We are committed to protecting your privacy and will only use personal data that we collect in line with all applicable laws, including the UK General Data Protection Regulation (UK GDPR).

Supporters

May 2024

Supporter Privacy Notice

This privacy notice is intended to let you know how and why we use the data you provide to us. You don’t need to do anything – but please read this notice carefully. We may update this notice from time to time, so please check it regularly.

  1. Who we are

Princess Alice Hospice (“the Hospice”) is a registered charity number 1010930 and a company limited by guarantee in England and Wales number 1599796. Registered office: West End Lane, Esher, Surrey KT10 8NA. The Hospice has two wholly-owned subsidiaries, PAH Trading Limited (Reg. No 1925762) and PAH Lottery Limited (Reg. No. 3347939), which are incorporated in the UK for the purposes of generating income for the Hospice’s charitable purposes.

We are committed to protecting your privacy and will only use personal data that we collect in line with all applicable laws, including the UK General Data Protection Regulation (UK GDPR).

  1. What data do we collect about you?

Personal data we collect may include one or more of the following:

  1. Your name
  2. Contact address
  3. Telephone number(s)
  4. Email address
  5. Records of your correspondence with us
  6. Donation and gift aid details
  7. Gifts in Will details
  8. Bank details for a Direct Debit
  9. Card payment details to process a donation
  10. Information you may enter onto the website (such as date of birth)
  11. Any information you choose to share with us (such as relationships to other donors)

When you use our website, we use tools like Google Analytics and Crazy Egg to collect information such as the browser you use (eg Microsoft Edge, Firefox, etc), IP address, domain names, page visits, clicks and mouse movements, how long you spend on a page, the time of day you accessed the website and referring website addresses. This information helps improve our online services, ensures security and helps protect against fraud. It also assists with diagnosing online problems with our website.

Our Cookies Policy is here: https://www.pah.org.uk/cookies (you can delete and change your cookie preferences at any point).

Security systems

The Hospice operates a non-audible Closed-Circuit Television (CCTV) surveillance system (“the system”) outside the Hospice premises with images being monitored and recorded. The system is owned, operated and managed by the Hospice. It is used for maintaining public and staff safety, the security of property and premises and for the detection, prevention and investigation of crime. Where appropriate, in exceptional cases, it may also be used to monitor staff when carrying out work duties. Disclosure of recorded material will only be made to third parties in accordance with the purposes of the system and in compliance with Data Protection legislation.

We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary.

CCTV images are only kept for 25 days unless we have a lawful purpose to retain them such as a request from the police or for our own internal investigations as a Hospice.

Images are stored in our secure IT systems and access to view recorded images is restricted to key individuals.

Also, for the security of our employees and service users, when lone working our employees may carry personal alarms which, when activated by the employee, will audio record conversations with customers and service users. The audio recording is risk assessed by the SoloProtect Security Centre, which also holds information about our employees such as their name, ethnicity and geolocation. In the event of an unsafe situation, this information will be escalated to managers at the Hospice and also to the Emergency Services when appropriate. Data is held securely and retained in line with data protection legislation. You can find out more here: Privacy Policy – SoloProtect UK

  1. How do we use the data we collect about you?

We use your personal data for a number of purposes including the following:

  • to process and acknowledge your donation, sponsorship or gift aid
  • to deliver services, literature and/or other materials and information you have requested from us
  • unless you tell us otherwise, to send you information we think may be of interest, such as updates on our work, news, fundraising appeals, lottery, shops, volunteering opportunities and events. We may send this information by e-mail, if you have given us your consent
  • to contact you about making a celebratory gift, donating in memory, leaving a gift in your Will, or to give you details of other ways to support or fundraise for the Hospice that you have expressed an interest in
  • to run our internal administration and keep a record of your relationship with us
  • to manage your communication preferences, i.e. how you have chosen to be contacted
  • to carry out research and surveys about our services
  • to comply with applicable laws and regulations

To help us understand our supporters better, we sometimes review received data to evaluate interests and preferences. We also look at geo-demographic information, i.e. the area you live in and the socio-economic make-up of your neighbourhood. Information is taken from publicly available sources, such as public registers of listed Directorships, typical earnings in a geographic area, information from the electoral roll, press reports and social media posts.

This means that when we need to approach supporters for donations, we do it ethically and cost effectively by asking the right people and organisations at the right time.

By law, we’re allowed to process your data for one or more of the following reasons:

  • you have given consent
  • it is necessary for us to be legally compliant
  • there is a legitimate interest to do so, e.g. to continue our existing relationship, in order to ask for your support and process donations for our Charity provided you haven’t requested we don’t contact you. In this way we are providing ongoing awareness of our fundraising journey.

Rest assured, we never share, sell, swap or rent your data to third parties for marketing purposes.

Sometimes, we need to share information with authorised people or organisations so they can deliver services to you. For example, we use an external party to help with our furniture collection and delivery service and you would be informed of this at the point of booking. The Hospice also works with the National Free Wills Network who provide free Will writing services to supporters who opt in to the service.

Local Hospice Lottery are an independent organisation that administers our lottery and are the Data Controller for our lottery players. You can read their privacy notice here: Privacy Policy – Local Hospice Lottery

If we do work with a third party, we only give them the information they need to deliver the service – and we always make sure that they will protect your information with securities and confidentiality processes equivalent to ours.

We will always keep your data secure and confidential. However, disclosure may be required by law, for example to government bodies and law enforcement agencies.

  1. How we protect and keep your data?

We don’t keep your data for longer than is necessary for the purposes for which it is used. This is in accordance with our Records Management Policy and adheres to the requirements of the UK GDPR.

