Privacy Notice - Treetops Hospice

Our Privacy Notice is below. You may also download the following documents: Privacy Notice Information Governance Leaflet Duty of Candour leaflet

Treetops Hospice Privacy Notice

Updated April 2023

During our day to day activities, Treetops Hospice collects, stores and processes personal information. When required, we process personal information about our patients, service users, their family members, carers, or friends; about those who volunteer with us in the hospice or in our charity shops and about our prospective, current and former donors, supporters; and staff. We may also process information about people in organisations with which we work closely, such as other healthcare professionals. We respect your privacy and recognise the need to limit the amount of information we collect and treat personal and sensitive data in a fair and lawful manner. No personal information held by us will be processed unless the requirements for fair and lawful processing can be met. Treetops has a duty to:

keep sufficient information to provide services and fulfil our legal responsibilities
keep your information secure and accurate
only keep your information as long as is required
collect, store and use the information you provide in a manner that is compatible with the UK General Data Protection Regulation and the Data Protection Act.

Access to personal and sensitive data is controlled, and only available on a ‘need to know’ basis. All staff receive training on the principles of data protection and information security. Data Protection laws give individuals rights in respect of the personal information that we hold about you. These are:

To be informed why, where and how we use your information.
To ask for access to your information.
To ask for your information to be corrected if inaccurate or incomplete.
To ask for your information to be deleted or removed where there is no need for us to continue processing it.
To ask us to restrict the use of your information.
To ask us to copy or transfer your information from one IT system to another in a safe and secure way, without impacting the quality of the information.
To object to how your information is used.

We will only hold your personal information for as long as necessary for business purposes or if we are required to keep it by law. We will retain personal data for the minimum period required by legislation or national guidance provided by statutory authorities or professional regulatory bodies. Our records management policy sets out the criteria we use for data retention. When no longer required personal information will be archived, either electronically or stored in a secure archive held offsite and then destroyed when the retention period has ceased. If you wish to ask Treetops about a data protection issue, request a copy of your data, or you have concerns about the processing of your personal data by Treetops, you may contact our Data Protection Officer via email dpo@treetopshospice.org.uk or by phone 0115 949 1264, or write to Treetops Hospice Derby Road Risley Derbyshire DE72 3SS Should you wish to lodge a complaint about the use of your information, details of our complaints policy can be found on our website here. If you are still unhappy with the outcome of your enquiry you can write to The Information Commissioners Office at The Office of the Information Commissioner Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF www.ico.org.uk Email: vasework@ico.org.uk Telephone 01625 545700. This privacy notice sets out in more detail how we process personal information in the following categories: CARE RECORDS EMPLOYMENT, VOLUNTEERING AND TRAINING RECORDS DONOR AND SUPPORTER RECORDS

1. Care Records

In order to ensure that we provide you with the highest quality of care, we keep records about you and the care we provide for you. Treetops Hospice collects, stores and processes personal information about potential, current and former patients and service users along with family members, carers or friends of patients, where there details have been provided to us for the purposes of providing care.

1.1 What types of personal data do we handle?

The personal data we process is provided to us by the individual and possibly also by a third party healthcare professional who has referred the individual to us for care. This can include: -

Personal details (gender, race, ethnicity, sexual orientation, religion)
Contact details (names, addresses, telephone numbers and emergency contact(s)
Medical information (physical and mental health conditions, medications, previous treatments and records of care given by other health and social care organisations)

Health records are held on paper and electronically and we have a legal duty to keep these confidential, accurate and secure at all times in line with Data Protection Laws.

1.2 What is the purpose of processing this data?

Treetops Hospice has a legal duty to care for its patients and service users and is contracted to provide services by the NHS. Processing this information is necessary for the provision of our services. We are working more closely in partnership with health and social care providers as services become more joined up and Treetops will share information as and when required with your consent. Sometimes we may need to share without telling you for legal reasons, or when it is in your vital interest or for safeguarding purposes. If we need to use your personal information for any reason beyond our legal duty, we will discuss this with you. You have the right to ask us not to use your information in this way. However, there are exceptions to this.

If the public interest is thought to be of greater importance: for example, if a serious crime has been committed; if there are risks to the public or our staff; to protect vulnerable children or adults.
Where we have a legal duty, for example reporting some infectious diseases, wounding by firearms and complying with court orders.
If we need to use the information for medical research. We have to ask permission from the Confidentiality Advisory Group (appointed by the NHS Health Research Authority) to do this.

Our staff are trained to handle your information correctly and protect your confidentiality and privacy. We aim to maintain high standards, adopt best practice for our record keeping and regularly check and report on how we are doing. Your information is never collected for direct marketing purposes and is not sold on to any other third parties. Your information is not processed overseas.

