Who we are Expand In this policy, whenever you see the words ‘we’, ‘us’, ‘our’ or ‘hospice’, it refers to The Ayrshire Hospice. (Our ICO registration number is Z5490883). The Ayrshire Hospice are a registered charity (SC011390) providing outstanding quality care and services which help those with any life-limiting illness. Care is provided where there is no cure for the condition, but which improves the quality of each day for people who have a limited time to live. Our charity helps adults throughout Ayrshire and Arran with life-limiting illness such as cancer, neurological conditions, end stage heart failure and lung disease. We help people to live as actively as they can to the end of their lives - however long that may be, wherever that may be. The care we provide not only seeks to alleviate pain and symptoms, but also allows people to stay engaged with friends, family and their community. We not only look after people’s physical needs but also attend to their emotional, spiritual and social needs too. The patient and their family are at the centre of all the care we provide. Family members, close friends and carers are also supported both during a person’s illness and following bereavement. Hospice services are free of charge and are available to patients over 16 years of age throughout Ayrshire and Arran. The funding of these services does, however, require extensive, on-going fundraising and NHS support to exist. Examples of areas of fundraising. At the Ayrshire Hospice we are committed to protecting your personal information and being transparent about what we do with it. We are committed to using your personal information in accordance with all applicable laws concerning the protection of personal information and not doing anything with your information that you would not reasonably expect.
What personal information do we collect or hold? Expand Personal information is any information that can be used to identify you. This information includes your name, date of birth, postal address, email address, telephone number, fax number and contact preferences. The information we hold about you will also differ depending on the department that needs to use it. The information the fundraising department collects includes your credit/debit card details, gift aid status, record of donations and your current interests and activities. Your bank or credit card details, if you provide them, will be processed in line with banking and credit card industry standards. Where appropriate the fundraising department will ask about your motivation for supporting the hospice although this question will never be compulsory. If you are an employee, we also collect information such as your national insurance number, qualifications, bank details, emergency contact information or trade union membership. If you are a patient, we collect information relating to your health or personal circumstances which includes a detailed record of your care, GP details or involvement with other health or social care providers as well as some information about your relatives or close family friends. Data protection law recognises that certain categories of information are more sensitive and are classed as special categories of data. In order to fulfil certain legal obligations and our role as a healthcare provider the hospice will collect information on employees or patients that falls into a number of these categories including racial or ethnic origin, religious or philosophical beliefs, trade union membership, heath data and sex life or sexual orientation.
How do we obtain your personal information? Expand The hospice collects your information in a number or ways: You give it to us directly When you make a donation, sign up for an event, sign up to receive our newsletter or play our lottery, register on our website, register as a supporter, share your experience of hospice care, apply for a vacancy or voluntary position at the hospice, order products or services, self-refer to one of the hospice’s services or otherwise give us your personal information. This information could be provided by you in writing or by email, by completing a form, over the phone or via our website. Sometimes when you support us, your information is collected or processed by an individual or organisation working for us (e.g. a professional fundraising agency or a data processing company). As the organisation will have been instructed by the Ayrshire Hospice, we will be responsible for your information at all times. It is given to us by a third party on your behalf If you are referred to the hospice by a third party such as a GP or team at a hospital, that third party will provide the hospice with information on your behalf to support the referral. If you self-refer to the hospice we will contact third party health and social care providers such as a GP or a team at a hospital to obtain information that we require to be able to provide care to you. Your information may be provided to us by a family member or friend who is receiving care from the hospice. Your information may also be provided to us by a family member, friend or another fundraiser as part of their own fundraising activities. Your information is also shared with us by independent fundraising event organisers, for example the Kiltwalk or websites like Just Giving. These independent third parties will only do so when you have indicated that you wish to support the Ayrshire Hospice and have given them your consent. You should check their Privacy Policy when you provide them with your information to fully understand how they will process your information. When your information is available publicly or from external sources If your information is held by our fundraising team we combine information that we already have about you with information available publicly or information available from external sources in order to obtain a better understanding of you and to improve our fundraising methods, products and services. Such information includes for example socio-demographic and lifestyle information and information about previous donations you have made. The information we get from other external sources depends on your privacy preferences you have provided to that external source. For example, you may have provided permission for a company or other organisation to share your data with third parties including charities. Depending on your settings or the privacy policy for social media and messaging services like Facebook, WhatsApp, LinkedIn, YouTube or Twitter, you might give us permission to access information from those accounts or services. We also obtain information about you where it is publicly available and found in places such as Companies House, Land Registry website and information that is published in articles and newspapers. To understand how we use information about the communications devices you use, such as IP address (the location of the computer on the internet) and cookies, please see the How do we use cookies section of this policy.