If you tell us not to contact you, we will update our records accordingly.

We have security procedures, rules and technical measures to protect your data. Your data will be kept in a secure environment with access restricted on a need-to-know basis.

Personal data will not be transferred to a country or territory outside the European Economic Area unless there is a specific operational reason to do so, in which circumstance we are obliged to ensure that the Country or Territory concerned ensures an equal level of cyber security/protection and confidentiality procedures (UK General Data Protection Regulation) for your rights and freedoms, in relation to the processing and storage of personal data.

We may, for financial or technical reasons, use the services of an Internet Services Provider and/or email marketing automation processor located outside the European Economic Area. However, we will make sure that your personal data will be held by those providers according to European data protection regulations. We will take all reasonable steps to ensure that your data is treated securely and in accordance with this privacy notice.

When using websites owned by other organisations to communicate with us, such as Twitter or Facebook, you should check their privacy policies/notices.

  1. How do you update your personal data?

We want to make sure that your personal data is accurate and up to date. Please let us know if your details change. We may use publicly available sources to keep your records up to date: for example, checking your postcode is correct by using the Royal Mail postcode lookup facility.

To let us know of any changes please contact:

Customer Experience Team
Princess Alice Hospice
West End Lane
Esher
Surrey
KT10 8NA

E-mail: customerexperience@pah.org.uk

Tel: 01372 461808

  1. What rights do I have over my personal data?

Under the UK General Data Protection Regulation, you have the right to:

  • access your personal data
  • rectify, erase or restrict your data
  • object to the processing of your data
  • data portability – request transfer of data
  • lodge a complaint with Princess Alice Hospice or the overarching regulator, the Information Commissioners Office (details on request).

For more information, please contact the Princess Alice Hospice Data Protection Officer using the following contact details:

Data Protection Officer
BLS Stay Compliant
Blake House
18 Blake Street
York
YO1 5QG

Email: info@bls-ltd.co.uk

  1. Changes to this privacy notice

Rules, regulations, suppliers and providers around data can change and therefore our privacy notice will change too so it’s worth visiting this page from time to time to check for updates. At the start of this privacy notice we tell you when it was last updated.

 

Education Customers

May 2024

Education Department Privacy Notice 

This privacy notice is intended to let you know how and why we use the data you provide to us. You don’t need to do anything – but please read this notice carefully.  We may update this notice from time to time so please check it regularly.

  1. Who we are

Princess Alice Hospice (“the Hospice”) is a registered charity number 1010930 and a company limited by guarantee in England and Wales number 1599796. Registered office West End Lane, Esher, Surrey KT10 8NA.

We are committed to protecting your privacy and will only use personal data that we collect in line with all applicable laws, including the UK General Data Protection Regulations (UK GDPR).

  1. What data do we collect about you?

Personal data we collect may include one or more of the following:

  1. your name
  2. contact address
  3. telephone number(s)
  4. e-mail address
  5. records of your correspondence with us
  6. card payment details to process a course payment
  7. assignment submissions and exam results
  8. Your communications via our Learning Management System (LMS), for example, forum posts

In addition to the above, we may take photographs and record meetings/video conferencing sessions for the purposes of sharing the course content with other learners or for publicity. If we wish to do this, you will be informed beforehand, given details of how we will use this data and asked for your permission.

When you use our website, we use tools like Google Analytics and Crazy Egg to collect information such as the browser you use (eg Microsoft Edge, Firefox, etc), IP address, domain names, page visits, clicks and mouse movements, how long you spend on a page, the time of day you accessed the website and referring website addresses. This information helps improve our online services, ensures security and helps protect against fraud. It also assists with diagnosing online problems with our website.

Our Cookies Policy is here: https://www.pah.org.uk/cookies (you can delete and change your cookie preferences at any point).

Security systems

The Hospice operates a non-audible Closed-Circuit Television (CCTV) surveillance system (“the system”) outside the Hospice premises with images being monitored and recorded. The system is owned, operated and managed by the Hospice. It is used for maintaining public and staff safety, the security of property and premises and for the detection, prevention and investigation of crime. Where appropriate, in exceptional cases, it may also be used to monitor staff when carrying out work duties. Disclosure of recorded material will only be made to third parties in accordance with the purposes of the system and in compliance with Data Protection legislation.

We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary.

CCTV images are only kept for 25 days unless we have a lawful purpose to retain them such as a request from the police or for our own internal investigations as a Hospice.

Images are stored in our secure IT systems and access to view recorded images is restricted to key individuals.

Also, for the security of our employees and service users, when lone working our employees may carry personal alarms. When off-site, an employee may “check-in” before a visit, recording their name, address and any perceived risks. If the alarm is activated by the employee, an additional audio recording of conversations/altercations with customers and/or service users will be triggered. On activation, the check-in and audio recording is risk assessed by the SoloProtect Security Centre, which also holds information about our employees, such as their name, ethnicity and geolocation. In the event of an unsafe situation, this information will be escalated to managers at the Hospice and also to the Emergency Services when appropriate. Data is held securely and retained in line with data protection legislation. You can find out more here: Privacy Policy – SoloProtect UK    

 

 

  1. How do we use the data we collect about you?

We use your personal data for a number of purposes including the following:

  • to deliver services, literature and/or other materials and information you have requested from us
  • to assess candidate performance in written assignments and examinations
  • to create supportive online communities/aumni for certain courses, such as the European Certificate in Essential Palliative Care (ECEPC)
  • unless you tell us otherwise, to send you information that we think you may be interested in, including updates on our work, news, events and research. We may send this information by e-mail, where you have provided consent
  • for our own internal administrative purposes
  • to manage your communication preferences, i.e. how you have chosen to be contacted
  • to carry out research and surveys about our services
  • to comply with applicable laws and regulations.

