Privacy policy

Policy statement

Garden House Hospice Care is committed to protecting your personal information. This privacy policy explains what we do with your personal data when you use one of our services, work or volunteer for us, donate to us, use our services, buy items in our shops or visit us either in person or on the website. This privacy policy also explains the ways you can control how your data is used.

It is important to note that Garden House Hospice Care never has and never will sell, swap or share your personal information with any organisation or third party for their own marketing purposes.

Who we are

Garden House Hospice Care provides personalised and compassionate palliative end of life care for those in need, following a diagnosis of a life limiting illness, across the communities of North Hertfordshire, Stevenage and surrounding towns and village in Central Bedfordshire and Cambridgeshire. This community includes more than 260,000 people.

It costs £8.5 million a year to run our services and we need to raise £10,542 in charitable income every day. Our wide range of services are all provided free of charge to our patients, their carers and families. The majority of this income is raised through the generosity of our community, by fundraising and through our Trading company, with a portion funded by the NHS.

Our Data Protection Officer

If you wish to contact us about the way we use your information, you can contact our Data Protection Officer by email at dpo@ghhospicecare.org.uk or by post to Garden House Hospice Care, Gillison Close, Letchworth Garden City, SG6 1QU.

When and how we collect your data

Personal information is any information that can be used to identify you, such as a name, address, telephone number, email address, or more rarely - bank account details, NHS number, and electronic identifiers such as your internet protocol (IP) address. The amount of information we collect and use about you will vary depending on your relationship to the Hospice.

Organisations are permitted to process data if they have a legal basis in doing so. We process data when:

• We have expressed and informed consent given by the person whose data is being processed.
• It is required for the provision of health or social care.
• We have a legitimate interest in processing the data.
• It is necessary in relation to a contract or agreement which the person has entered into or because the person has asked for something to be done so they can enter into a contract or agreement.
• There is a legal obligation on Garden House Hospice Care to process data.

The following sections give you more information according to your relationship with us. You will find out what data we collect, why we need it, our lawful basis for sharing it under GDPR, who we share it with and how long we keep it.

Patients and service users

What data we collect and why

We will collect contact information, including your personal details (name, address etc), and contact details of your next of kin and doctor. This is so we can contact the relevant people about your care and appointments, and in case of emergency. It is in our legitimate interest to be able to administer your appointments and care in an appropriate and efficient way.

We will also collect information about your medical and care history. This is to ensure you receive the best and most appropriate care, which is in both your and our legitimate interests. In matters of life or death, this information can be processed to protect your vital interests.

The majority of this information will provided by the person referring you to our services. We may also gain information from your doctor or another health professional. We always check this information with you to make sure it is accurate.

Information is stored on our computerised medical records system called SystmOne. Only those who need to use your information to deliver your care are allowed access to it. This will include clinicians such as nurses, doctors and therapists, but also non-clinicians such as administrators, auditors and data analysts. All who work at the Hospice, including volunteers, must follow a strict code of conduct regarding confidentiality. We only share information about you with your family or friends with your consent.

There may be times when services require paper records to be kept. These are securely stored.

Who we share your data with

We are part of My Care Record, an approach to improving care by joining up health and care information. Health and care professionals from other services will be able to view information from the records we hold about you when it is needed for your care. Please see www.mycarerecord.org.uk for more information.

Your record on SystmOne can be accessed by other health and care providers involved in your care and we may send information via the post or secure NHS email to individuals involved in your care.

Often it is necessary to share your information with professionals in other services who may be directly involved with your care or if you need treatment elsewhere. Your information will only be made available if there is a genuine need to do so. Such professionals might, for example, include GPs, ambulance services or social care services.

We may share your details with partners such as the Care Quality Commission or local social care services for safeguarding purposes. In these circumstances it is a legal obligation for us to do so.

If you require any additional information, please contact Caldicott Guardian at Garden House Hospice Care.

If you are a patient or next of kin and are already on our supporter database, Donorflex, we will update your record to ensure you do not receive inappropriate communications at a sensitive time. It is important to us that if our supporters are also our patients and/or their next of kin, we recognise this connection and we communicate with you in an appropriate way, or if you contact us directly, we know your relationship with the Hospice.

