St Joseph’s Hospice takes privacy and the protection of personal and sensitive information seriously.  We are committed to protecting your data and complying with the data regulations to their full extents. Our Privacy Policy explains how we use and protect your personal information, to show that we are adhering to the new General Data Protection Regulation (GDPR), which came into force in 25th May 2018.

It explains how we collect and use the personal information that you provide to us whether in person, online or via phone, email, letter or other correspondence, this includes data from our website  and  sets out  how St Joseph’s Hospice uses and protects any information that you give us.

Privacy Policy
St Joseph’s Hospice is committed to protecting your privacy and right to confidentiality. We comply with GDPR and NHS requirements concerning confidentiality and information security standards.

The policy explains how we use any personal information we collect about you based on your relationship with St Joseph’s Hospice, detailing how we collect data, how we store it, and how we use it.

 

St Joseph’s Hospice is a registered charity (Charity Number 1113125) committed to providing high quality palliative care and support to local people affected by life-limiting and terminal illness. The GDPR require every organisation that processes personal information to be registered with the Information Commissioner’s Office. Our registration number is Z9386348.

If you have any questions or queries about this Privacy and Data Protection statement, please contact our Data Protection Officer (DPO) using the contact details outlined at the end of this document.

How we collect information

We obtain personal information from you when you are referred or enquire about our services and activities, register, apply to volunteer or work with us, send or receive an email, make a donation to us, ask a question about our services or otherwise provide us with your personal information. Sometimes we may obtain your personal information from third party data suppliers only if they provide the appropriate evidence that you have agreed for your personal information to be shared with other organisations.

We also gather non-identifiable general information about the use of our websites such as pages visited and areas that are of most interest to users. We use this information to improve our website and make it a better experience for everyone. For further information please see the cookies section below.

Cookies

 St Joseph Hospice uses “cookies” to help track and monitor the usage of our website and to improve the overall user experience. The information we collect and share is anonymous and does not personally identify you. It does not contain your name, address, telephone number or email address.

What information we collect

 The personal information we collect might include name, address, email address, telephone numbers, date of birth, bank account details (for setting up regular Direct Debit or payment information), and your family relationships to avoid duplicating communications.

The GDPR recognise that certain categories of personal information are more sensitive. These are known as special categories of data and cover health information race and religious beliefs – this list is not exhaustive.  We do not usually collect special categories of data about our supporters.

However, we will collect sensitive data where necessary for example in cases where there is a statutory requirement.

Regarding supporters, we will use your information to contact you with news about our work and how you can support us.  Your information may be used for analysis purposes to help us ensure you receive appropriate and relevant communications from us. We will not share, sell or rent your personal information to third parties for marketing purposes – we do, however, share your information with third parties working on our behalf.

Personal data is only accessible by appropriately trained staff and volunteers who need to access your personal information as an essential part of their role. We employ security technology including firewalls and encryption to safeguard personal data and have procedures in place to ensure that paper and computer systems and databases are protected against unauthorised disclosure, use, loss and damage.

How we use this information

 We may use your personal information for:
• Providing and personalising our care and support services
• Dealing with your enquiries requests and complaints
• Processing your donations
• Providing you with information about our work activities, events and services
• Complying with our legal obligations policies and procedures
• Fundraising
• Conducting market research, recruitment, training, and compliance with employment law

How we protect your information

We adopt appropriate data collection, storage, and processing practices, and security measures to protect against unauthorised access, alteration, disclosure, or destruction of your personal or transactional data stored on our website and systems.

We have security procedures, rules and technical measures to protect your data. Your data will be kept in a secure environment with access restricted on a need to know basis.

We don’t keep your data for longer than is necessary for the purpose for which it is obtained, in accordance with our internal policies. Health Care Records are initially retained for eight years from the date of the last interaction, after which point they are archived.

Other departmental records including fundraising, employee records and finance are all held for a period of 6 years.

PATIENTS AND SERVICE USERS

Where we collect information about you
If you are referred to one of our clinical services, we will collect data from you and may also receive and share it where necessary with other healthcare providers.  Our current lawful basis for collecting personal information is contained within Articles 6 and 9 of the GDPR.