By law we’re allowed to process your data for one or more of the following reasons:

  • you have provided consent
  • it is necessary for us to be legally compliant
  • there is a legitimate interest to do so, e.g. to fulfil our aims as a charity to share our knowledge and expertise (unless you have specifically asked us not to do so)
  • it is necessary to process your course bookings or enquiries.

Rest assured, we never share, sell, swap or rent your data to third parties for marketing purposes.

We only provide authorised external trainers with the data they need to deliver relevant training services and ensure they have the same or equivalent securities and confidentiality processes in place, as we utilise within the Hospice.

We will always keep your data secure and confidential. However, disclosure may be required by law, for example to government bodies and law enforcement agencies.

  1. How we protect and keep your data?

We do not keep your data for longer than is necessary for the purposes for which it was provided.  This is in accordance with our Data Retention policy and adheres to the requirements of the UK GDPR.

If you tell us not to contact you we will update our records accordingly.

We have security procedures, rules and technical measures to protect your data. Your data will be kept in a secure environment with access restricted on a need-to-know basis.

Personal data will not be transferred to a country or territory outside the European Economic Area unless there is a specific operational reason to do so,  in which circumstance,  we are obliged to ensure that the Country or Territory concerned ensures an equal level of cyber security/protection and confidentiality procedures (UK General Data Protection Regulation) for your rights and freedoms, in relation to the processing and storage of personal data.

We may, for financial or technical reasons, use the services of an Internet Services Provider and/or e-mail marketing automation processor located outside of the European Economic Area. However, we will make sure that your personal data will be held by those providers in accordance with European data protection regulations. We will take all reasonable steps to ensure that your data is treated securely and in accordance with this privacy notice.

When using websites owned by other organisations to communicate with us, such as Twitter or Facebook, please consult their privacy policies/notices.

  1. How do you update your personal data?

We want to make sure that your personal data is accurate and up to date. Please let us know if your details change. We may use publicly available sources to keep your records up to date, for example, checking your postcode is correct by using the Royal Mail postcode lookup facility.

To let us know of any changes please contact:

Education Department
Princess Alice Hospice
West End Lane
Esher
Surrey
KT10 8NA

E-mail: education@pah.org.uk

Tel: 01372 461988

  1. What rights do I have over my personal data?

Under the UK General Data Protection Regulation, you have the right to:

  • access your personal data
  • rectify, erase or restrict your data
  • object to the processing of your data
  • data portability – request transfer of data
  • to lodge a complaint with the Hospice or the overarching regulator, the Information Commissioner’s Office (details on request)

For more information, please contact the Princess Alice Hospice Data Protection Officer using the following contact details:

Data Protection Officer
BLS Stay Compliant
Blake House
18 Blake Street
York
YO1 5QG

Email: info@bls-ltd.co.uk

  1. Changes to this privacy notice

Rules, regulations, partners and suppliers around data can change, therefore our privacy notice will change too, so it’s worth visiting this page from time to time to check for updates.  At the start of this privacy notice we tell you when it was last updated.

 

Employees & Job Applicants

May 2024

Employees and Job Applicants Privacy Notice

This privacy notice is intended to let you know how and why we use the data you provide to us. You don’t need to do anything – but please read this document carefully. We may update this notice from time to time, so please check it regularly.

  1. Who we are

Princess Alice Hospice is a registered charity number 1010930 and a company limited by guarantee in England and Wales number 1599796. Registered office: West End Lane, Esher, Surrey KT10 8NA. The Hospice has two wholly-owned subsidiaries, PAH Trading Limited (Reg. No 1925762) and PAH Lottery Limited (Reg. No. 3347939), which are incorporated in the UK for the purposes of generating income for the Hospice’s charitable purposes.

We are committed to protecting your privacy and will only use personal data that we collect in line with all applicable laws, including the Data Protection Act 2018 and UK General Data Protection Regulation (UK GDPR).

  1. What data do we collect about you?

We collect personal data about you for employment purposes, with the aim of meeting the regulatory and contractual obligations to enable us to carry out our duties as an employer. This includes processing your pay and pension, providing information for statistical purposes, and ensuring that all health and safety standards are successfully complied with.

The personal data we collect may include one or more of the following:

  1. Your name
  2. Home address
  3. Telephone number(s)
  4. E-mail address
  5. Bank details
  6. Emergency contact details
  7. Date of birth
  8. Gender
  9. National Insurance number
  10. Nationality
  11. DBS certificate number and date
  12. Copies of qualifications and professional registration numbers (e.g. NMC, GMC)
  13. Pre – employment references
  14. Photo
  15. Health conditions
  16. Ethnicity
  17. Vehicle registration details
  18. Records of your correspondence with us
  19. Proof of ID / Proof of right to work in the UK
  20. CCTV footage
  21. Any information you choose to share with us (such as information for statistical purposes)
  22. Information you may send to us or enter onto our website (such as speculative CV’s or Application Forms).

When you use our website, we use tools like Google Analytics and Crazy Egg to collect information such as the browser you use (eg Microsoft Edge, Firefox, etc), IP address, domain names, page visits, clicks and mouse movements, how long you spend on a page, the time of day you accessed the website and referring website addresses. This information helps improve our online services, ensures security and helps protect against fraud. It also assists with diagnosing online problems with our website.

Our Cookies Policy is here: https://www.pah.org.uk/cookies (you can delete and change your cookie preferences at any point).