Those who have not previously engaged in supporting the Hospice will not be contacted for marketing purposes. As part of our care for you, if you are bereaved, we will let you know about ways to remember your loved ones, such as our annual Lights of Life event.

The Hospice always complies with the fundraising regulator's requirements and will provide a simple and easy way to stop communications that are no longer required. Any use of legitimate interest will relate to postal communications and telephone only.

How long we keep your data for

Medical records on service users will be retained in accordance with the national guidance for health and social care records
You have the right to object to us collecting and using this information, however it may not be possible to continue providing care and support services to you and your family without it.

It is important to understand that not allowing access to your information may affect the quality of the care you receive.

Only health and social care professionals involved in your care are allowed to access your information. These people are viewing your record to give you the best quality care they can.

In many situations it is necessary to share information between services to deliver care. However, it may be possible to request that specific or sensitive information is not made available.

There may also be some situations where information still needs to be made available. For example, if there is a serious concern about an individual's safety.

National data opt-out

The Hospice complies with the national data opt-out, which allows you to choose if you want your confidential patient information to be used for purposes beyond your individual care and treatment, e.g., for research and planning.

To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters.

You can object to your record being shared between services. To do this, speak to the person delivering care to you at each organisation such as your GP.

Donors, supporters and customers

What data we collect and why

The types of information that we will collect or process include your name, address, gender, date of birth, contact details including email and telephone, any donation amounts or regular gifts given; details of any previous support including participation at events or information relevant to your participation at that event; other relevant support; communication preferences and a record of the previous communications we have had with you. Information about our supporters is held securely on our database called Donorflex.

It is in our legitimate interests to collect and process your personal data in order to be able to send you relevant marketing and fundraising material by post and on the telephone.

We will always collect your consent to send you marketing and fundraising information by email, and by text message.

If you have chosen to participate in an event or challenge, and have paid to do so, or bought a product, we will process your personal details as it is necessary for the performance of a contract.

This information is given to us either directly, via our website or a registration form, or indirectly, via online giving services such as JustGiving. We receive the name and address of current patients, next of kin and bereaved next of kin from our patient management system, SystmOne.

We need to keep these details for fundraising and marketing purposes. We are a charity and we want to provide the best care for all of our Hospice users, and to do this we need to generate income in order to ensure this is provided free of charge to all local people. We will send out relevant marketing and fundraising information via post, telephone and email.

We need your details so that we can contact you and:

• Manage the events that you might be taking part in
• Keep you informed of news and developments and to help you to feel connected to our cause

• Promote all the different events, campaigns and activities that we have going on

• Thank supporters and showcase the difference your donations make to the organisation and to local people

• Create standing order or direct debit payments

• Process donations

• Showcase our care services and raise awareness of the many ways we can help those living with a terminal illness

• Claim gift aid (against both monetary donations and donations made to our trading company for sale in our shops or eBay)

• Dispel myths about hospice care, encouraging more people to access our care - especially hard to reach groups

• For collection or delivery of items to donated to or purchased from our shops

• Ensure we are contacting you with relevant information

• Drive traffic to our website to find out more
• Ensure that your details are accurate and up-to-date.

Data sharing with partners

We may share your information securely with partner companies who support us in delivering our fundraising activities, such as mailing houses who act on our behalf to circulate our publicity materials or banks to set up a regular gift by standing order. If you are participating in an event we will share your personal data with the relevant event organisers and administrators when required for legal purposes. Finally, we use a data company, Quantor, to scan our paperwork for digital archiving.

When we use third party service providers, we disclose only the personal information that is necessary to deliver the service and we have a contract in place that requires them to keep your information secure and not to use it for their own direct marketing purposes. We may also share your data if it is required by law, for example, by a court order or for the purposes of prevention of fraud or crime.

Please be reassured that we will not release your information to any third parties for them to use for their own direct marketing purposes. We have never and will never sell your information.

Targeting our marketing

We will carry out targeted fundraising and marketing to ensure that we are contacting you with the most relevant information (for example about volunteering, events, research and how your support helps) through your preferred channels.