1.3 Sharing your information

We ask for your consent to share your information with other organisations as and when appropriate in order that we can provide effective care to you. If you do not want us to do this, you have the right to ask us not to and we will discuss with you the implications this may have for your care. We will not routinely disclose any information about you without your express permission. However, there are circumstances where we must or can share information about you owing to a legal/statutory obligation.

How the NHS and care services use your information

Whenever you use a health or care service, such as attending Accident & Emergency or using Community Care services, important information about you is collected in a patient record for that service. Collecting this information helps to ensure you get the best possible care and treatment. The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

improving the quality and standards of care provided
research into the development of new treatments
preventing illness and diseases
monitoring safety
planning services

This may only take place when there is a clear legal basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law. Most of the time, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information isn’t needed. You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out your confidential patient information will still be used to support your individual care. To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters. On this web page you will:

See what is meant by confidential patient information
Find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
Find out more about the benefits of sharing data
Understand more about who uses the data
Find out how your data is protected
Be able to access the system to view, set or change your opt-out setting
Find the contact telephone number if you want to know any more or to set/change your opt-out by phone
See the situations where the opt-out will not apply

You can also find out more about how patient information is used at: Patient information and health and care research - Health Research Authority (hra.nhs.uk) (which covers health and care research); and Introducing patient data | Understanding patient data (which covers how and why patient information is used, the safeguards and how decisions are made) You can change your mind about your choice at any time. Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement. Health and care organisations have until 2020 to put systems and processes in place so they can be compliant with the national data opt-out and apply your choice to any confidential patient information they use or share for purposes beyond your individual care. Treetops Hospice have identified that at present we have no data flows that the new policy effects, however we will ensure all staff are aware of the policy and have communication’s and materials provided to our staff, patients, volunteers and our community. If you want further information about the handling of care records and patient information, please contact our Caldicott Guardian Philippa Shreeve, Director of Clinical Services by phone on 0115 949 1264 or by email at pshreeve@treetopshospice.org.uk

2. Employment, Volunteering and Training Records

Treetops Hospice collects, stores and processes personal information about potential, current and former staff, including applicants, employees (and former employees), agency, casual and contracted staff as well as volunteers current, past and prospective and trainees.

2.1 What types of personal data do we handle?

The personal data is provided to us by individuals at the point of application or engagement for temporary staff. In order to carry out our requirements as an employer we collect data in relation to:

Personal demographics (gender, age, race, ethnicity, sexual orientation, religion)
Contact details (names, addresses, telephone numbers and emergency contact(s)
Employment records (professional membership, references and proof of eligibility to work in the UK and security checks) employment history, including performance and attendance records
Bank details
Pension details
Medical information including physical health or mental condition (occupational health information)
Information relating to health and safety
Trade union membership
Offences (including alleged offences), criminal proceedings, outcomes and sentences
Employment Tribunal applications, complaints, accidents, and incident details
Details of your emergency contact(s)

Our staff are trained to handle your information correctly and protect your confidentiality and privacy; we do not undertake automated decision-making such as profiling. We aim to maintain high standards, adopt best practice for our record keeping and regularly check and report on how we are doing. We always try to work with organisations which operate within the European Economic Area (EEA). Where we work with a supplier operating outside the EEA, we will ensure they provide an appropriate level of protection.

2.2 What is the purpose of processing this data?

We have a legal basis to process this as part of your employment (either permanent or temporary) or as part of our recruitment processes following data protection and employment legislation. We process your data for the following reasons:

Staff payroll and performance
Pensions administration
Business management and planning
Accounting and Auditing
Crime prevention and prosecution of offenders
Provision of education and training
Health administration and services

The provision of personal data is part of our contractual requirement. Failing to provide the personal data required would mean we would be unable to complete our recruitment processes and we could not engage you in a contract of employment.

2.3 Sharing your information

Any disclosures of personal information are always made on case-by-case basis, using the minimum personal information necessary for the circumstances. Appropriate security controls are always in place. Information is only shared with those agencies and bodies who have a "need to know" or where you have consented to the disclosure of your personal information. There are a number of reasons why we share information. This can be due to:

Our obligations to comply with legislation
Our duty to comply any Court Orders which may be imposed
We may use the information we hold about you to detect and prevent crime or fraud.

We will not routinely disclose any information about you without your express permission. However, there are circumstances where we must or can share information about you owing to a legal/statutory obligation. To enable effective staff administration we share your information with some specific external organisations in order to comply with our obligations as an employer. Further details can be provided by our Human Resources Department, who can be contacted by email hr@treetopshospice.org.uk or by phone on 0115 949 1264

3. Donor and Supporter Records

Treetops Hospice collects, stores and processes personal information about prospective, current and former donors and supporters of the charity.