Security systems

The Hospice operates a non-audible Closed-Circuit Television (CCTV) surveillance system (“the system”) outside the Hospice premises with images being monitored and recorded. The system is owned, operated and managed by the Hospice. It is used for maintaining public and staff safety, the security of property and premises and for the detection, prevention and investigation of crime. Where appropriate, in exceptional cases, it may also be used to monitor staff when carrying out work duties. Disclosure of recorded material will only be made to third parties in accordance with the purposes of the system and in compliance with Data Protection legislation.

We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary.

CCTV images are only kept for 25 days unless we have a lawful purpose to retain them such as a request from the police or for our own internal investigations as a Hospice.

Images are stored in our secure IT systems and access to view recorded images is restricted to key individuals.

Also, for the security of our employees and service users, when lone working our employees may carry personal alarms. When off-site, an employee may “check-in” before a visit, recording their name, address and any perceived risks. If the alarm is activated by the employee, an additional audio recording of conversations/altercations with customers and/or service users will be triggered. On activation, the check-in and audio recording is risk assessed by the SoloProtect Security Centre, which also holds information about our employees, such as their name, ethnicity and geolocation. In the event of an unsafe situation, this information will be escalated to managers at the Hospice and also to the Emergency Services when appropriate. Data is held securely and retained in line with data protection legislation. You can find out more here: Privacy Policy – SoloProtect UK    

 

  1. How we use the data we collect about you?

We use your personal data for a number of purposes including the following:

  • to process job enquiries and expressions of interest
  • to complete our recruitment process
  • to process the details of your contract of employment, pay and pension, and keep a record of employment related matters
  • to deliver our services as an employer
  • for our own internal administrative purposes
  • for statistical purposes appropriate to our services
  • to comply with relevant laws and regulations.

By law we’re allowed to process your data for one or more of the following reasons:

  • you have provided consent
  • it is necessary for us to be legally compliant
  • there is a legitimate interest to do so (e.g. in our role as an employer)

We will never share, sell, swap or rent your data to third parties for marketing purposes.

We only provide authorised parties (for example, the HMRC, Health & Safety Executive, pension schemes, our childcare vouchers provider, etc) with the data they need to deliver relevant services.

We will always keep your data secure and confidential. However, disclosure may be required by law, for example to government bodies and law enforcement agencies.

  1. How we protect and keep your data?

We don’t keep your data for longer than is necessary for the purposes for which it is processed.  This is in accordance with our Records Management Policy which adheres to the requirements of the UK GDPR.

We have security procedures, rules and technical measures to protect your data. Your data will be kept in a secure environment with access restricted to a need-to-know basis.

  1. How do you update your personal data?

We want to make sure that your personal data is accurate and up to date. Please let us know if your details change.

To let us know of any changes please contact:

People Services
Princess Alice Hospice
West End Lane
Esher
Surrey
KT10 8NA

E-mail: peopleservices@pah.org.uk

Tel: 01372 461 852

  1. What rights do I have over my personal data?

Under the UK General Data Protection Regulations, you have the right to:

  • access your personal data by making a Subject Access Request
  • rectify, erase or restrict your data where this is justified
  • object to the processing of your data where this is justified
  • data portability – request transfer of data where this is justified
  • lodge a complaint with the Hospice or the primary regulator, the Information Commissioner’s Office (details available on request).

For more information, please contact the Princess Alice Hospice Data Protection Officer using the following contact details:

Data Protection Officer
BLS Stay Compliant
Blake House
18 Blake Street
York
YO1 5QG

Email: info@bls-ltd.co.uk

  1. Changes to this privacy notice

Rules, regulations, partners and suppliers around data can change, which means that our privacy notice will change too. Therefore, it’s worth visiting this page from time to time to check for updates. At the start of this privacy notice we tell you when it was last updated.

Patients & Patient Representatives

May 2024

Our commitment to you

We are committed to protecting and respecting your privacy as a patient or family member or carer of the patient.

This notice (together with any other documents referred to in it) sets out the basis on how any personal data we collect from you, or that you provide to us, or that we obtain about you, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

This privacy notice explains the following:

  • What information Princess Alice Hospice (“the Hospice”) may collect about you
  • How we will use any information we have collected from you
  • When the Hospice will share your information with others
  • Your rights under data protection legislation
  • What to do if you are unhappy with how we use your data.

We are committed to safeguarding your personal information. Whenever you provide information such as this, we are legally obliged to use your information in line with all laws concerning the protection and security of personal information, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy & Electronic Communications (EC Directive) Regulations 2003.

Who we are

Princess Alice Hospice is a registered charity in England and Wales with charity number 1010930. The registered address is: Princess Alice Hospice, West End Lane, Esher, Surrey KT10 8NA.

We are a registered Data Controller with the Information Commissioner’s Office – Reg no: Z6460055.

The Hospice has two wholly-owned subsidiaries, PAH Trading Limited (Reg. No 1925762) and PAH Lottery Limited (Reg. No. 3347939), which are incorporated in the UK for the purposes of generating income for the Hospice’s charitable purposes.

We are committed to protecting your privacy and will only use personal data that we collect in line with all applicable laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Why we process information about you

In order to support your care, health professionals maintain records about you. We take great care to ensure your information is kept securely, that it is up-to-date, accurate and used appropriately. All of our Hospice staff are fully trained to understand their legal and professional obligations to protect your information and will only look at your information if they need to. They will only look at what they need to in order to do things like arrange to visit you, give palliative care advice, provide you with care and, if necessary, refer you on to other services.