This approach has mutual benefits; you will hopefully receive communications from us that feel purposeful, but equally we are using our resources effectively, which is important to both us and you as supporters. For example, if you have already participated in an event or bought a product; we will contact you about that and/or similar events or products, unless you ask us not to.

We will keep your record updated with relevant information that will help us, such as previous events you have taken part in or whether you are giving in memory of a loved one. We may analyse geographic, demographic or other information relating to you to better understand your interests and motivation for giving.

Next of kin and patient data

In order to protect the way we communicate with current patients and next of kin, if you are an active Hospice supporter and you or your family member starts to receive one (or more) of our services, we will amend your Donorflex record to reflect your relationship with the Hospice and adjust your communications accordingly.

No information is shared or stored about the services you are receiving or your health and condition. The names and addresses of patients and next of kin with no previous relationship with the Hospice are stored on Donorflex in the event we are contacted by the individuals or we receive a donation in the future, so we are aware of their relationship with the Hospice. This information will not be used for marketing purposes.

If you are bereaved, as part of our support for you we will let you know about ways to remember your loved ones, such as our Lights of Life event. If you are a bereaved next of kin and you were not previously a Hospice supporter, we will invite you to be a part of our Lights of Life services and campaign, but if you do not respond this will be the only time you hear from us, unless you support us in the future.

The organisation complies with the Fundraising Regulator's requirements and will provide a simple and easy way to stop communications that are no longer required. Any use of legitimate interest will only relate to postal communications and telephone only. This is clearly explained in our leaflet 'Your information: How we use it' which is given to all patients and next of kin upon referral to our services.

Sharing your story or photographs

Stories of people who have used or are using our services help us to raise awareness of Garden House Hospice Care's services. If you choose to support us by getting involved in publicity work, including photographic, video or written content, we will obtain consent from you. Photographs taken at our fundraising events will be used indefinitely. You can withdraw your consent at any time by emailing marketing@ghhospicecare.org.uk.

Garden House Hospice Care Community Groups

We have a number of community groups, who are committees of volunteers who fundraise for the Hospice within their local community. They may do this by running events, raffles and having stalls at local fetes and fairs. Although they operate independently, they work in partnership with the Hospice, receive our training and comply with all the data protection laws as well as our own policies. Any data they capture for fundraising purposes is securely shared with us at the Hospice - where it falls under the same protection as all other supporter data - and then destroyed from their systems.

Local Hospice Lottery

We run our lottery in partnership with Local Hospice Lottery Ltd. Local Hospice Lottery Ltd is a private limited company with registered company number 03226004 and registered address Farleigh Hospice, North Court Road, Broomfield, Chelmsford, Essex, CM1 7FH.

If you play the Local Hospice Lottery, you will be given the choice to share your data with the Hospice you support. Your name, address and marketing preferences are shared with us securely on a monthly basis, and stored on our database, Donorflex. Your data will be treated in line with all other supporters as detailed in this policy. If you cease your contract with Local Hospice Lottery, your data will be shared once again so we can keep our database up to date.

Please visit the Local Hospice Lottery website for their full privacy policy.

Keeping our data accurate

Whenever we contact our supporters, we will give you an opportunity to update your information so it is as current and accurate as possible.

We use your details for data cleansing. We want to keep your details accurate and up-to-date - and so we work with a partner organisation who will notify us if people have moved and tell us about people who have recently deceased to avoid any distress that continued communications may cause.

Changing your preferences

You can opt out of your data being used for profiling. However, this may mean that you stop receiving relevant marketing communications from us or they become more generic and less relevant to you as they are no longer based on your interests in our cause. If you do wish to opt out please contact the supporter care team using the information below.

You are welcome to contact us at any time to change your communications preferences. Please call the supporter care team during office hours on 01462 679540, option 3, or email fundraising@ghhospicecare.org.uk. Any email or postal marketing we send will include information on how you can change your communication preferences or cease communication from the Hospice. If you request to receive no further information from us, we will also keep your personal data on our database so that we can always ensure that you do not receive any unwanted communication.