In order to provide complete care we may also collect some information about family members and carers. Where Next of Kin or family details are provided within clinical services, this information will not be passed to Fundraising or any other internal department without explicit consent. However, information is passed onto our Bereavement Support Team when a patient dies to enable an offer of Bereavement Support to be made directly to a patient’s loved ones.

If you stay on or visit our premises, such as our Inpatient Unit, we may collect your image on CCTV. We may take photographic images of you for medical purposes, with your prior consent, such as in the case of pressure ulcers, to assist in your care. We also receive data about our patients and their families and carers from other healthcare providers.

What information we collect about you

Personal data we collect may include one or more of the following:
• Patient details such as name, address, telephone number, email address, date of birth
• Patient Health Care Records (electronic or paper) with consent
• Patient GP details (plus other involved health care professionals)
• Patient representative details, such as name, address, telephone number and email address. In addition, we may need to contact other agencies for relevant health or social care information for the benefit of our patients’ care.

How we use your information
We use your personal data for a number of purposes including the following:
• Information relating to diagnosis, treatment and care will be shared across our multi-disciplinary hospice teams to ensure all our healthcare professionals are updated for continuing care
• Advising patient representatives (keeping in touch)
• If appropriate, information will be shared with external healthcare professionals such as GPs, Hospitals and other involved health care professionals, such as our contracted Pharmacy
•  For medical research and educational purposes.
Legitimately, we are allowed to process your data for one or more of these reasons:
• We have consent to use your information for continuing health care and support
• It is necessary for compliance with a legal obligation to which we are subject (for example a change in the law)
• We have a legitimate interest to do so – for example, where consent is absent and we need to provide immediate care
• It is in the public interest to do so (for example, a notification of infectious diseases (NOID) that need to be reported to the Local Authority health protection team)
• Data disclosure may be required by law, for example to government bodies and law enforcement agencies.

Rest assured, we never share, sell, swap or rent your data to third parties for marketing purposes.

STAFF

Where we collect information about you
If you apply to work at St Joseph’s Hospice we will only use the information you give us to process your application and to monitor recruitment statistics. If we want to disclose information to someone outside the hospice – for example, if we need a reference, or need to get a criminal record check from the Disclosure and Barring Service – we will make sure we tell you beforehand, unless we are required to disclose this information by law.

 

What information we collect about you

If you are unsuccessful in your job application, we will hold your personal information for 12 months after we’ve finished recruiting the post you applied for. After this date we will destroy or delete your information. We keep de-personalised information about applicants to develop our recruitment processes, but this does not contain any information that could be used to identify individual job applicants.

If you begin employment with us, we will put together a file about your employment. We keep the information in this file secure, and will only use it for matters that apply directly to your employment.

Once you stop working for us, we will keep this file according to our record retention guidelines. You can contact us to find out more about this.

How and why we use your information
We collect this information so that we can ensure staff fulfil their roles and responsibilities as detailed within their job description. We also have to ensure that those we care for are safe. We may analyse data in order to improve recruitment, training and development. In certain circumstances, we will record details such as disciplinary action.

VOLUNTEERS

 Where we collect information about you
In most cases we collect data about you when you give it to us.

What information we collect about you
As appropriate for a volunteer role, we may ask
• Emergency contact information
• Contact details for referees
• Your interests, experience, relevant qualifications
• Your driving licence records
• Any previous convictions
• Your DBS
• Relevant medical conditions
• If you have been bereaved in last 18 months

How we use your information
We collect this information so that we can give you a volunteer role suitable and support you to do this role. We also have to ensure that those we care for are safe – it is our moral and legal obligation.

FUNDRAISING/SUPPORTERS

1. How we collect your information

We collect information from you directly which you provide when you fill in any of our online or printed forms to make a donation, sign up to an event or buy a product.

Your information may be shared with us by fundraising sites like Just Giving and Virgin Money or by event organisers such as London Marathon.  These third parties will only share your information when you have given permission for them to do so.  You should also check their Privacy Policy when you provide your information to understand fully how they will process your data.