Your care will sometimes be discussed with colleagues within the service to ensure that your care is co-ordinated and/or to obtain further advice from other team members (e.g. doctors, occupational therapists, pharmacists, physiotherapists, psychologists, nurse specialists, dieticians, chaplains, social workers, patient equipment and transport services etc).

We have a small number of highly-skilled volunteers who may be involved in processing your data in order to deliver care and support, for example, in Bereavement Support, Chaplaincy and Complementary Therapy. We always ensure that these volunteers receive appropriate training, supervision, support and audit.

We look to deliver care in our community and remotely, wherever appropriate. As such, we may process information in order to deliver the following:

Remote Consultations via accuRx

You may be offered a remote consultation as an alternative to a home visit. If you agree to a remote consultation, the health or social care professional will send you a link via email or text message. We use a service called accurRx, which integrates with our patient care database.

Images will only be collected where it is necessary for providing health care and with patient consent. The approach to video-consulting, image sharing and storage is the same as it would be for face-to-face interactions.

Further details about how remote consultation works can be obtained by contacting the Hospice.

accuRx will also be used to send and receive SMS messages for survey and feedback purposes. Certain patient groups may receive information, reminders and advice via the accuRx platform.

Wellbeing sessions over Zoom

The Wellbeing Centre offer a range of sessions for patients and carers and some of these are delivered via Zoom, a video-conferencing service. Sessions are never recorded and there are procedures in place to protect your privacy. If you join group sessions, our Wellbeing Team make sure everyone understands the expectations with regard to confidentiality.

Bereavement support over Zoom

Our bereavement support volunteers may be able to offer one-to-one support sessions via Zoom. Again, sessions are never recorded and procedures are in place to protect your privacy.

Off-site security for employees and service users

When lone working our employees may carry personal alarms. When off-site, an employee may “check-in” before a visit, recording their name, address and any perceived risks. If the alarm is activated by the employee, an additional audio recording of conversations/altercations with customers and/or service users will be triggered. On activation, the check-in and audio recording is risk assessed by the SoloProtect Security Centre, which also holds information about our employees, such as their name, ethnicity and geolocation. In the event of an unsafe situation, this information will be escalated to managers at the Hospice and also to the Emergency Services when appropriate. Data is held securely and retained in line with data protection legislation. You can find out more here: Privacy Policy – SoloProtect

What is our legal basis for collecting your data?

The primary lawful basis for the Hospice to process your personal data is under Article 6(1)(f) of the UK GDPR. Processing your data is necessary for the purposes of the legitimate interests pursued by the Hospice in providing end of life care support and services in our local community and within our Hospice or by another third party associated with us.

Where we collaborate and share information with other Healthcare providers such as your GP, Article 6(1)(e) of the UK GDPR provides a lawful basis for processing where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Hospice. For example the NHS Act 2006 and the Health and Social Care (Safety and Quality) Act 2015 both provide a duty to share. We also support the Caldicott Principles in Health and Social Care which states that the duty to share information can be as important as the duty to protect patient confidentiality.

Depending on the processing activity, we also rely on the following lawful basis for processing your personal data under the UK GDPR:

  • Article 6(1)(b) which relates to processing necessary for the performance of a contract.
  • Article 6(1)(c) so we can comply with our legal obligations as a Hospice with associated services.
  • Article 6(1)(d) in order to protect your vital interests or those of another person.

Special category data

We may process sensitive personal data which includes racial or ethnic origin; sexual orientation; political opinions; religious or philosophical beliefs and data concerning your health.

The primary additional basis for processing that we rely on is Article 9(2)(h) where the processing is for the purposes of preventive or occupational medicine, for the assessment of the working capacity of an employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services based on legislation or pursuant to contract with a health professional.

The relevant basis in UK law is set out in the Data Protection Act (DPA) 2018, in Schedule 1 condition 2.

Article 9(3) of the UK GDPR contains the additional safeguard that the Hospice can only rely on this condition if the personal data is being processed by (or under the responsibility of) a professional who is subject to an obligation of professional secrecy.

Section 11 of the DPA 2018 makes it clear that in the UK this includes:

(a) a health professional or a social work professional; or

(b) another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.

Article 9(2)(f) permits us to process special category data where the processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.

Article 9(2)(c) permits us to process special category data where the processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent.

Article 9(2)(g) permits us to process special category data where the processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

The relevant basis in UK law is set out in section 10(3) of the DPA 2018. This means that we should also meet one of the 23 specific substantial public interest conditions set out in Schedule 1 (at paragraphs 6 to 28).

Subject to the conditions and safeguards and Schedule 1 of the Data Protection Act 2018, the Hospice relies on (6) our statutory purposes as a healthcare provider, (16) where we support individuals with a particular disability or medical condition, (17) for our Counselling services and (18) where we need to safeguard children and individuals at risk.

We may also process personal data where it is in the public interest to do so (for example, a notification of infectious diseases (NOID) that need to be reported to the Local Authority health protection team).

Information about your family members, carers and others that you identify as important to you

We record names and contact details about your family members, carers and others that you identify as important to you in order to:

  • Keep them informed of changes in your situation (unless you ask us not to)
  • Ensure they are involved in planning that might affect them as well as you (e.g. if we were arranging for health or other professionals to visit you at home, or for equipment to be delivered)
  • Offer support, including emotional and psychological support, if needed
  • Offer bereavement support and attendance at remembrance events if you were to die.