How do we use your personal information? Expand We will only use your personal data as permitted by the EU General Data Protection Regulation, the UK Data Protection Act and the Privacy and Electronic Communication Regulations. We will provide an outline of the purpose of collecting any personal data in a transparent manner at the time of collection or registration where appropriate, in accordance with any preferences you express. If asked by the police, or any other regulatory or government authority investigating suspected illegal activities, we will need to provide your personal data. How we use your personal data varies greatly depending on the nature of how you interact with the hospice. Fundraising The ways that we use your personal data will largely be defined by why you are providing it. These include: We use your personal information to give you the information, support, services or products you ask for. We also use your personal information to thank you for your previous support or invite you to an event, for example if you have made a donation or have previously taken part in one of our events. We will ensure that we know how you prefer us to contact you, where you have provided this information. The legal basis we rely on to use your data in this way is article 6 (1) (f) of the GDPR which relates to information being processed for the purposes of the legitimate interests of the Ayrshire Hospice. We use your personal information to gain a full understanding of your situation including relationships to other supporters where for example, you have provided family and spouse/partner details so we can develop and offer you the most efficient and the best possible personalised services. The legal basis we rely on to use your data in this way is article 6 (1) (f) of the GDPR which relates to information being processed for the purposes of the legitimate interests of the Ayrshire Hospice. We use your personal information to keep a record of your relationship with us and the contact we have with you and for internal administrative purposes (such as our accounting and records), and to let you know about changes to our services or policies. The legal basis we rely on to use your data in this way is article 6 (1) (f) of the GDPR which relates to information being processed for the purposes of the legitimate interests of the Ayrshire Hospice. We use your personal information to look into, and respond to, complaints, legal claims or other issues. The legal basis we rely on to use your data in this way is article 6 (1) (c) of the GDPR which relates to information being processed where it is necessary to comply with a legal obligation. We use your personal information to claim Gift Aid on your donations. The legal basis we rely on to use your data in this way is article 6 (1) (c) of the GDPR which relates to information being processed where it is necessary to comply with a legal obligation. We use personal information to carry out statistical analysis and research in order to help us understand how we are performing and how we can improve our activities and services to meet the needs of people that require our help. The legal basis we rely on to use your data in this way is article 6 (1) (f) of the GDPR which relates to information being processed for the purposes of the legitimate interests of the Ayrshire Hospice. We use your information to send you communications about our work and how you can help us, for example, information about our campaigns, volunteering and fundraising activities and how you can donate to us. Occasionally, we may include information from partner organisations or organisations that support us in these communications. We offer clear communication marketing preference questions and guidance on how you can change your communication preferences or tell us that you no longer wish to hear from us. For electronic communications including email, phone and SMS the legal basis we rely on to use your data in this way is article 6 (1) (a) of the GDPR which states that processing can only occur where the you have given your consent for it. For communications sent by post the legal basis we rely on to use your data in this way is article 6 (1) (f) of the GDPR which relates to information being processed for the purposes of the legitimate interests of the Ayrshire Hospice. Fundraising – Profiling We use profiling techniques to ensure communications are relevant and timely and to provide an improved experience to our supporters. In some instances, we use trusted third party service providers to provide us with additional information