We currently keep all of our records on Donorflex until you have been an inactive supporter for six years. This means we haven't heard from you or received donations or fundraising support for six years. The exception to this rule is if we are informed of a change in your situation before then, or we are asked to delete the record.

We review our retention periods for personal information on a regular basis. We are legally required to hold some types of information to fulfil our statutory obligations (for example the collection of Gift Aid). We will hold your personal information on our systems for as long as is necessary for the relevant activity or as long as it is set out in any relevant contract you hold with us.

Keeping your information secure

We take the security of your personal information very seriously. All staff and volunteers who handle personal information are required to complete training on information security once per year at a minimum. We also carry out regular audits and inspections to make sure our security controls are effective and reliable.

Within the organisation, access to information is controlled, so that no one can use personal information unless they have a business reason to do so. If information needs to be taken outside our premises, we take extra precautions to keep it as safe as we can. When information is no longer required, it is archived or securely destroyed in accordance with the law.

Responsibilities and accountabilities for information security are clearly defined. Our Data Protection Officer is responsible for compliance with data protection regulations. We also have a Caldicott Guardian is Dr Sarah Bell, Medical Director, who is responsible for protecting people's confidentiality, in accordance with NHS information sharing rules.

We value transparency and improvement. If we think your personal information may have been misused, we will investigate the incident and let you know about it. In the most severe cases, we may also notify regulatory bodies such as the Information Commissioner's Office or the Care Quality Commission, as required by law. As a regulated healthcare provider, we have a Duty of Candour to inform you about mistakes, apologise for them, and support you while we work to resolve them.

Our website and cookies

What data we capture online and why

We obtain information about you when you use our website, for example, when you contact us about products and services, to make a donation, to play our Lottery or if you register to receive one of our newsletters.

The personal information we collect might include your name, address, email address, IP address, and information regarding what pages are accessed and when. If you make a donation online or purchase a product from us, your debit/credit card information is not held by us, it is collected by our third-party payment processors, who specialise in the secure online capture and processing of credit/debit card transactions, as explained below.

An Internet Protocol address (IP address) is a numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication. An IP address serves two principal functions: host or network interface identification and location addressing.

We may use your information to:

• Process a donation you have made

• Carry out our obligations arising from any events or contracts entered into by you and us

• Deal with entries into a competition

• Seek your views or comments on the services we provide

• Notify you of changes to our services

• Send you communications which you have requested and that may be of interest to you. These may include information about the Hospice, campaigns, appeals and other fundraising

• Process activities/promotions of our associated trading companies' goods and services

• Process a grant
• Process a job application

When you are using our secure online donation pages, your donation is processed by a third-party payment processor, who specialises in the secure online capture and processing of credit/debit card transactions. If you have any questions regarding secure transactions, please contact us.

The security of our website

When you give us personal information, we take steps to ensure that it's treated securely. Any sensitive information (such as credit or debit card details) is encrypted and protected with the following software 128 Bit encryption on SSL. When you are on a secure page, a lock icon will appear on the bottom of web browsers such as Microsoft Internet Explorer.

Non-sensitive details (your email address etc.) are transmitted normally over the internet, and this can never be guaranteed to be 100 per cent secure. As a result, while we strive to protect your personal information, we cannot guarantee the security of any information you transmit to us, and you do so at your own risk.

Once we receive your information, we make our best effort to ensure its security on our systems. Where we have given (or where you have chosen) a password which enables you to access certain parts of our websites, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

The use of cookies

Like many other websites, the Garden House Hospice Care website uses cookies. 'Cookies' are small pieces of information sent by an organisation to your computer and stored on your hard drive to allow that website to recognise you when you visit. They collect statistical data about your browsing actions and patterns and do not identify you as an individual. For example, we may use cookies to store your country preference. This helps us to improve our website and deliver a better more personalised service.

It is possible to switch off cookies by setting your browser preferences. For more information on how to switch off cookies on your computer, visit our full cookies policy. Turning cookies off may result in a loss of functionality when using our website.

Sharing your information

Where we have indicated information may be shared, we always ensure the people receiving your information uphold the same information security standards as we do. This will often be specified in writing as part of a contract or information sharing agreement. All staff, volunteers and agents of GHHC are bound by strict duties of confidentiality.