What information do we hold about you

We use a combination of electronic and paper records and working practices and technology to ensure that your information is kept confidential and secure. Records which the Hospice hold about you may include the following information;

  • Your age, contact details and next of kin
  • Your racial or ethnic origin, sexual orientation, and religious or philosophical beliefs
  • Details of your referrals, appointments, telephone calls, clinic visits etc.
  • Records about your symptoms and concerns, illnesses, medications, treatment and care
  • Results of investigations, such as laboratory tests, x-rays, etc.
  • Information from other health professionals, relatives or those who care for you.

CCTV system

The Hospice operates a non-audible Closed-Circuit Television (CCTV) surveillance system (“the system”) outside the Hospice premises with images being monitored and recorded. The system is owned, operated and managed by the Hospice. It is used for maintaining public and staff safety, the security of property and premises and for the detection, prevention and investigation of crime. Where appropriate, in exceptional cases, it may also be used to monitor staff when carrying out work duties. Disclosure of recorded material will only be made to third parties in accordance with the purposes of the system and in compliance with Data Protection legislation.

We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary.

CCTV images are only kept for 25 days unless we have a lawful purpose to retain them such as a request from the police or for our own internal investigations as a Hospice.

Images are stored in our secure IT systems and access to view recorded images is restricted to key individuals.

Where do we get information about you from

In additional to the information that you, your family and any carers give to us, we often obtain information from:

  • The health professional referring you to our service such as your GP
  • Records of investigations (e.g. imaging, biopsy and blood results), clinic letters and discharge summaries available electronically from local and mainland hospitals via their secure electronic information systems
  • Other professionals already involved in, or who can give help and advice about, your care.

Patient Data Sharing

The Hospice has agreed to work collaboratively to provide the best possible services for our patients. Please see our website for further information regarding our collaborative commissioning arrangements with other Healthcare providers. We also support the Surrey Heartlands Integrated Care System – the Surrey Downs Health and Care Partnership privacy notice is available here.

We have sharing agreements in place with some organisations where we believe this will facilitate improved care for our patients.  This allows authorised Hospice staff to directly access electronic records which our partners such as GPs hold about you and ensures that those involved in your care, treatment or research study can quickly, easily and securely access the information they need, when they need it.

The Hospice is routinely the Data Controller for your information that we hold and this means that we are the legal entity that is responsible for determining how this will be used and ensuring that this use complies with applicable data protection legislation.

Where we are working collaboratively with another Healthcare provider, we may be joint data controllers for your information.

Hospice volunteers do not have access to shared care records.

Who are our partner organisations

We may share your information, subject to strict agreements on how it will be used, with the following organisations:

  • Your GP practice
  • NHS Trusts / Foundation Trusts (e.g. hospitals, other ambulance trusts, out of hours services such as 111)
  • Clinical Commissioning Groups / Integrated Care Board
  • Social Care Services
  • NHS Commissioning Support Units
  • Independent contractors such as dentists, opticians and pharmacists
  • Private sector providers (e.g. oxygen suppliers, wheelchair providers)
  • Funeral directors (we regularly use Lodge Brothers)
  • Security services (such as our lone working application, SoloProtect)
  • Voluntary Sector Providers
  • Health and Social Care Information Centre (HSCIC)
  • Local Authorities
  • Local charities (e.g. SPEAR London) 
  • Education Services
  • Fire and Rescue Services
  • Police & Judicial Services.

In most circumstances you will be informed who your data will be shared with and in some cases asked for explicit consent for this to happen.

How we use the data we collect about you

We use your personal data for a number of purposes including the following:

  1. Information relating to diagnosis, treatment and care will be shared across our multi-disciplinary hospice teams to ensure all our healthcare professionals are updated for continuing care.
  2. Advising patient representatives (keeping in touch).
  3. If appropriate, information will be shared with external healthcare professionals such as GP’s, Hospitals and other involved health care professionals, such as our contracted Pharmacy.
  4. For medical research and educational purposes.

On exceptional occasions, disclosing your data may be required by law, for example to government bodies and law enforcement agencies.

Rest assured, we never share, sell, swap or rent your data to third parties for marketing purposes.

How we store your data

Like all healthcare providers, the Hospice uses an electronic clinical records programme to store your personal information. We also hold a small amount of information on paper (e.g. medication prescriptions, summaries of care and information required in the event of an electrical failure etc. when the electronic system cannot be accessed).

We have up-to-date security software and regularly review our procedures and technical measures to protect your data. Your data will be kept in a secure environment with access restricted on a need-to-know basis.

We don’t keep your data for longer than is necessary for the purpose for which it is obtained, in accordance with our internal policies. If you require any further information, please contact the Data Protection Officer at the address provided at the end of this privacy notice.

Transferring your data outside the UK

Personal data will not be transferred to a country or territory outside the UK unless there is a specific operational or medical reason to do so, in which circumstance we are obliged to ensure that the country concerned ensures an equal level of data security/protection and confidentiality procedures (i.e. compliant with the UK General Data Protection Regulation) for your rights and freedoms, in relation to the processing and storage of personal data.

How we look after your data

We never use clinical data for educational or research purposes without encrypting or anonymising so that no recognisable personal information is released.

This privacy notice is reinforced with our internal policies such as Confidentiality and Information Governance.

We are committed to protecting your privacy and will only use personal data that we collect lawfully, in line with all current applicable data protection laws and regulations.  Our compliance is mandatory and governed by the Information Commissioners Office (details on request).

To monitor the protection of Data we have an appointed Caldicott Guardian who is a senior person responsible for ensuring the confidentiality of patient and service-user information.

In addition, we have a Data Protection Officer who advises on all matters concerning data and its securities.

The Hospice participates and contributes to efforts by the NHS to use your information in an anonymous and safe way to:

  • protect the health of the public
  • help us anticipate, plan and provide care
  • audit, review, monitor and evaluate the quality of services provided.