about you which can be collected from external sources, including information that is publicly available about you. This analysis also allows us to target our resources effectively, better understand how likely it is that you may donate to us and tailor what type and level of support we may ask you for. This sort of profiling can include us using information such as your age, where you live, your job, directorships, your financial circumstances, philanthropic interests, networks and any previous donations you have made. We also use this information to help us determine whether and in what ways you might be interested in getting involved in our other fundraising activities. The legal basis we rely on to use your data in this way is article 6 (1) (f) of the GDPR which relates to information being processed for the purposes of the legitimate interests of the Ayrshire Hospice. You can let us know if you would prefer us not to profile you in this way by phoning the Ayrshire Hospice Fundraising Office on 01292 288488, emailing us at [email protected] or by writing to us at 29 Miller Road, Ayr, KA7 2AX. Clinical Any information collected from a clinical perspective is used in full identifiable format to ensure we provide the best quality care to our patients and families: We use your personal information to assess your medical, personal or social situation and as such tailor the care we provide. We use your personal information to contact you and other healthcare or social providers for administration purposes such as sending out appointment, discharge or condolence letters. We use your personal information to compile a detailed clinical record in order to meet our professional obligations as a health care provider. We may also use your personal contact information to send details of other clinical hospice services that we feel may be of benefit to you. We may also use your personal information if you are the family member or friend of a patient who has died in hospice to send out offers of bereavement support. The legal basis we rely on to use your information for these purposes is article 9 (2) (h) of the GDPR which is where processing is necessary for the purposes of the provision of health or social care or treatment. Information may also be retained clinically in an anonymised, pseudonymised or aggregated format. This type of information may be used for statistical, research or benchmarking purposes. The legal basis we rely on to use your information in this way article 9 (2) (j) of the GDPR which allows for processing which is necessary for research or statistical purposes. Organisational When individuals apply to work or volunteer at the Ayrshire Hospice, we will only use the information they supply to us to process their application and then, if the candidate is successful in joining the organisation, for the purposes of their employment or volunteering. The legal basis we rely on to use your information for these purposes is article 6 (1) (b) of the GDPR which is where processing is necessary in order to take steps prior to entering into a contact or agreement. Personal information about unsuccessful candidates will be held for 3 months after the recruitment exercise has been completed, it will then be destroyed or deleted. We retain de-personalised statistical information about both successful and unsuccessful applicants to help inform our recruitment activities and to monitor equality & diversity, but no individuals are identifiable from that data. The legal basis we rely on to use your data in this way is article 6 (1) (f) of the GDPR which relates to information being processed for the purposes of the legitimate interests of the Ayrshire Hospice. Once a person has taken up employment or starts volunteering with us, we will compile a file relating to their employment/volunteering. The information contained in this will be kept secure and will only be used for purposes directly relevant to that person’s employment/volunteering. The legal basis we rely on to use your information for these purposes is article 6 (1) (b) of the GDPR which is where processing is necessary for the performance of a contract or agreement. Once a person’s employment/volunteering with the Ayrshire Hospice has ended, we will retain the file in accordance with the requirements of our retention schedule, which is governed by our legal obligations, and then delete it. The legal basis we rely on to use your data in this way is article 6 (1) (c) of the GDPR which relates to information being processed where it is necessary to comply with a legal obligation.