In rare circumstances, we may be obliged to share your information without forewarning. For example, if we believe you may be at risk of harm or there is a public health risk, we may have a legal or professional duty to share information about you with the authorities. In all such cases, the sharing will be reviewed by our Caldicott Guardian and will only happen if they believe it is absolutely necessary.

There may also be times when we are legally required to share information about you with the authorities. For example, if you come to harm due to a work-related accident at the hospice or one of our shops, we are required to give your name, address and age to the Health & Safety Executive under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations (RIDDOR).

We affirm here that your information will never be swapped, shared with or sold to any third parties for the purpose of marketing or monetisation.

Your individual rights

Under data protection regulations, you have rights over how your personal information is used by others.

• Right to access: You have the right to access the personal information we hold about you. If you wish to see it, you can submit a request to our Data Protection Officer (see 'Who we are' section for contact information) who will respond within one month. Depending on the nature of your request, we may need to seek further clarification from you or gain confirmation of your identity before the information can be provided.
• Right to rectification: If the information we hold about you contains errors, you have the right for it to be corrected. We have measures in place to keep our information updated, but if you notice anything wrong with the information we are using, please let us know and we will update it as soon as we can.
• Right to erasure: You have the right to request we erase the information we hold about you from our records if you think it is no longer required. Where possible, we will always comply with a request for erasure, however in many cases it will not be possible to erase all information about you, because there may be legal or contractual reasons why we need to keep certain details. If any of your details cannot be erased, we will tell you and explain the reasons.
• Right to restriction: If you think your personal information is being used for things it shouldn't be, you have the right to request we stop using it that way. As with erasure, there may be legal or contractual obligations why we need to continue using information in particular ways.
• Right to portability: There may be times when you want a particular portion of the information we hold about you to be moved or made portable. For example, if you're an employee, you might want us to give you a list of all the training courses you have attended, to put on your CV perhaps. You have a right to receive information you have provided to us in a structured, commonly used and machine-readable format. This right only applies when the information has been collected and used on the basis of consent or a contract.
• Right to objection: You have the right to object to us collecting and using your information when it is being done on the basis of legitimate interests, or for direct marketing, or research. We will inform you at the point we start collecting your information if this right applies. Any objections will be considered and complied with, unless there is a lawful exemption.

We will endeavour to inform you about your rights and uphold them at all times. If you believe we have infringed your rights, we encourage you to contact our Data Protection Officer who will work with you to resolve the matter in a way that satisfies both you and the law. If for any reason you are unable to resolve the matter with us, you can escalate your concerns to the Information Commissioner's Office, which is the UK's independent authority responsible for upholding information rights in the public interest.

Correcting or deleting your personal data

If you think that we may already hold your personal data, and you want us to correct information that you believe is wrong, or if you want us to delete your personal data or to stop processing it, then you have the right to object to the data being used or to ask for it to be corrected.

Please make your objection in writing by sending an email to enquiries@ghhospicecare.org.uk or by post to Garden House Hospice Care, Gillison Close, Letchworth, SG6 1QU.

Sometimes we may need to refuse a request to delete, correct or stop processing personal data. For example, this may be when we need to protect a vulnerable person from harm, or as a result of our legal obligations, or to help us carry out our functions.

Accessibility

If you, or someone you know, wish to receive this privacy notice in a different format, such as large print, braille, audio recording, or translated into a different language, please contact us by telephone on 01462 679540, by email at enquiries@ghhospicecare.org.uk or by post to Garden House Hospice Care, Gillison Close, Letchworth, SG6 1QU.

Complaints

If you have a complaint about us, or the treatment of your data, you can contact the Charity Commission. The Charity Commission is the independent watchdog for charities. If you have a complaint about our fundraising activities you can also complain to the fundraising regulator of which we are a member.

Complaints can also be sent via email to complaints@ghhospicecare.org.uk or in writing to the Chief Executive. Please see the complaints section of our website for further information.

CQC privacy statement

Policy monitoring and review

This privacy policy will be regularly reviewed and updated and any such changes will be published on our website. Please check back at regular intervals to ensure you are reading the latest version.

Last updated: March 2023