Privacy policy

1. Policy statement

Garden House Hospice Care (GHHC) is committed to protecting personal information. This privacy policy explains what we do with the personal data of persons who use our services, work or volunteer for us, donate to us, buy items in our shops or visit us either in person or on the website. This privacy policy also explains the ways individuals can control how their data is used.

GHHC never has, or will, sell, swap, or share any individual’s personal information with any organisation or third party for their own marketing purposes.

2. Our Data Protection Lead

The Chief Information Officer is the point of contact for individuals wanting information regarding how GHHC uses information.

3. When and how we collect your data

Personal information is any information that can be used to identify an individual, such as a name, address, telephone number, email address, or more rarely bank account details, NHS number or electronic identifiers, such as the internet protocol (IP) address. The amount of information collected and used about individuals will vary depending on their relationship with GHHC.

Organisations are permitted to process data if they have a legal basis in doing so. GHHC processes individual person’s data when:

• The organisation has expressed and informed consent given by the person whose data is being processed
• The organisation has a legitimate interest in processing the data
• We have a legitimate interest in processing the data.
• It is necessary in relation to a contract or agreement which the person has entered into or because the person has asked for something to be done so they can enter into a contract or agreement
• There is a legal obligation on GHHC to process data.

The following sections give you more information according to your relationship with us. You will find out what data we collect, why we need it, our lawful basis for sharing it under GDPR, who we share it with and how long we keep it.

4. Patients and service users

4.1. What data we collect and why

For patients referred to us or who are under the care of any of our services, including any of our clinical services or the community hubs, we will collect contact information, including personal details (name, address etc), and contact details of next of kin and GP.

This is to enable GHHC to contact the service user about care and appointments, service users’ next of kin in case of emergencies and to share key medical information with service user’s GPs. It is in GHHC’s legitimate interest to be able to administer appointments and service user’s care in an appropriate and efficient way.

GHHC will also collect information about service users’ medical and care history. This is to ensure service user’s receive the best and most appropriate care, which is in both the service users’ and GHHC’s legitimate interests. In matters of life or death, this information can be processed to protect service user’s vital interests.

For information provided by the referrer, such a doctor or another health professional, key aspects of this information will be checked with service users to make sure it is accurate. We also ask service user’s permission to continue sharing their health information with other care providers into the future for the duration of care provided by GHHC.

The information is stored on SystmOne, an electronic patient records system. Only GHHC staff who need to use this information to deliver care can access the information. This will include clinicians such as nurses, doctors and therapists and non-clinicians such as administrators, auditors and data analysts.

4.2. Service user data sharing

SystmOne clinical records can be accessed by other NHS providers involved in providing health care. Information may also be sent via the post or secure NHS email to professionals involved in service user’s care.

SystmOne clinical records can be accessed by other NHS providers involved in providing health care. Information may also be sent via the post or secure NHS email to professionals involved in service user’s care.

For service users or their next of kin already on the supporter CRM system used by GHHC, the record will be updated to reflect this. This will ensure service users do not receive inappropriate communications at a sensitive time and that communication is appropriate, including and if service users or their next of kin contact the hospice directly or any purpose, including when contacting the fundraising team.

Service users who have not previously engaged in supporting GHHC should not be contacted for marketing purposes.

Where service users who have died, GHHC will inform their bereaved next of kin about ways to remember their loved ones, such as our Lights of Life events.

GHHC will comply with the Fundraising Regulator's requirements to provide a simple and easy way to stop communications that are no longer required. Any use of legitimate interest will relate to postal communications and telephone only.

4.3. How long we keep your data for

Medical records on service users will be retained in accordance with the national guidance for health and social care records and in line with our own policies.

GHHC fully respects service users' rights to object to the organisation collecting and using this information and will abide by service users’ requests in this regard. Should service users request that GHHC limits the information used or kept, GHHC will explain to the service users that this may impact the care it is possible to safely provide.

5. Donors, supporters and customers

5.1. Data collected and reason for collection

The types of information GHHC collects or process include person’s name, address, gender, date of birth, contact details including email and telephone, any donation amounts or regular gifts given; details of any previous support including participation at events or information relevant to your participation at that event; other relevant support; communication preferences and a record of the previous communications we have had with individuals. Information about supporters is held securely on our CRM system.

It is in our legitimate interests to collect and process supporters’ personal data to be able to send relevant marketing and fundraising material by post and on the telephone.

GHHC will always collect individual supporter’s consent to send marketing and fundraising information by email, and by text message.

Where supporters have chosen to participate in an event or challenge, and have paid to do so, or bought a product, GHHC will process their personal details as part of a performance of a contract. GHHC receive this information directly, via the GHHC website or registration form, or indirectly, via online giving services such as JustGiving.