Who do we share your information with? Expand We will not sell your details to any third parties but we will sometimes share your information with our trusted service providers who are authorised to act on our behalf, organisations who work on our behalf, or whom we work with in partnership to deliver and improve services for people affected by life limiting illness. We will share your information with other organisations who fundraise on our behalf. The legal basis we rely on to use your data in this way is article 6 (1) (f) of the GDPR which relates to information being processed for the purposes of the legitimate interests of the Ayrshire Hospice. We will only share clinical information with other health and social care providers in order to ensure that we provide the best care possible to all patients and their families. The legal basis we rely on to use your information for these purposes is article 9 (2) (h) of the GDPR which is where processing is necessary for the purposes of the provision of health or social care or treatment. We also comply with Article 9 (3) of the GDPR and ensure that we only share for these reasons with parties whose professional regulation obligates them to secrecy. The hospice is obligated to share health and social information with other parties such as the National Health Service including National Services for Scotland and their Information Services Division to comply with national reporting and statistical requirements. The hospice will also be required to share information with Healthcare Improvement Scotland in order to ensure that the care we provide meets the standards expected of a Scottish healthcare provider. The legal basis we rely on to use your information in this way is article 9 (2) (i) which relates to the processing of data where it is necessary in the area of public health to ensure high standards of quality and safety of health care. When individuals apply to work at the Ayrshire Hospice we may disclose information to a third party, for example where we want to take up a reference. The legal basis we rely on to use your information for these purposes is article 6 (1) (b) of the GDPR which is where processing is necessary in order to take steps prior to entering into a contact. When individuals apply to work at the Ayrshire Hospice we will disclose information to a third party to obtain a ‘disclosure’ from Disclosure Scotland. We will not do so without informing them beforehand unless the disclosure is required by law. The legal basis we rely on to use your data in this way is article 6 (1) (c) of the GDPR which relates to information being processed where it is necessary to comply with a legal obligation. From time to time we may exchange your personal information with other organisations for the purposes of fraud and credit risk reduction. We may also share information with our financial and legal advisers for the purposes of obtaining advice and protecting our legal rights. If a complaint is made against the hospice we will require to share personal information with the relevant governing bodies. We may also share your information with the emergency services if we think there is a risk of serious harm or abuse to you or someone else. The legal basis we rely on to use your data in this way is article 6 (1) (c) of the GDPR which relates to information being processed where it is necessary to comply with a legal obligation. We will share information internally between our clinical and non-clinical departments to ensure that all information held within the organisation is accurate as required of us by the General Data Protection Regulation. The legal basis we rely on to use your data in this way is article 6 (1) (c) of the GDPR which relates to information being processed where it is necessary to comply with a legal obligation. Website data Your data may also be available to our website provider to enable us and them to deliver their service to us, carry out analysis and research on demographics, interests and behavior of our users and supporters to help us gain a better understanding of them to enable us to improve our services. This may include connecting data we receive from you on the website to data available from other sources. Your personally identifiable data will only be used where it is necessary for the analysis required, and where your interests for privacy are not deemed to outweigh their legitimate interests in developing new services for us. In the case of this activity the following will apply: Your data will be made available to our website provider, however no clinical data will be shared with the provider. The data that may be available to them include any of the data we collect as described in this privacy policy. Our website provider will not transfer your data to any other third party, or transfer your data outside of the EEA. They will store your data for a maximum of 7 years. This processing does not affect your rights as detailed in this privacy policy.
How do we secure your information? Expand All of our staff, volunteers and Executive Team receive appropriate and on-going training to ensure they are aware of their personal responsibilities and have contractual obligations to uphold confidentiality, enforceable through disciplinary procedures. All staff are trained to ensure they understand how to recognise and report a data protection breach ensuring that the organisation’s procedure for investigating, managing and learning lessons from incidents is well established. All identifiable information that we hold about you will be held securely and confidentially. We use strict administrative and technical controls to ensure that only authorised staff are able to see information that identifies you where it is appropriate to their role and is strictly on a need-to-know basis. The hospice also ensures that all electronically stored information, including information collected via our website, is either located on internal servers that are kept up-to-date, protected by passwords and behind a strict network firewall or stored on external servers by organisations that have the certifications to ensure your information is stored securely. Where we store information on a portable device, the information on those devices will