Your information may be shared with us by other online accounts like Facebook and Twitter.

The information received will depend on your settings or the privacy policy for the online accounts and you should check these regularly.

Your information may be shared with us via referrals from trustees, volunteers or staff members, with your consent.

2. What information we collect about you 

The type of information we collect will include names, addresses, email, telephone details, dates of birth, communication preferences and information you have shared such as your experience of the hospice or why you have chosen to support our work.

When taking part in a challenge event, you may also be asked for health information and emergency/next of kin contact information for health and safety reasons. This information would be held for the duration of the event only.

When giving in memory, we will collect the name of the deceased and your connection to them.

We hold records of your donations and fundraising efforts alongside communications we have sent to you and those we have received from you.

Where possible, we will ask you about your contact preferences at the first point of contact, i.e. when you first register for an event, make a donation or request fundraising information.  However, when this is not possible, we will ask you about your contact preferences in an appropriate and timely manner.

If your first contact with us is in memory, this will be done in a follow up letter sent a minimum of 12 weeks after your donation.

3. How we use your information 

We use your information to process your donations or product/information requests, to provide appropriate acknowledgement and collect gift aid.   We keep a record of your relationship with the hospice.

We will also use your information to keep you informed of our work, the latest news and to ask for donations or other fundraising support in accordance to your contact preferences.

We may also use the information we collect on you to build a profile of our supporters. When building profiles of our supporters, we use range of profiling and screening techniques using data we have collected directly from you and combine it with;

– Information from publicly available sources such as such as charity websites and annual review, corporate websites, public social media accounts, the electoral register and Companies House.

– Information from reputable external organisations such as Factary to provide additional socio-demographic information about our supporter base

We may also estimate gift capacity based on visible assets, history of charitable giving and your connection to St Joseph’s Hospice to identify people who may be able to give a larger gift in support of our work.

We do this because we believe our collection and use of your personal information is necessary and in the charity’s best interests, to ensure that we engage with you in the most appropriate and efficient way, ensuring that we use our resources efficiently.

We will not share, sell or rent your personal information to third parties for marketing purposes – we do, however, share your information with third parties working on our behalf.

We process your personal information under the legal basis of “Legitimate Interest”.  We consider the potential impact on you, how intrusive it is from a privacy perspective and your rights under data protection laws do not override our interests in using your information in this way.  We consider our legitimate interests to include the following activities carried out by St Joseph’s Hospice;

– Where you have signed up to fundraise for us at an event, to contact you about the event and support you in your fundraising journey.  We may also share your personal information with the third party organiser so they can administer the event

– To update your address using third party sources if you have moved house

– To thank next of kin for donations collected in memory of a loved one

– To contact prospective company supporters by email, phone and post to find out about their giving policies, make them aware of the hospice and talk about opportunities to support us

– To contact prospective Trust funders by email, phone and post to find out more about their giving criteria and to apply for funds

– To contact prospective supporters by post where information in the public domain suggests that they may be interested in supporting the hospice

– To contact people who have previously supported the charity where we believe they will be interest in supporting us again

– To use publicly available information, giving history and third party organisations to identify supporters who can give a larger gift to the hospice.

– To track whether you open/forward/click through email/digital campaigns in order to send you the most relevant information in the future

– To maintain a “stop” file of all supporters/individuals who have requested not to be contacted by the hospice to prevent unwanted communications in the future

You can ask us to change the way we use your personal information by contacting our Supporter Care Team on 020 8525 3202 or email SupporterCare@stjh.org.uk.

The accuracy of your information

We aim to ensure that all information we hold about you is accurate and, where necessary, kept up to date. If any of the information we hold about you is inaccurate and either you advise us or we become otherwise aware, we will ensure it is amended and updated as soon as possible.

Storing your information

We take great care to ensure that your data is kept secure at all times. Data is only accessible to appropriately trained staff and volunteers.