GHHC keeps information supporter information for fundraising and marketing purposes, to send out relevant marketing and fundraising information via post, telephone and email. Supporter information is kept in order to:

• Ensure supporter information is correct, accurate and up to date
• Ensure information sent to supporters is relevant and appropriate to them
• Keep supporters informed about and connected to GHHC news and developments, including promoting GHHC events, campaigns and activities
• Encourage ongoing fundraising by informing supporters of our care services and how this impacts services users and their families
• Thank supporters and showcase the difference supporter donations make
• Process donations, create standing order or process direct debit payments from supporters
• Claim gift aid (against both monetary donations and donations made to our trading company for sale in our shops or eBay)
• To arrange collection or delivery of items to donated to or purchased from our shops
• Drive traffic to our website

5.2. Data sharing with partners

Information may be shared securely with partner companies who support us in delivering our fundraising activities. Examples of this include mailing houses who act on our behalf to circulate our publicity materials, or the data company, Quantor, that GHHC uses to scan our paperwork for digital archiving.

When supporters participate in an event, GHHC will share all or some of the following personal data with the relevant event organisers and administrators when required for legal purposes.

When GHHC uses third party service providers, only the personal information that is strictly necessary to deliver the service is disclosed.

With each third party service provider, GHHC will draw up a contract requiring them to:

• Keep all GHHC supporters’ information secure
• Never use any GHHC supporters’ information for their own direct marketing purposes
• Never sell GHHC supporters’ information.

We may also share your data if it is required by law, for example, by a court order or for the 
purposes of prevention of fraud or crime.

5.3. Targeting our marketing

GHHC will carry out targeted fundraising and marketing to ensure that individuals are contacting with the most relevant information (for example about volunteering, events, research and how your support helps) through their preferred channels.

The purpose of this is to enable supporters to receive GHHC communications that are purposeful and also enables GHHC to use resources, and therefore donations, effectively. For example, if supporters have already participated in an event or bought a product, they will be contacted again about that and/or similar events or products in the future, unless the supporter requests GHHC not to do so.

GHHC may analyse geographic, demographic or other information relating to supporters, to better understand their interests and motivation for giving.

5.4. Next of kin and patient data

In order to protect the way GHHC communicates with current patients and next of kin/family members, where active GHHC supporters or their next of kin/family members become service users, GHHC will amend the CRM record to reflect this, in order that communications can be adjusted appropriately and sensitively.

No information will be shared or stored about the services GHHC supporters or their next of kin/family members are receiving or GHHC supporters’ medical records.

The names and addresses only of all service users and next of kin/family members are stored on CRM. This allows the GHHC fundraising team to be aware of the donors’ relationship to the Hospice, if a donation is made at any time. This information will never be used for marketing purposes.

For the bereaved family and friends of deceased service users, they will be informed of ways in which GHHC can support them to remember the deceased, such as the annual Lights of Life event.

GHHC complies with the Fundraising Regulator's requirements and will provide a simple and easy way to stop communications that are no longer required. Any use of legitimate interest will only relate to postal communications and telephone only. This is clearly explained in our leaflet ‘Your information: How we use it’ which is given to all patients and next of kin upon referral to our services.

5.5. Sharing individual's stories or photographs

Stories of service users help us to raise awareness of GHHC services. Consent will be sought from all service users who are involved in publicity work, including photographic, video or written content. Any such photographs, videos or other information will be held indefinitely, unless notified otherwise. Consent is gained via Media Consent Form.

Photographs taken at our fundraising events will be used indefinitely. Consent for fundraising events is covered as part of event terms and conditions.

Consent for the use of service users or fundraising supporters’ information, photographs or video can be withdrawn at any time by emailing marketing@ghhospicecare.org.uk.

5.6. GHHC Community Groups

Data captured for GHHC fundraising purposes by independent volunteer run community fundraising committees is securely shared with GHHC where it falls under the same protection as all other supporter data. Once this data is shared with GHHC, it is then securely destroyed by the community fundraising committees. All such groups operate independently but work in partnership with the Hospice, receive GHHC training and comply with all GHHC policies and UK data protection laws.

5.7. Local Hospice Lottery

The GHHC lottery, is run in partnership with Local Hospice Lottery Ltd. Local Hospice Lottery Ltd is a private limited company with registered company number 03226004 and registered address Farleigh Hospice, North Court Road, Broomfield, Chelmsford, Essex, CM1 7FH.

Individuals who play the Local Hospice Lottery in support of GHHC are given the choice to share their data with GHHC. The name, address and marketing preferences of such individuals are shared with GHHC securely on a monthly basis and stored on the GHHC CRM system. All such data is treated in line with all other supporters as detailed in this policy. If individuals cease to have contract with Local Hospice Lottery, their data will be shared once again on that basis, in order that the current lottery player database is up to date.