Information used for these purposes will not identify you but if you would like further details about this, or if you do not want us to use your information in this way, please contact the Hospice Data Protection Officer at the address provided at the end of this privacy notice.

Retention of records

Records of clinical care now often inform future clinical decision making, for example, responses to medication such as allergies and diagnoses that might recur in the future. Therefore, your details will be held on our systems after you have been discharged from the Hospice so that your patient record can be shared across various services in the event that it needs to be accessed by other professionals to ensure decisions about any future treatment are informed.

Your Data Protection rights

You have certain rights in relation to your personal information, although those rights will not apply in all cases or to all the information that we hold about you. For example, we may need to continue to hold and process information to establish, exercise or defend our legal rights.

You have the right to be informed about how we use the data you provide. We will try to be as transparent as possible in our interactions with you. Any time you give us personal information you have a right to be informed about why we need it and how we will use it. You can find most of the information you need in this Privacy Notice.

You have right of access to any of your personal data that we hold about you. You can contact us at any time to gain information about what data we hold about you and why we hold it.

If you make a formal request, we will acknowledge your request and will first require you to prove your identity. We may also ask you for information about any specific information you are seeking to help us make sure we meet your request fully and speed up the process.

If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.

We will provide you with the information that you are entitled to as soon as possible and without unreasonable delay and at the latest within one month of your identity being verified by us.

In exceptional cases, we may extend the period of compliance by a further two months if the request(s) are complex or numerous. If this is the case, we will inform you within one month of the receipt of the request and explain why the extension is necessary.

In most circumstances there will be no charge for this right of this access.

You have the right to have any personal data we hold corrected at any time if you believe it to be inaccurate, e.g. the spelling of your name or your contact information.

You also have the right to ask for our processing of your personal data to be restricted. For example, if you are contesting the accuracy of data we are using about you. In such case we will restrict our processing while we verify the accuracy of the data that we hold.

You can also ask for certain information about you to be deleted. For example, if you are moving out of the area.

In certain cases, we will be unable to delete your information if there are statutory grounds to retain it (i.e. HMRC or other legal requirements).

You have the right to data portability where processing is automated, although we don’t currently carry out any such processing. If we do in future, you can make a request for this data to be exported from our systems for you.

You have the right to ask us not to process your personal data for marketing or profiling purposes.

You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your data. You can also exercise the right at any time by contacting either the Information Governance Lead (ig@pah.org.uk) or our Caldicott Guardian (caldicottguardian@pah.org.uk) or alternatively at the following address:

Caldicott Guardian

Princess Alice Hospice
West End Lane
Esher
Surrey
KT10 8NA

Complaints

The Hospice tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.

This privacy notice was drafted with brevity and clarity in mind. It does not provide exhaustive details of all aspects of the Hospice’s collection and use of personal information. However, we are happy to provide any additional information or explanation needed.

To do any of the above or to view our relevant internal policies, please contact the Princess Alice Hospice Data Protection Officer, using the following contact details:

Data Protection Officer

BLS Stay Compliant
Blake House
18 Blake Street
York
YO1 5QG

Email: info@bls-ltd.co.uk

To help us keep your personal information accurate and up to date, please tell us about any changes by writing to:

Clinical Secretaries Dept.
Princess Alice Hospice
West End Lane
Esher
Surrey
KT10 8NA
Tel. 01372 468811

Changes to this privacy notice

Rules, regulations, suppliers and partners around data can change – therefore our privacy notice will change too, so it’s worth visiting this page from time to time to check for updates.

Cookies

When you use our website, we use tools like Google Analytics and Crazy Egg to collect information such as the browser you use (eg Microsoft Edge, Firefox, etc), IP address, domain names, page visits, clicks and mouse movements, how long you spend on a page, the time of day you accessed the website and referring website addresses. This information helps improve our online services, ensures security and helps protect against fraud. It also assists with diagnosing online problems with our website.

Our Cookies Policy is here: https://www.pah.org.uk/cookies (you can delete and change your cookie preferences at any point).

Reviewed May 2024

Volunteering

May 2024

Volunteering Privacy Notice

This privacy notice is intended to let you know how and why we use the data you provide to us. You don’t need to do anything – but please read this notice carefully.  We may update this privacy notice from time to time, so please check it regularly.

  1. Who we are

Princess Alice Hospice (“the Hospice”) is a registered charity number 1010930 and a company limited by guarantee in England and Wales number 1599796. Registered office: West End Lane, Esher, Surrey KT10 8NA. The Hospice has two wholly-owned subsidiaries, PAH Trading Limited (Reg. No 1925762) and PAH Lottery Limited (Reg. No. 3347939), which are incorporated in the UK for the purposes of generating income for the Hospice’s charitable purposes.

We are committed to protecting your privacy and will only use personal data that we collect in line with all applicable laws, including the UK General Data Protection Regulation (UK GDPR).

  1. What data do we collect about you?

Personal data we collect may include one or more of the following, depending on your volunteer role:

  1. your name
  2. contact address
  3. telephone number(s)
  4. e-mail address
  5. records of your correspondence with us
  6. emergency contact information
  7. reference information
  8. date of birth
  9. health conditions
  10. GP’s contact details
  11. relevant information to process a DBS application
  12. DBS certificate number and date
  13. details of criminal convictions
  14. equal opportunities monitoring data
  15. vehicle registration and insurance details
  16. school information
  17. copies of relevant qualifications and professional registration numbers
  18. information you may enter onto the website
  19. any information you choose to share with us (such as relationships to other supporters).

