and use such anonymous data for any legitimate business purpose without further notice to you.

If you have any queries about your personal data held by HR or would like access to your personal data held by St Oswald’s Hospice then please contact them directly on humanresources@stoswaldsuk.org or via the dataprotectionofficer@stoswaldsuk.org email.

Purpose and lawful grounds for processing

The purpose of capturing your personal and potentially sensitive information (i.e. health information for physical events) within income generation (e.g. fundraising) will be for the purpose of processing your donation, organising a sponsored event, processing your gift aid etc. This will be done on the basis of explicit consent which will be gathered from entry forms and other marketing materials.

What we need

What we need will vary depending on the type of fundraising interaction however the most common details collected will be name, contact details, donation details, bank details and for some events, health information.

Patients, staff and volunteers can also be donors, supporters, customers or even patients.

If you are a donor, supporter and/or customer the information we will collect will be that which we require to process your donation, purchase, gift aid donation or to keep you safe during an event.

We collect name and contact details, payment details where appropriate and in addition, we ask you to supply information about the type of person or organisation you are so we understand your relationship with St Oswald’s Hospice so as to tailor future communications to you.

Often people who interact with St Oswald’s Hospice have more than one status within the organisation meaning your data may have been collected a number of times for different purposes by different departments. We do not share your data internally for marketing purposes unless you have given us permission to do so. On most data collection forms within St Oswald’s Hospice we will ask you if you’re happy to receive marketing from us. If you give consent for us to market to you we also ask if you would kindly let us know your status or status’ with us i.e. are you:

  • Name of Organisation (if applicable)
  • A member of staff
  • A volunteer
  • Next of Kin to a patient
  • A patient of ours
  • A friend of relative of a patient
  • We also always give the option: Prefer Not to Say

If you do kindly tick the correct box(es), this gives us permission to use this status information which will help us protect you and send you information more relevant to you in future.

Other areas of the organisation do not share this information with Fundraising unless you have given your consent for them to do so.

In addition to the information you provide, Fundraising may use online platforms such as Facebook, Twitter, Instagram and LinkedIn in order to gather available information about you where relevant.  Any information we are given, or gather about you which is in the public domain, will help us tailor the information we send you to your needs to ensure it is as relevant to you as possible.

What we do with it

If you tell us your status, here is how we will use this information:

If you tell us you are a staff member: We will stop sending printed paper copies of information to your home address and ask that you pick up a newsletter from display points around the Hospice, one of our shops or through internal emails instead. This will help us save money on printing and postage.

If you tell us you are a volunteer: We would like to continue to communicate with you with more relevant information to you such as updates, volunteer opportunities and fundraising, as we know so many volunteers not only give their valued time but also support us in our fundraising and for that we are truly grateful. If you are worried about postage costs and have an email address, we can send a lot of this information to you via email, which will allow us to keep in touch with you without the printing and postage costs. However in order to email you we would need you to stipulate you are happy to receive emails from us.

If you tell us you are a patient: As you are currently receiving support and care from us, if you tell us you are a patient, unless you opt out, we will continue to send you the newsletter to keep you up to date with our activities, but will not send you any direct requests to help fund our service. If you choose not to divulge this information we completely understand but please note that if we do not know you are a patient, you may receive requests from us for funds in future and we apologise if this causes you any distress. Please know this is not our intention. If you do not wish us to know your status please tick the “Prefer Not to Say” option and we will continue to communicate with you as we would any other supporter.

If you tell us you are Next of Kin, or a friend or relative of a current or previous patient: If we have this information within Fundraising this will help us send information to you about service updates and fundraising opportunities we have specifically for people who would like to help in memory of a loved one. Many people choose to fundraise in memory and find it a positive way of helping them to come to terms with the death of their loved one, but there is absolutely no obligation to do this and we understand if you wish to opt out and no longer receive information from us. If you do not wish us to know your status please tick the “Prefer Not to Say” option and we will continue to communicate with you as we would other supporters.