The Local Hospice Lottery privacy policy is available here.

5.8. Keeping our data accurate

Whenever GHHC contacts supporters, the Hospice will give supporters an opportunity to update their information, so it is as current and accurate as possible.

Supporter details are also shared with a partner organisation for the purposes of data cleansing. Data cleansing enables supporter details to be kept accurate and up-to-date. The partner organisation notifies GHHC if supporters have moved home. GHHC is also informed if supporters have died, in order that the Hospice can avoid any distress that continued communications may cause to bereaved next of kin.

5.9. Changing your preferences

When supporters wish to change the marketing communications received from the GHHC or wish to opt out of receiving marketing material, they are requested to contact the supporter care team on 01462 679540 or email fundraising@ghhospicecare.org.uk.

Any email or postal marketing we send will include information on how to change communication preferences or cease communication from GHHC.

Supporter details will remain on the CRM system to allow us to ensure that supporters do not continue to receive unwanted communication.

Supporter records are kept until the record has been inactive for six years, this means if we have not heard from a supporter or received a donation in this time, we will archive the details. The exception to this is if we are informed of a change or the supporter has asked us to delete a record.

We review our retention periods for personal information on a regular basis. We are legally required to hold some types of information to fulfil our statutory obligations (for example the collection of Gift Aid). We will hold personal information on our systems for as long as is necessary for the relevant activity or as long as it is set out in any relevant contract that a supporter holds with us. 

6. Our website and cookies

6.1. What data we capture online and why

We obtain information about individuals when they use our website, for example, when contacting us about products and services, to make a donation, to play our Lottery or when registering to receive one of our newsletters.

The personal information we collect might include name, address, email address, IP address,  and information regarding what pages are accessed and when. If a supporter makes a donation online or purchase a product from us, their debit/credit card information is not held by us, but is collected by our third-party payment processors, who specialises in the secure online capture and processing of credit/debit card transactions, as explained below.

An Internet Protocol address (IP address) is a numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication. An IP address serves two principal functions: host or network interface identification and location addressing.

We may use information to:

• Process a donation that made
• Carry out our obligations arising from any events or contracts
• Deal with entries into a competition
• Seek feedback on the services we provide
• Notify people of changes to our services
• Send communications which have been requested and that may be of interest. These may include information about the organisation, campaigns, appeals and other fundraising
• Process activities/promotions of our associated trading companies’ goods and services
• Process a grant
• Process a job application.

When using our secure online donation pages, donations are processed by a third-party payment processor, Stripe, who specialises in the secure online capture and processing of credit/debit card transactions.

6.2. GHHC website security

When individuals give us personal information, these are the steps GHHC takes to ensure the information is treated securely.

Sensitive information (e.g. credit or debit card details) is encrypted and protected with 128 Bit encryption on SSL software.

Where individuals send non-sensitive details (e.g. email address) to GHHC over the internet, the Hospice will always take every precaution to protect such personal information. However, GHHC cannot guarantee the security of any information individuals transmit to us via email, and this is done at individuals own risk.

Where individuals have chosen a password which enables them to access certain parts of our websites, they are responsible for keeping this password confidential. GHHC requests that individuals do not to share password with anyone.

6.3. Cookies

'Cookies' are small pieces of information sent by an organisation to users’ computers and stored on computers’ hard drives, to allow that website to recognise users when they visit. Cookies collect statistical data about users’ browsing actions and patterns but do not identify users as individuals. The use of cookies helps GHHC to improve our website and deliver a more personalised service.

7. Keeping individuals' information secure

All staff and volunteers who handle personal information must complete training on information security once per year at a minimum. Within the organisation, access to information is controlled, so that no one can use personal information unless they have a business reason to do so. If information needs to be taken outside our premises, extra precautions are taken to keep it as safe as we can. When information is no longer required, it is archived or securely destroyed in accordance with the law. This is outlined in OM31 Data Security and Protection Policy.

Responsibilities and accountabilities for information security are clearly defined:

• The Chief Information Officer is our Data Protection Lead and is responsible for compliance with data protection regulations
• Caldicott Guardian, responsible for protecting patients’ confidentiality, is the GHHC Medical Director.

GHHC values transparency and improvement. If an individual’s personal information may have been misused, GHHC will raise an incident, carry out an investigation and formulate an action plan as a result. In the most severe cases, we may also notify regulatory bodies such as the Information Commissioner’s Office or the Care Quality Commission, as required by law. As a regulated healthcare provider, we will also follow Duty of Candour guidance as per CM22 Being Open and Duty of Candour Policy.

