Privacy and Procedures

We are a hospice based at Uphill in Weston-super-Mare, providing a range of palliative and end-of-life care services to the communities of Weston-super-Mare and surrounding towns and villages within North Somerset and Sedgemoor, covering an area of approx. 450 square kilometres and a population of approx. 170,000 people.

Our Clinical services include a 10-bed in-patient unit, a team of hospice community nurse specialists caring for patients at home, day hospice services (for out-patients), a family support team providing practical assistance, bereavement support and spiritual care to the family setting, physiotherapy and occupational therapy, and complementary therapies.

The hospice is funded via a minority (20%) NHS grant, with the majority of our income achieved via our network of retail shops, our charitable fundraising activities and financial support from the communities we serve. We employ around 145 full-time and part-time staff, and we have an active volunteer base of around 600 volunteers.

Weston Hospicecare is a UK company, limited by guarantee, and registered with the Charity Commission of England and Wales under number 900328. We are registered with, and inspected by, the Care Quality Commission. We are registered with the Fundraising Regulator and subject to its code of fundraising practice. The Hospice is registered with the Information Commissioner’s Office (ICO) as a Data Controller with registration number Z5035102, and as such we comply with the Data Protection Act (2018) and the General Data Protection Regulations (EU: 2016/679). Our Lottery is licenced by North Somerset Council and regulated by the Gambling Commission.

We collect, hold and use your personal information to enable us to run our Hospice effectively and to interact with you appropriately, including:

• Personal information about patients and next of kin to enable us to give you the correct care and treatment, and to be able to contact you and your loved ones.
• Personal information about our staff, volunteers and applicants for roles, to communicate effectively and to carry out administration and our duties as an employer, as necessary for your role.
• Personal information about our donors and supporters so that we can coordinate and acknowledge your support for us, to understand you better, and to send you relevant news and information about our work, fundraising activities and events.
• Personal information about our shop customers when they are able to gift aid the sale proceeds of their donations to the Hospice.
• Technical data about visitors to our website to ensure the content of our website is presented in the most suitable format for you and your computer.

Information is held either digitally on computer and disk storage, or as hardcopy paper records, or both.

Personal information is stored both in paper (hardcopy) and electronic (computer disk) forms.

Patient and service users’ personal information is held for specified periods of time as set out in the NHS Records Management Code of Practice for Health and Social Care, and National Archives Requirements. In addition, everyone working for the NHS (and at independent H&SC organisations which are wholly or partly commissioned by the NHS and regulated by the Care Quality Commission) must comply with the Common Law Duty of Confidentiality and related national and professional standards and requirements. Accordingly, we have a duty of care to:

• Maintain full and accurate records of the information we hold.
• Keep records confidential and secure.
• Provide information in a format that is accessible to you.

We take the security of your personal information seriously. Information technology safeguards such as firewalls, anti-virus software and encryption are employed to keep digital data safe and protected against unauthorised disclosure access and damage. Related Hospice policies and procedures maintain security of hard copy documents, and regulate access to digital documents via individual login credentials, password controls and hierarchy of permissions.

Retention of personal information

We will keep your personal data only as long as necessary for the purpose it was collected, and to comply with relevant legislation.

Destruction of personal data which has expired or for which we no longer have a compelling justification to retain, is achieved via shredding of paper documents by an accredited waste destruction company, and by wiping of data disks prior to secure disposal in the case of digital documents.

The appropriate contact persons and details are provided below:

Patients &
service users &
Clinical complaints Clinical IG Lead /
Caldicott Guardian Director of Patient Services, Weston Hospicecare,
28 Thornbury Road, Uphill, Weston-super-Mare, BS23 4YQ.
Tel. 01934-423900
Email: MedSecs-Admin@westonhospicecare.org.uk

Staff & applicants
for employment Human Resources HR Manager, Weston Hospicecare,
28 Thornbury Road, Uphill, Weston-super-Mare, BS23 4YQ.
Tel. 01934-423900
Email: hr.admin@westonhospicecare.org.uk

Volunteers Volunteer
Department Training & Volunteer Manager, Weston Hospicecare,
28 Thornbury Road, Uphill, Weston-super-Mare, BS23 4YQ.
Tel. 01934-423900
Email: volunteer@westonhospicecare.org.uk