Gift Aid

If you have kindly allowed us to claim Gift Aid back on your donation of money or goods it is your responsibility to let us know if your tax status has changed when you make any further donations. You can do so by contacting enquiries@stoswaldsuk.org telling us your name, address and new status.

Emails and Texts

Under the Data Protection Act 2018, we cannot send marketing information to you via text or email without your specific consent to use these channels, even if you’ve supplied your email address or mobile number to us in the past.

Mail and telephone marketing

It is not a legal requirement that we obtain explicit consent to contact you with marketing information via traditional mail or over the telephone if you have supplied us with your contact details and assuming we are contacting you about something which is relevant to how you’ve contacted us or supported us in the past.

However you can opt out of receiving marketing from us via these channels at any time by emailing supportercare@stoswaldsuk.org or call 0191 246 9123.

It may be that you have played the lottery which is run by St Oswald’s Hospice Promotions Limited but is managed via the same donor platform as other St Oswald’s Hospice Limited events and donations. Your marketing preferences are the same across both companies.

We shall process the data you supply in order that we can assist you and respond appropriately. We will not share or sell your data for marketing purposes outside of St Oswald’s Hospice companies.

Purpose and lawful basis for processing

Our purpose for collecting the information is so that we can provide you with a service and let you know about upcoming events or information that may be of interest to you.

The legal basis we rely on for processing your personal data is your consent under article 6(1)(a) of the GDPR.

What we need

To subscribe to one of our newsletters we need your name and email address.

Why we need it

To be able to send the newsletters as cost effectively as possible we distribute them via email.

What we do with it

We only use your details to provide this service, we do not pass your details on. We gather statistics about email opening and clicks using industry standard technologies  including Clear Gifts and Mailchimp to help us monitor and improve our newsletter.

How long we keep it

We will keep your details until you unsubscribe from the service. As you may opt to receive other services from us, we may need to retain your details to record the fact you no longer want to receive a particular newsletter.

Use of data processors

We use external suppliers to deliver the e-newsletter, currently Mailchimp. For more information, see the Mailchimp privacy notice.

Purpose and lawful basis for processing

Our purpose for collecting the information is so that we can respond to your complaints or enquiry appropriately.

The legal basis we rely on for processing your personal data is Legitimate Interest of both parties in resolving the issue or query raised and to comply with our legal obligation to respond to your requests under the Data Protection Act.

What we need

Contact details, details of your request and additional information needed to verify your identity.

Why we need it

To be able to investigate a complaint, respond to your query or request.

What we do with it

We only use your details to provide a response to you, we then retain a minimal log of complaints and access requests to be able to monitor the service and how it can be improved. We are also required to share anonymised versions of the logs with the NHS under the provision of the NHS contract.

How long we keep it

We keep a log of complaints for eight years from the date of the complaint and data subjects rights requests are retained for three years from the date of request.

Use of data processors

All logs are maintained on Microsoft software internally to St Oswald’s Hospice.

Purpose and lawful basis for processing-

Our purpose for collecting this information is so we can facilitate the event and provide you with an acceptable service. The legal basis we rely on for processing your personal data is your consent under article 6(1)(a) of the GDPR. When we collect any information about dietary or access requirements we will do so purely for your own safety and participation in the event. Such data will not be retained after the event has taken place.

What we need

If you wish to attend one of our events, you will be asked to provide your contact information including your organisation’s name and, if offered a place, information about any dietary requirements or access provisions you may need. We may also ask for payment if there is a charge to attend.

Why we need it

We use this information to facilitate the event and provide you with an acceptable service. We also need this information so we can respond to you.

What we do with it

If you are not successful in securing a place, we will let you know and hold your details on a reserve list in case a place becomes available. If you are allocated places at an event, we will ask for information about any dietary/access requirements. We will not share this information in any identifiable way with the venue, and we delete it after the event.

How long we keep it for

Your attendance at a course may be retained on your personnel file, otherwise your data will be deleted after the provision of the course.