When you use our website, we use tools like Google Analytics and Crazy Egg to collect information such as the browser you use (eg Microsoft Edge, Firefox, etc), IP address, domain names, page visits, clicks and mouse movements, how long you spend on a page, the time of day you accessed the website and referring website addresses. This information helps improve our online services, ensures security and helps protect against fraud. It also assists with diagnosing online problems with our website.

Our Cookies Policy is here: https://www.pah.org.uk/cookies (you can delete and change your cookie preferences at any point).

Security systems

The Hospice operates a non-audible Closed-Circuit Television (CCTV) surveillance system (“the system”) outside the Hospice premises with images being monitored and recorded. The system is owned, operated and managed by the Hospice. It is used for maintaining public and staff safety, the security of property and premises and for the detection, prevention and investigation of crime. Where appropriate, in exceptional cases, it may also be used to monitor staff when carrying out work duties. Disclosure of recorded material will only be made to third parties in accordance with the purposes of the system and in compliance with Data Protection legislation.

We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary.

CCTV images are only kept for 25 days unless we have a lawful purpose to retain them such as a request from the police or for our own internal investigations as a Hospice.

Images are stored in our secure IT systems and access to view recorded images is restricted to key individuals.

Also, for the security of our employees and service users, when lone working our employees may carry personal alarms which, when activated by the employee, will audio record conversations with customers and service users. The audio recording is risk assessed by the SoloProtect Security Centre, which also holds information about our employees such as their name, ethnicity and geolocation. In the event of an unsafe situation, this information will be escalated to managers at the Hospice and also to the Emergency Services when appropriate. Data is held securely and retained in line with data protection legislation. You can find out more here: Privacy Policy – SoloProtect UK

  1. How we use the data we collect about you?

We use your personal data for a number of purposes including the following:

  • to process volunteer enquiries and expressions of interest
  • to complete the volunteer recruitment process
  • to support your ongoing volunteering relationship with us
  • to share your information with your line manager so that they can effectively support you
  • to send you information linked to your volunteering at the Hospice, for example our volunteer newsletter and information about new volunteer roles and volunteering events.
  • for our own internal administrative purposes and to keep a record of your relationship with us
  • to manage your communication preferences i.e. how you have chosen to be contacted
  • to carry out research and surveys about our services
  • to analyse internal volunteering trends and processes
  • to comply with applicable laws and regulations.

When applying to volunteer, we will also ask you if you wish to receive information as a Princess Alice supporter and, if so, your preferred communication options.  You can read our Supporter Privacy Notice at www.pah.org.uk/privacy

By law we’re allowed to process your data for one or more of the following reasons:

  • you have given consent
  • it is necessary for us to be legally compliant
  • there is a legitimate interest to do so (for example, to communicate with you about your role as a volunteer)

Rest assured, we never share, swap, rent or sell your data to third parties for marketing purposes.

Sometimes we need to share information with authorised people or organisations, for example some of our volunteering programmes work in partnership with other organisations.  You would be informed of this relationship in advance and we only provide authorised parties with the data they need to deliver relevant services and ensure they have the same or equivalent securities and confidentiality processes.

We will always keep your data secure and confidential.  However, disclosure may be required by law, for example to government bodies and law enforcement agencies.

  1. How we protect and keep your data?

We don’t keep your data for longer than is necessary for the purposes for which it is used. This is in accordance with our Records Management Policy and adheres to the requirements of the UK GDPR.  If you don’t become a volunteer we will keep your data for 6 months – this is to allow for any change in circumstances whereby you wish to re-start the process.

If you tell us not to contact you, we will update our records accordingly.

We have security procedures, rules and technical measures to protect your data. Your data will be kept in a secure environment with access restricted on a need-to-know basis.

Personal data will not be transferred to a country or territory outside the European Economic Area unless there is a specific operational reason to do so, in which circumstance we are obliged to ensure that the Country or Territory concerned ensures an equal level of cyber security/protection and confidentiality procedures (UK General Data Protection Regulation) for your rights and freedoms, in relation to the processing and storage of personal data.

We may, for financial or technical reasons, use the services of an Internet Services Provider and/or e-mail marketing automation processor located outside the European Economic Area. However, we will make sure that your personal data will be held by those providers according to European data protection regulations. We will take all reasonable steps to ensure that your data is treated securely and in accordance with this privacy notice.

When using websites owned by other organisations to communicate with us, such as Twitter or Facebook, you should check their privacy policies/notices.

  1. How do you update your personal data?

We want to make sure that your personal data is accurate and up to date. Please let us know if your details change. We may use publicly available sources to keep your records up to date, such as checking your postcode is correct by using the Royal Mail postcode lookup facility.

To update your personal data please contact:

Volunteering
Princess Alice Hospice
West End Lane
Esher
Surrey
KT10 8NA

E-mail: volunteering@pah.org.uk

Tel: 01372 461856

  1. What rights do I have over my personal data?

Under the UK General Data Protection Regulation, you have the right to:

  • access your personal data
  • rectify, erase or restrict your data
  • object to the processing of your data
  • data portability – request transfer of data
  • lodge a complaint with the Hospice or the overarching regulator, the Information Commissioner’s Office (details on request)

For more information, please contact the Princess Alice Hospice Data Protection Officer using the following contact details:

Data Protection Officer
BLS Stay Compliant
Blake House
18 Blake Street
York
YO1 5QG

Email: info@bls-ltd.co.uk

  1. Changes to this privacy notice

Rules, regulations, partners and suppliers around data can change, therefore our privacy notice will change too, so it’s worth visiting this page from time to time to check for updates. At the start of this privacy notice we tell you when it was last updated.