8. Sharing individuals' information

Where we have indicated information may be shared, we always ensure those receiving individuals’ information uphold the same information security standards as we do. This will often be specified in writing as part of a contract or information sharing agreement. All staff, volunteers and agents of GHHC are bound by strict duties of confidentiality.

In rare circumstances, we may be obliged to share service users’ information without forewarning. For example, if we believe there may be a risk of harm or there is a public health risk, we may have a legal or professional duty to share information about a service user with the authorities. In all such cases, the sharing will be reviewed by our Caldicott Guardian and will only happen if they believe it is absolutely necessary and in all such cases, the service user would be informed prior to any information being shared.

There may also be times when we are legally required to share information about individuals with the authorities. For example, if a member of GHHC staff or volunteer comes to harm due to a work-related accident at the hospice or one of our shops, we are required to give their name, address and age to the Health & Safety Executive under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations (RIDDOR). In all such cases, the member of GHHC staff or volunteer would be informed prior to any information being shared.

9. Individuals' rights

Under data protection regulations, individuals have rights over how their personal information is used by others.

• Right to access: Individuals have the right to access their personal information GHHC holds about them. If individuals wish to see it, they can submit a request to our Data Protection Lead (see ‘Who we are’ section for contact information) who will respond within one month. Depending on the nature of your request, GHHC may need to seek further clarification or gain confirmation of the individual’s identity before the information can be provided.
• Right to rectification: If the information GHHC holds about individuals contains errors, the have the right to have it corrected. GHHC has measures in place to keep all information updated, but if an individual notices anything wrong with the information we are using, it will be updated as soon as possible once the error is identified.
• Right to erasure: Individuals have the right to request GHHC erase information held about them from Hospice records if they believe it is no longer required. Where possible, GHHC will always comply with a request for erasure, however in many cases it will not be possible to erase all information about individuals, where there are legal or contractual reasons why GHHC needs to keep certain details. If any details relating to an individual cannot be erased, GHHC will inform them and explain the reasons.
• Right to restriction: If individuals believe their personal information is being used for things it shouldn’t be by GHHC, they have the right to request the Hospice stop using it that way. As with erasure, there may be legal or contractual obligations why GHHC needs to continue using information in particular ways but the individual will be informed where this is the case.
• Right to portability: There may be times when individuals want a particular portion of the information GHHC holds about them to be moved or made portable. For example, an employee might want us to give them a list of all the training courses they have attended. The individual has a right to receive information about them in a structured, commonly used and machine-readable format. This right only applies when the information has been collected and used on the basis of consent or a contract.
• Right to objection: Individuals have the right to object to GHHC collecting and using their information when it is being done on the basis of legitimate interests, or for direct marketing, or research. GHHC will inform individuals at the point GHHC start collecting their information if this right applies. Any objections will be considered and complied with, unless there is a lawful exemption.

GHHC will endeavour to inform individuals about their rights and uphold them at all times. If individuals believe GHHC have infringed their rights, they should be encouraged to contact our Data Protection Lead who will work with them to resolve the matter in a way that satisfies both the individual and the law. If for any reason the individual is unable to resolve the matter with GHHC, they can escalate their concerns to the Information Commissioner’s Office, which is the UK’s independent authority responsible for upholding information rights in the public interest.

10. Accessibility

Our privacy notice is available on our website. If an individual wishes to receive this in a different format, such as large print, braille, audio recording, or translated into a different language, they can do so by contacting us by telephone on 01462 679540, by email at enquiries@ghhospicecare.org.uk or by post to Garden House Hospice Care, Gillison Close, Letchworth Garden City, Herts, SG6 1QU.

11. Correcting or deleting individuals' personal data

Where an individual believes that we may already hold their personal data and they want us to correct information they believe is wrong, or if an individual wants GHHC to delete their personal data or to stop processing it, they have the right to object to the data being used or to ask for it to be corrected by contacting the hospice via email or post.

GHHC may need to refuse a request to delete, correct or stop processing personal data. For example, this may be when there is the need to protect a vulnerable person from harm, or as a result of our legal obligations, or to help the Hospice carry out our functions.

12. Complaints

Where there are complaints about the treatment of individual’s data by GHHC as a charity, the Charity Commission, the independent watchdog for charities.

Complaints can also be sent to Garden House Hospice Care, Gillison Close, Letchworth Garden City, Herts, SG6 1QU.

13. CQC privacy statement

The CQC (Care Quality Commission) use personal data (information that relates to and identifies living people) and other information to help them to carry out their role as the regulator of health and adult social care services in England. The CQC’s privacy statement can be found here.

14. Policy monitoring and review

This policy will be regularly reviewed and updated and any such changes will be published on our website.

Last updated: March 2025

15. Staff training requirements

All employees and volunteers will become familiar with this policy as part of the induction process.