Use of data processors

We use data processors to help facilitate the events. We collect registration information from some of our conference microsites, this will be clear in any communications about the event. We would encourage you to check their privacy notices.  We may sometimes charge a fee to attend an event. If this happens, our communications about the event will provide details of the data processor we use to collect payments.

We hold the names and contact details of individuals acting in their capacity as representatives of their organisations, across the business. If this relates to interactions regarding our regulatory functions, the legal basis is article 6(1)(e) of the GDPR. If the interactions relate to suppliers, contracts, buildings management, IT services etc., the legal basis is article 6(1)(b) in relation to managing your contract with us, article 6(1)(c) of the GDPR for any legal obligation, or article 6(1)(f) because the processing is within our legitimate interests as a business.

We do monitor any emails sent to us, including file attachments, for viruses or malicious software. You must ensure that any email you send is within the bounds of the law.

St Oswald’s Hospice website contains links to our social media pages where we operate our business accounts. These social media pages are hosted and operated by third parties under their own differing privacy policies. Should you choose to access one of our social media pages, you will be leaving St Oswald’s Hospice website, this Privacy Policy will no longer apply and you will be bound by the Terms and Conditions of the external Social Media site. Upon entering the Social Media site, it is your responsibility to abide by the relevant Terms and Conditions and we accept no responsibility for your misuse of any social media site.

Purpose and lawful basis for processing-

We operate a variety of Social Media pages to allow us to operate our business, provide information about fundraising events, retail services and maximise revenue income. We also provide links to Social Media sites of partner organisations that we feel could be of legitimate interest to our supporters, patients and their families.

What we need

For social media pages that we operate, we require the supporter to request to follow our relevant social media channel.

Why we need it

To allow us to showcase our services, provide communication about the Hospice and our fundraising activities to generate awareness and fundraising income via Social Media pages and engagement with our followers.

What we do with it

We gather statistics around social media traffic and click through rates to help us monitor and improve our online presence. We are able to view the profiles of our supporters online depending on how much information they have shared via their own personal privacy settings. We engage with our supporters via social media and answer their queries online.

How long we keep it for

Our supporters follow our social media pages until either they choose to unfollow the page, they request that we remove them from the page or we choose to deactivate or close that social page.

Use of data processors

All our social media pages and their content are stored on external servers run by external providers.

Prevention and detection of a crime: Closed Circuit Television is in use on the exterior of the St Oswald’s Hospice site and in some retail units. Where CCTV is in use, there are signs clearly displayed. CCTV is used for the prevention and detection of crime. Access is limited to specific personnel and will only be shared in the event of a potential or actual crime being committed. Data is retained for 14 days unless a request for disclosure is made in which case it will be retained until the investigation is complete and the images are no longer required.

Sharing your personal data and information: There may be rare occasions when we are asked to disclose personal data or information to the police or other enforcement agencies. We will consider this on a case by case basis and aim to minimise data that is shared while still supporting the prevention or detection of crime.

Cookies: These are small files that are widely used in order to make websites work more efficiently. Most web browsers allow some control of cookies through browser settings. To find out more about cookies, including how to see what cookies have been set and how to manage or delete them from your computer, visit www.allaboutcookies.org.

St Oswald's Hospice may, from time to time, engage in re-marketing, which means third-party vendors, including Google, may display St Oswald's Hospice adverts on the internet, based on your prior interaction with the St Oswald's Hospice website. To find out more about how Google uses any data it collects please visit google.com/privacy_ads.html. Any information collected via cookies is used solely for this purpose and no other purpose.

External links: The St Oswald’s Hospice website contains some links to websites operated by third parties under different privacy policies. Should you choose one of those links, you will be leaving St Oswald’s Hospice site and this Privacy Policy will no longer apply.

Automated Decision Making: We will not use your personal data for automated decision making within any of our services or functions listed above.

Copyright: Copyright © St Oswald's Hospice, all rights reserved. Unless otherwise stated, the copyright of all the information, materials, images, logos, downloadable documents and video content on this website belongs to St Oswald's Hospice Ltd. Information may not be published in any other format without the express written permission of the Hospice.