Supporters, donors,
event participants Fundraising
Department Supporter Care Team, Weston Hospicecare,
28 Thornbury Road, Uphill, Weston-super-Mare, BS23 4YQ.
Tel. 01934-423900
Email: supporter.care@westonhospicecare.org.uk

Complaints
(non-Clinical) Hospice IG Lead Chief Executive, Weston Hospicecare,
28 Thornbury Road, Uphill, Weston-super-Mare, BS23 4YQ.
Tel. 01934-423900
C/o Email: louisa.clark@westonhospicecare.org.uk

There are two principle legal bases for our processing of your personal information:

1. You have given your consent for us to do so.
2. It is within our legitimate interest to do so.

Consent

Consent means that you have clearly and specifically provided your permission for the Hospice to contact you in a certain way, or ways, and have provided your personal information to us on a positive opt-in basis.

Note: some services in the Hospice provide an option to communicate with supporters via email. Please be aware that the hospice cannot guarantee the security of information contained within emails whilst in transit, and by consenting to this means of communication you are accepting this risk.

Legitimate interests

Legitimate interests means we have a reasonable and compelling justification to process personal information in the pursuit of our charitable objectives, thereby enabling us to run our charity effectively, but only where your personal data is used in ways you might reasonably expect and any impact on your privacy is minimal and predictable, and where those objectives cannot realistically be achieved through other means than processing of personal information.

The legitimate interests may be our own interests, a third party’s interests, or indeed your own interests.

When relying on legitimate interests as the legal basis for processing your personal data we make sure to consider and balance any potential impact on you (both positive and negative), and your rights and interests under data protection laws. Our legitimate interests do not automatically override yours and we will not use your information for activities where our interests are overridden by the impact on you, unless we have your consent or are otherwise required or permitted by law to do so.

The personal information we collect, hold and use is always kept to the minimum data necessary to achieve the specific purpose required, and therefore varies depending on why you are providing it.

Personal information may be collected verbally whether by telephone or face-to-face, electronically such as via online forms or by email, or on paper such as forms you complete and submit or letters.

Examples of the types of information we may collect from you are listed below, noting that for most purposes the personal information collected would be just a small subset of these:

• Name
• Address(es)
• Date of birth
• NHS number & hospital number if applicable
• Medical records
• Telephone number(s)
• Email address(es)
• Next of kin details
• Records of your communications with us
• Donation and gift aid information
• Bank details, when you set up a standing order or direct debit
• Card payment details (for donations, lottery membership, event entry, or a merchandise purchase – card details are held only for a single transaction, and are subsequently deleted)
• Information you elect to provide onto our website (such as date of birth or reason for donating)
• Confirmation of your health status for so-called ‘extreme’ sports activities
• Any other information you choose to share with us (such as your relationship to other supporters or patients).

Personal information may come to us directly or indirectly:

Directly

Personal information comes to us directly when for example you:

• Are referred to us as a patient or other service user, either from you, from your family, or from another health care professional involved in your care.
• Make a donation
• Register for an event
• Join our lottery
• Sign up to Gift Aid when donating goods to one of our shops
• Register as a Hospice volunteer
• Apply for employment
• Share your story with us we will collect details that enable us to process or administer our relationship with you.

Indirectly

Personal information comes to us indirectly when for example you:

• Use online fundraising sites such as JustGiving or Virgin Money Giving – only if you agree to them sending us your details.
• Register for an event, or sign up for a newsletter, via our website – the details you submit are collected on our behalf by our website provider.
• Set up a standing order or direct debit – your bank will send us enough details to be able to process and administer your donations.
• Agree to let a friend or colleague give us your details when registering for an event.
• Use our website:
  • Cookies on our website work to gather data about your time spent on our website to make your browsing experience more efficient and enjoyable. Cookies are small text files containing basic information about a particular website and user. If you would like to disable cookies, you can change your browser settings to reject cookies – for more information visit aboutcookies.org
  • When you use our website, tools like Google Analytics collect information such as your IP address, the browser you use (e.g. Internet Explorer, Google Chrome, etc…), domain names, time of day you accessed the website, and referring website addresses. This information helps improve our online services, assures security and helps protect against fraud. It also assists with diagnosing online problems with our website.
  • Please note our website may contain links to other websites which are not controlled by us. We are only responsible for our own website security and privacy policies as described herein, therefore we recommend you check the privacy notice/statement of any other websites that you may visit.