Although most of the information we store and process stays within the UK some information may be transferred to countries outside the European Economic Area. This may occur if, for example, one of our trusted partners’ servers are located in a country outside the EU. These countries may not have similar data protection laws to the UK, however, we will take steps with the aim of ensuring your privacy continues to be protected as outlined in this privacy policy.

We will keep your information for as long as required to enable us to operate our services, but we will not keep your information for any longer than is necessary. We will take into consideration our legal obligations and tax and accounting rules when determining how long we should retain your information. When we no longer need to retain your information we will ensure it is securely disposed of, at the appropriate time.

Consent for under 16s

 We are committed to protecting the privacy of the young people that engage with us through our website and at fundraising events. Our fundraising events also request specific information about the age of participants. Anyone under the age of 16 must obtain parental or guardian consent before participating in an event organised by St Joseph’s Hospice. Children aged under 13 must obtain the consent of a parent or guardian before providing any personal information.

Your rights

Under the General Data Protection Regulation, which came into force on May 25th, 2018, you have the following rights:

  1. The right to access your personal information
    2. The right to edit and update your personal information
    3. The right to request to have your personal information deleted
    4. The right to restrict processing of your personal information
    5. The right to object processing of your personal information
    6. The right to lodge a complaint with a supervisory authority
    To address your rights as listed above please contact our Data Protection Officer (DPO) using the contact details outlined at the end of this privacy statement.

 

1. The right to access your personal information

You have a right to obtain confirmation that your personal information is being processed. You also have the right to request a copy of your personal information we hold.

Should you wish to exercise any of these rights, in terms of the information that we hold about you, you can make a request to see your data by completing a request form which is available upon request.

Alternatively, please ensure you provide us with all the requested information in an alternative written format to help us locate your records.

You must provide proof of your identity by enclosing two pieces of approved identification.   Your request will be processed within 30 days of receipt of your request and all the relevant information we require.

2. The right to edit and update your personal information

The accuracy of your personal information is important to us. You can edit  your personal information including your address and contact details at any time.

Please provide as much information as possible about the nature of your contact with us, to help us locate your records. Any changes you have requested may take 28 days before they take effect.

3. The right to request to have your personal information deleted

You have the right to request the deletion of your personal information which we will review on a case by case basis.

4. The right to restrict processing of your personal information

You have the right to ‘block’ or suppress processing of your personal data. However, we will continue to store your data but not further process it. We do this by retaining just enough of your personal information so we can ensure that the restriction is respected in the future.

Please provide as much information as possible about the nature of your contact with us, to help us locate your records. Any changes you have requested may take 28 days before they take effect.

5. The right to object

You have the right to object to your personal information being processed for fundraising marketing (including profiling) and for research purposes. From the very first communication from us and every fundraising marketing communication we send after you will have the right to object to it.

Alternatively, you can exercise this right by contacting our Data Protection Officer (DPO) using the contact details outlined at the end of this Privacy Statement.

Please provide as much information as possible about the nature of your contact with us to help us locate your records. Any changes you have requested may take 28 days before they take effect.

If we process your personal information for the exercise or defence of legal claims, or we can demonstrate compelling grounds that override your rights and freedoms, we may not be able to fulfil your request. However, we will contact you to discuss further.

6. Your right to lodge a complaint with a supervisory authority

If you wish to lodge a complaint or seek advice from a supervisory authority please contact:
The Office of the Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: +44 (0) 01625 545 745

Website: www.ico.org.uk https://ico.org.uk
Changes to the Policy

This policy was last updated on 7th July 2020.

We will regularly review and update this Privacy Statement.
Any changes will be notified to you, either via e-mail or through an announcement on our website and your continued use of our website, any of our services and/or the continued provision of personal information after we have posted the changes to these terms, will be taken to mean you are in agreement with those changes.

Do you need extra help?

If you would like this notice in another format (for example: audio, large print), please contact us as below.

How to contact us

Post:
Data Protection Officer (DPO)
St Joseph’s Hospice
Mare Street, Hackney
London E8 4SA

Tel: 020 8525 6000
Email: dpo@stjh.org.uk