Changes to this Policy: If we decide to change our Privacy Policy, we shall post changes on this page so that you are always aware of how St Oswald’s Hospice uses your personal information.

Transparency: We have chosen not to upload all of our policies onto the website however should you wish to view any of our data protection policies you are more than welcome to request them via our email address. dataprotectionofficer@stoswaldsuk.org

Photographs and Video Imagery: At St Oswald’s Hospice we often take photographs and videos most commonly for marketing and promotional purposes but occasionally it may be for medical reasons. Where necessary we will ask for written consent from participants and this can be withdrawn at any time simply by contacting a member of the communications team or the care team in the case medical photography. You should note that we are highly likely to be taking photographs and videos at events arranged by ourselves and sometimes events organised by our supporters. We consider these to be public events and as such do not obtain consent but will make every effort to make participants aware when photographs are being taken.  When working with schools, we will adhere to the schools own consent arrangements for the taking and use of photographs and videos.

We may use photographs on the website, social media pages, newsletters or printed material such as leaflets or posters in order to promote the work of the hospice or fundraising efforts.

We try to take a common sense approach to the handling of imagery with relation to data protection and as such will review issues as and when they arise. If you have any concerns about any photographs or videos in use please contact the communications team on enquiries@stoswaldsuk.org.

Ongoing Development: St Oswald’s Hospice Limited is committed to improving services for patients and families and the working environment for staff and volunteers. We may occasionally offer you the opportunity to participate in research, audit or satisfaction surveys in order to help us develop and audit current services and support innovation in Palliative Care. All participation is voluntary and any resulting reports will be anonymous and presented in a summarised form before being shared with a wider audience. Where necessary your explicit consent will be sought when entering a research project and can be withdrawn at any stage.

As a provider of some NHS Services, St Oswald’s Hospice is also compliant with the National Data Opt Out Scheme which is a service that allows patients to opt out of their confidential paper information being used for research and planning. Patients can find out more and view or change their national data opt-out choice at any time by using the online service at www.nhs.uk/your-nhs-data-matters or by calling 0300 3035678.

Track and Trace:  Where required to do so by the government or to support the NHS Track and Trace system in the fight against COVID-19, St Oswald’s Hospice may collect and share details of staff, volunteers, visitors or patients. Where this is the case notices will be made clear at signing in points and this information will be destroyed securely after 21 days. If you object to your data being used for this purpose please let us know via the dataprotectionofficer@stoswaldsuk.org

Compliance with the NHS National Data Opt-out Operational Policy: 

As a health and care provider, we comply with the NHS National Data Opt-out Operational Policy.

Your health records contain a type of data called confidential patient information. This data can be used to help with research and planning.

Research and planning using your confidential patient information might also be used to plan and improve health and care services, and / or research and develop cures for serious illnesses.

You can choose to stop your confidential patient information being used for research and planning. You can also make a choice for someone else like your children under the age of 13.

Your choice will only apply to the health and care system in England. This does not apply to health or care services accessed in Scotland, Wales or Northern Ireland.

If you're happy with your confidential patient information being used for research and planning you do not need to do anything.

Any choice you make will not impact your individual care.

For more information on this NHS Data Opt-out policy, please visit www.nhs.uk/your-nhs-data-matters

NHS National Data Opt-out downloadable forms:

We keep our privacy notice under regular review to make sure it is up to date and accurate. It was last reviewed in September 2020.

St Oswald’s Hospice Promotions Limited Privacy Statement

This is the Privacy Policy of St Oswald’s Hospice Promotions Limited, registered Address: Regent Avenue, Gosforth, NE3 1EE.  Company Number 03146260

Gambling Operations Number 000/005230/N/30378110004

St Oswald’s Hospice Promotions Limited is a wholly owned, non-charitable subsidiary of St Oswald’s Hospice Limited and is a company registered in England number 03146260.

The primary activities of the subsidiary are: to run a lottery and to co-ordinate other promotional or trading activities to generate funds for the charity.  Taxable profits generated by the subsidiary are passed on to the parent company by Gift Aid.