Weston Hospicecare promises never to share your personal data with any third party for their own marketing purposes, and never to sell your personal data.

We may need to share your information with selected service providers who help us to deliver against our fundraising activities and appeals – such providers are classified as ‘data processors’ who will only act under our specific instructions, are subject to pre-contract due diligence and contractual obligations containing strict data protection clauses. We do not allow these organisations to use your data for their own purposes or to disclose it to third parties, and we will take all reasonable care to ensure that they keep your data secure.

We are required to share our employees’ personal data with supporting organisations such as our employee pension providers and occupational health advisors, as well as HMRC and the Office for National Statistics. Hospice staff are referred to our Employee Privacy Notice for more information.

Very occasionally, the Hospice may be required by law to share personal data with privileged organisations such as the Police, regulatory bodies and legal advisors, or where urgent matters of care and/or safeguarding override other interests. In such cases we will always act proportionately and with maximum discretion.

Sharing of personal data for clinical care

In accordance with NHS guidance, the Hospice has an appointed Caldicott Guardian (CG); this is a senior member of our clinical staff who is registered as our CG, attends specific training annually, responsible for maintaining patient confidentiality and enabling appropriate sharing of clinical data with other health and social care providers involved in the care and support of our patients and service users.

Members of the Hospice team looking after you may need to share your personal information with each other and with other healthcare professionals such as nurses, doctors, therapists, pharmacists, clerical support staff, and medical students/trainees.

Please also refer to the information leaflet entitled “How do we use your information?” which is provided to new patients upon referral to the Hospice.

If we need to use your information for any reasons other than those described within this Privacy Notice, we will first consult you and ask for your explicit consent.

The Data Protection Act (2018) and related legislation gives you certain rights, including the right to:

• Request access to the personal data we hold about you. This is most usually achieved by completing a SAR (subject access request) form which we will provide to you upon request, but must otherwise be received digitally or in writing, and proof of identity is required. There will be no fee for subject access requests, unless a particular request is “manifestly unfounded or excessive”. The Hospice will make every effort to reply as quickly as possible and within 21 days. Requests to access the personal data of another person require both proof of identity and proof of authority.
• Request the correction or updating of inaccurate or incomplete personal information contained in our records, subject to certain safeguards. We do encourage you to update us as promptly as possible if your personal details change, however please note that we use data services periodically to update us on people who have moved home or who have died so as to ensure your records are as accurate and as current as possible. Requests to correct/update the personal data of another person require both proof of identity and proof of authority.
• Request that your information be deleted or removed where there is no need for us to continue processing it, and where the minimum retention time required by law has passed. This is also known as the “right to erasure” or the “right to be forgotten”.
• Ask us to limit or restrict the use of your personal information, where appropriate.
• Ask us to copy or transfer your personal information from or to another organisation in a safe and secure way, without impacting the quality of the data, provided we are reasonably able to do so. This is also known as the “right to data portability”.
• Object to how your personal information is used. Unless there are overriding safety or safeguarding issues, such an objection will usually result in an immediate suspension of the processing of your data until such time as it is mutually agreed that processing can continue, or will otherwise trigger a complaint – see below.
• Challenge any decisions made without human intervention (automated decision making).
• Require us to update/amend your contact preferences.
• Raise a complaint.
• In cases where you want us to disclose, delete or amend personal information relating to a person who has died, for example your deceased next of kin, the relevant legislation governing such a request is different, and the Hospice will cooperate and assist you to make your application in the appropriate way.

How to raise a complaint

To raise a complaint about how we have handled any aspect of your personal data, please contact one of the Hospice’s Information Governance (IG) Lead persons:

• For patients and service users: please contact our Clinical IG Lead/Caldicott Guardian.
• For all other persons: please contact the Hospice IG Lead.

The Information Commissioner’s Office (ICO) is the body that regulates the Hospice under prevailing data protection legislation.

For definitive advice on all matters pertaining to information governance and your personal data, please refer to the ICO. In particular, if you have made a complaint against the Hospice and you are not satisfied with our response or the way in which your complaint is being handled, please refer the matter to the ICO.

Information Commissioner’s Office,

Wycliffe House, Water Lane,

Wilmslow, Cheshire,

SK9 5AF.

Tel: 0303-1231113 (local rate) or 01625-545745 (if you prefer to use a national rate number)

Fax: 01625-524510

Email: casework@ico.org.uk

Website: https://ico.org.uk/