3.1 What personal data do we hold?

The personal data we hold in relation to donors and supporters is provided by individuals at the point at which they choose to engage with us. For example, through fundraising donations, attending our fundraising events, playing our lottery, via the donation of Gift Aid on the sale of donated goods in one of our charity shops. In order to carry out our activities in relation to donors and supporters, we handle data in relation to:

Personal details (e.g. date of birth, hobbies or interests)
Contact details (names, addresses, telephone numbers and email).
Bank account and credit card details (direct debit or standing order details for lottery subscribers)
Details of your donation including gift aid
A record of any messages or communication we have had with you

Our staff are trained to handle your information correctly and to protect your confidentiality and privacy. Although rarely, we may undertake decision-making such as profiling to help us provide you with a better, more relevant experience when we communicate with you. We may ask professional, compliant and approved third-party agencies to help us with this task and this could mean them handling your data. However, we will never sell your data for other agencies to use for their own purposes. We aim to maintain high standards, adopt best practice for our record keeping and regularly check and report on how we are doing. Your information is only collected for our own marketing purposes and is never collected for or sold to other organisations. We always try to work with organisations which operate within the European Economic Area (EEA). Where we work with a supplier operating outside the EEA, we will ensure they provide an appropriate level of protection.

3.2 What is the purpose of processing this data?

We have a legal basis to process this on the basis of your consent to provide us with this information. Please also see Section 4. Legitimate Interest. You may withdraw your consent for us to process this data at any time. We process your data for the following reasons, including:

Fundraising activities, soliciting donations and support in kind
Marketing and communication about our activities including events
Securing your consent to the donation of Gift Aid on the sale of donated goods.

3.3 Sharing your information

Any disclosures of personal data are always made on case-by-case basis, using the minimum personal data necessary for the specific purpose and circumstances and with the appropriate security controls in place. In order to process your information and donations to the highest possible standards, we will sometimes need to give other organisations access to your data. Examples include database storage, printers and email software providers. We may use the information we hold about you to detect and prevent crime or fraud. We may also share this information with other bodies that inspect and manage public funds. We will not routinely disclose any information about you without your express permission. However, there are circumstances where we must or can share information about you owing to a legal/statutory obligation (such as HMRC for Gift Aid records).

4. Legitimate Interest Processing Relating to Donors and Supporters

While continuing to follow an opt in approach for all electronic communications activity through email and text, Treetops will use legitimate interest as the basis for post and phone communications activity. A combination of these two approaches is the most appropriate way of meeting the needs of the charity and the expectations of our donors and supporters. Broadly speaking 'Legitimate Interest' means that we can process your personal information if we have a genuine and legitimate reason, and we are not harming any of your rights and interests. This means that, when you provide your details to us, we use your information for our legitimate charitable interests to carry out our work to help people with a life-limiting illness live life to the full and help family friends and carers to continue with life after loss. Some typical examples of when we might use the approach are for: fundraising, preventing fraud, direct marketing, maintaining the security of our system, data analytics, enhancing, modifying or improving our services.

Our Legitimate Interests:

We believe that people who share our values would love to know how to support us. We will process the personal information you have supplied to us to conduct and manage our business to enable us to give you the most appropriate marketing, information, and service; and provide the best and most secure experience. These are what we consider to be our 'Legitimate Interests'. The following are some examples of when and why we would use this approach in our work: Direct Marketing: We will send updates on our work – including the challenges and the impact that has been achieved. We will send postal marketing and fundraising 'asks' which further our aims and objectives. We will tailor this information to your interests as far as we are able. Your best interest: Processing your information to protect you against fraud, for example when transacting on our website, and to ensure our websites and systems are secure. Personalisation: Where the processing enables us to enhance, modify, personalise or otherwise improve our services/communications for the benefit of our supporters. Analytics and Research: To process your personal information for donor analysis, assessment, and profiling, on a personalised or aggregated basis, to develop our products, services, systems and relationships with you to help us with our activities. Treetops Hospice will never sell your data to a third party. Due Diligence: We may need to conduct investigations on supporters and business partners to determine if those companies and individuals have been involved or convicted offences such as fraud, bribery and corruption. We will also hold information about you so that we can respect your preferences for being contacted by us.

Your Interests:

When we process your personal information for our legitimate interests, we will consider and balance any potential impact on you and your rights under data protection and any other relevant law. Our legitimate interests do not automatically override your interests – we will not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

5. Withdrawing your consent

Should you wish to withdraw your consent to our processing your data, please just contact us either through our Fundraising Department at fundraising@treetopshospice.co.uk or by phone on 0115 949 1264, our Lottery Department on lottery@treetopshospice.org.uk or by phone on 0115 9399339 or fill in our preferences form. If you wish to withdraw your consent to our processing of your data in respect of Gift Aid donations in our shops, please contact our Retail Giftaid administrator at ymarquess@treetopshospice.org.uk or by phone on 0115 949 7354. ALL departments can all also be contacted via our main hospice number 0115 949 1264.