We at St Oswald’s Hospice Promotions Limited aim to be as transparent as we can about how and why we communicate with you and how we will use your personal information.

St Oswald's Hospice Promotions limited is committed to protecting the personal information of all those who provide it, regardless of the reason, whether it is provided online or offline.

As a subsidiary company many of the support services are provided fully or partially by St Oswald’s Hospice Limited on behalf of St Oswald’s Hospice Promotions limited and as such data is shared across shared systems. This privacy statement aims to make instances of this clear and transparent. Your data is only shared between St Oswald’s Hospice Promotions Limited and St Oswald’s Hospice limited in order to fulfil the obligations of managing the lottery securely and providing support services.

In this statement we will tell you:

  • why we are able to process your information
  • what purpose we are processing it for
  • whether you have to provide it to us
  • how long we store it for
  • who we share it with

St Oswald’s Hospice Promotions Limited is the data controller (based on the definitions in the General Data Protection Regulations - GDPR) for the personal information we process, unless otherwise stated.

There are many ways you can contact us, including by phone, email and post.

Our postal address:

Data Protection Officer
St Oswald’s Hospice
Regent Avenue
Gosforth
Newcastle upon Tyne
NE3 1EE

Switchboard Number: 0191 2850063

Email: dataprotectionofficer@stoswaldsuk.org

Regardless of your status you can contact us about any of the data issues below at any time at any of the contact details above.

Please mark any correspondence for the attention of the Data Protection Officer.

Most of the personal information we process is provided to us directly by you for one of the following reasons:

  • You are a member of our lottery scheme.
  • You have made a complaint or enquiry to us.
  • You have applied for a job or secondment with us or continue to work for us as a member of staff or a volunteer.
  • You are representative of your company/organisation/association.
  • You are a supplier or contractors

You may fit into more than one category so please read any sections that apply to you.

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information. If you wish to contact us about any of the rights described above please do so. We do have a form which can be returned via email to dataprotectionofficer@stoswaldsuk.org however an email or letter will suffice as long as you are clear about the request you are making.

We will aim to respond to your request within one month however if it is a complex request we will keep you informed of any potential delay.

You are not required to pay any charge for exercising your rights.

Please note that we may ask for proof of identification before processing any request.

 

You have the right to ask for a copy of the personal information St Oswald’s Hospice Promotions Limited holds about you and to correct any inaccuracies in that information.

Please direct any requests to access personal data to the data protection officer at dataprotectionofficer@stoswaldsuk.org, or on 0191 2850063

You can read more about subject access requests on the ICO website by clicking this link.

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

When you ask us to rectify any information we hold about you we will take reasonable steps to investigate whether the data is already accurate or needs to be amended.

We will then contact you to confirm the data has been corrected, deleted or added to. If we believe the data is accurate and therefore disagree with your request we will write to you to inform you of our decision and rationale.

The ICO offers additional guidance about this which you can access here

You have the right to ask us to erase your personal information in certain circumstances. However there are exclusions to this including:

  • Where we have a legal obligation to keep hold of your data, such as healthcare regulations, employment law, financial regulations.
  • When keeping your data is necessary for establishing, exercising or defending legal claims.

When making a request to be erased from our systems we will confirm that this has been carried out or advise you of the legal reason for not proceeding with your request.

The ICO provides additional guidance on this and you can read more about it here

You have the right to ask us to restrict the processing of your information in certain circumstances for example if you are concerned about the accuracy of data or how it is being used.

The ICO provides additional guidance on this and you can read more about this right here.

You have a right to object to our processing of your data in various situations, including where it relates to processing for our legitimate interests or for direct marketing.

We would always attempt to accommodate requests to access your data in a portable version, however we do not currently have any systems that would support the electronic transfer of data as outlined in GDPR. Healthcare records can be shared with consent via SystmOne, the national Summary Care Record or via sending paper notes if systems are incompatible. However, we will consider on a case-by-case basis and do our best to respond where we can.

This privacy notice does not cover how any partner organisations processes personal information; this includes any external links connected to our website. We encourage you to read the privacy notices on the other websites you visit. We do work with partner organisations to ensure that appropriate data sharing agreements or appropriate terms and conditions are in place to ensure that they are equally compliant in keeping your data as safe as we do.

We work to high standards when it comes to processing your personal information. If you have queries or concerns about St Oswald’s Hospice handling of your data or that of anyone working on our behalf, please contact us at dataprotection officer@stoswaldsuk.org.

If you remain dissatisfied with any immediate response to a particular situation, we will escalate this using our complaints policy.

If you remain dissatisfied you can also raise your concerns with the ICO directly at https://ico.org.uk/make-a-complaint/

Your personal data is held on secure servers operated by both St Oswald’s Hospice Limited on behalf of St Oswald’s Hospice Promotions Limited and agencies contracted by us. We do not transfer your data outside the European Economic Area (EEA) and we comply with the protection offered to you under the GDPR and the Privacy and Electronic Communications Regulations 2003 EC Directive (PECR).

The systems in use are Donorflex (used for the lottery) and Kudos (used to capture gift aid information and goods donations accepted within the shops).

Personal data is collected and stored securely subject to stringent security measures and is protected against misuse. The sharing of information between St Oswald’s Hospice Promotions Limited (data controller) and St Oswald’s Hospice Limited (data processor) is to be set out in the memorandum of understanding between the two companies.

St Oswald’s Hospice Promotions limited is not involved in the care provided by St Oswald’s Hospice limited and as such does not have access to data held on clinical systems. The one exception to this is that if a service user dies the information is passed to the fundraising department to ensure that no inappropriate communication is sent to the deceased individual. There is an expectation from the public that this would also include notifying the lottery system and therefore the data is shared with St Oswald’s Hospice Promotions Limited for this purpose only.

A small number of people work solely for St Oswald’s Hospice Promotions Limited. All HR functions from application, employment from starting to leaving are managed by St Oswald’s Hospice Limited on behalf of St Oswald’s hospice Promotions Limited, the relevant privacy statement can be found above.

Purpose and lawful grounds for processing

The purpose of capturing your personal information will be for processing your participation in the lottery scheme. This will be done on the basis of explicit consent which will be gathered from entry forms.

What we need

In order to process your lottery entry we need are your name, contact details, number of tickets and bank details.

Sharing your data

St Oswald’s Hospice Promotions Limited utilises a donor database (Donorflex) to manage the lottery and all other donations to St Oswald’s Hospice, as such being a lottery player generates a donor account on Donorflex. If you are also a donor in other ways, all of your generosity is recorded on one donor record and as such is shared between the two companies by being on a shared database. We use a single marketing preferences system across the two companies as if we were a single company, therefore when you join the lottery, make a donation through participation in an event, or by regular giving your marketing preferences are the same across the two companies.

Communicating with you

Under the Data Protection Act 2018, we cannot send marketing information to you via text or email without your specific consent to use these channels, even if you have supplied your email address or mobile number to us in the past.  We would generally communicate with you by post or telephone in order to process any winning claims or issues with ticket purchases.

Mail and telephone marketing

It is not a legal requirement that we obtain explicit consent to contact you with marketing information via traditional mail or over the telephone if you have supplied us with your contact details and that we are contacting you about something which is relevant to how you’ve contacted us or supported us in the past. By ‘us’ we mean both St Oswald’s Hospice Limited and St Oswald’s Hospice Promotions Limited.

However you can opt out of receiving marketing from us via these channels at any time by emailing supportercare@stoswaldsuk.org or call 0191 246 9123.  These preferences as stated above will be used across St Oswald’s Hospice Limited and St Oswald’s Hospice Promotions Limited.

We shall process the data you supply in order that we can assist you and respond appropriately. We will not share or sell your data for marketing purposes outside of St Oswald’s Hospice Limited or St Oswald’s Hospice Promotions Limited.

Photographs and Video Imagery: At St Oswald’s Hospice Promotions Limited we may take photographs and videos most commonly for marketing and promotional purposes such as in the event of a lottery win. Where necessary we will ask for written consent from participants and this can be withdrawn at any time simply by contacting a member of the communications team on enquiries@stoswaldsuk.org.

Support services for managing data protection requests, complaints and enquiries are provided by St Oswald’s Hospice Limited (data processor) on behalf of St Oswald’s Hospice Promotions Limited (data controller).

Purpose and lawful basis for processing

Our purpose for collecting the information is so that we can respond to your complaints or enquiry appropriately.

The legal basis we rely on for processing your personal data is Legitimate Interest of both parties in resolving the issue or query raised and to comply with our legal obligation to respond to your requests under the Data Protection Act.

What we need
Contact details, details of your request and additional information needed to verify your identity.

Why we need it
To be able to investigate a complaint, respond to your query or request.

What we do with it
We only use your details to provide a response to you, we then retain a minimal log of complaints and access requests to be able to monitor the service and how it can be improved. We are also required to share anonymised versions of the logs with the NHS under the provision of the NHS contract.

How long we keep it
We keep a log of complaints for eight years from the date of the complaint and subject access requests are retained for three years from the date of request.

Use of data processors
All logs are maintained on Microsoft software within St Oswald’s Hospice Limited on behalf of St Oswald’s Hospice Promotions Limited.

We hold the names and contact details of individuals acting in their capacity as representatives of their organisations, across the business. If this relates to interactions regarding our regulatory functions, the legal basis is article 6(1)(e) of the GDPR. If the interactions relate to suppliers, contracts, buildings management, IT services etc., the legal basis is article 6(1)(b) in relation to managing your contract with us, article 6(1)(c) of the GDPR for any legal obligation, or article 6(1)(f) because the processing is within our legitimate interests as a business.

We do monitor any emails sent to us, including file attachments, for viruses or malicious software. You must ensure that any email you send is within the bounds of the law.

Ongoing Development: St Oswald’s Hospice Promotions Limited is committed to improving services and developing opportunities for raising additional income to support St Oswald’s Hospice services. We may occasionally offer you the opportunity to participate in research, audit or satisfaction surveys in order to help us develop and audit current services and support innovation. All participation is voluntary and any resulting reports will be anonymous and presented in a summarised form before being shared with a wider audience. Where necessary your explicit consent will be sought when entering a research project and can be withdrawn at any stage.

Track and Trace:  Where required to do so by the government or to support the NHS Track and Trace system in the fight against COVID-19, St Oswald’s Hospice may collect and share details of staff, volunteers, visitors or patients. Where this is the case notices will be made clear at signing in points and this information will be destroyed securely after 21 days. If you object to your data being used for this purpose please let us know via the dataprotectionofficer@stoswaldsuk.org

If we decide to change our Privacy Policy, we shall post changes on this page so that you are always aware of how St Oswald’s Hospice Promotions Limited uses your personal information.

We keep our privacy notice under regular review to make sure it is up to date and accurate. It was last reviewed in September 2020.

Memorandum of understanding

St Oswald’s Hospice Promotions Limited shall for the purposes of the lottery and the management of any staff employed solely by the promotions company, act as the Data Controller with St Oswald’s Hospice Limited acting as Data Processor on their behalf. The two companies will share data processing databases for managing donor activities, gift aid and also for staff management. The two companies will hold separate registrations with the Information Commissioners Office and as such any breaches relating to data processed by or on behalf of St Oswald’s Hospice Promotions Limited will be notified to the ICO as and when required and assigned to the relevant company registration or both if necessary and appropriate. The two companies will share a Data Protection Officer and will work to the same policies and procedures with the exception of the Privacy Notice which will indicate clearly the responsibilities of each company. All data processing and data protection management shall be carried out in line with the Data Protection Act and St Oswald’s Hospice Limited will manage day to day requirements including data subject access requests on half of St Oswald’s Hospice Promotions Limited. An annual report will be provided to St Oswald’s Hospice Promotions Limited providing an overview of any data protection issues, developments or concerns.