be encrypted to protect against unauthorised access. All hospice PCs and laptops are protected by up-to-date anti-virus software. The hospice also ensures that any organisation that we share information with or any support provider that may have the ability to access that information train their staff on data protection and have their own policies, procedures and certifications in place to meet any data protection regulations. When an individual applies to join the Ayrshire Hospice, personal information about unsuccessful candidates will be held for 3 months after the recruitment exercise has been completed, it will then be destroyed or deleted. We retain de-personalised statistical information about applicants to help inform our recruitment activities, but no individuals are identifiable from that data. In terms of clinical information, everyone working for the Ayrshire Hospice has a legal duty to keep information about you confidential. The NHS Care Record Guarantee and NHS Constitution provide a commitment that all NHS organisations and those providing care on behalf of the NHS will use records about you in ways that respect your rights and promote your health and wellbeing. Where clinical information requires to be sent electronically to another health or social care provider it will only be sent using the NHS Mail secure email system. We will only retain information in accordance with the schedules set out in the Records Management Code of Practice for Health and Social Care 2016. The hospice’s Records Management Policy includes guidance around the secure destruction of information in line with the Code of Practice. The Hospice has a Caldicott Guardian who is a senior person responsible for protecting the confidentiality of service users and service users’ information and enabling appropriate and lawful information-sharing
People aged 16 or under Expand If you’re aged 16 or under, you must get your parent/guardian’s permission before you provide us with any personal information for example on our websites or registration forms. This does not apply to clinical referrals where if you are aged 16 or under you may consent to a referral and as such, us storing information for the purposes of processing that referral and providing treatment, if a medical practitioner is of the opinion you understand the nature and consequences of the treatment we will provide. Where a medical practitioner is not of that opinion a guardian’s consent for the referral would be required.
How do we use cookies? Expand What is a cookie? A cookie is a small piece of data that is downloaded to your computer or mobile device when you access certain websites. Most websites you visit will use cookies in order to improve your user experience by enabling that website to ‘remember’ you. Cookies may be set by the website that you are visiting or by other websites that run content on the page that you are viewing. Cookies can be used by websites to remember information about you so that you don’t have to repeatedly provide that information to them, keep you signed into the website, personalise the adverts and services they offer to you and track your activity on the website as well as collecting location information about you and technical information about the device you are accessing the website from. How does the hospice use them? The cookies that the hospice uses are predominantly ‘analytical’ cookies. They allow us to recognise and count the number of visitors to our website and track how you accessed our site and how you move around our site when you’re using it. We can also record information about what country you are accessing our website from as well as technical information like your IP address, device type and operating system. To do this the hospice website uses Google Analytics. Unless you have adjusted your browser settings to block cookies, they will automatically be created as soon as you access the website. Google Analytics is collected via a JavaScript tag in the pages of our site. Google Analytics uses Persistent Cookies (remain on your computer unless they expire or your cookie cache is cleared) and some session cookies (used to calculate visit information such as visit length and where a visitor arrived from). More information on Google Analytics and Google’s privacy policy for the system can be found at https://support.google.com/analytics/topic/2919631?hl=en&ref_topic=1008008 Why does the hospice use cookies? The hospice uses cookies as by monitoring the use of our website we can ensure all of our visitors are able to find the information they require when visiting it. It also allows us to discover what information may be relevant to our visitors and display that more prominently. The legal basis we rely on to use your data in this way is article 6 (1) (f) of the GDPR which relates to information being processed for the purposes of the legitimate interests of the Ayrshire Hospice and our website visitors. How do I stop cookies from being stored? You can prevent your browsing from being tracked generally by adjusting your browser settings, browsing in ‘private mode’ or using browser add-ons. You can find out how to do this by visiting the relevant support page for your browser or by using the help function on your browser.
Complaints Expand The Ayrshire Hospice aims to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring concerns to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures. You can also raise a concern directly with the ICO https://ico.org.uk although our aim is to resolve your complaint swiftly ourselves in the first instance. For more information on how to make a suggestion or complaint, please write to The Complaints Officer, The Ayrshire Hospice, Lochranza Building, Ailsa Hospital Campus, Dalmellington Road, Ayr, KA6 6AB.
Accessing and updating your information Expand We regularly review records of our supporters to ensure your data is as accurate as possible and we always appreciate it if you let us know if your contact details change. Where possible we use publicly available sources to keep our records up to date for example, the Post Office’s National Change of Address database, or information provided to us by a trusted third party service provider. It is important that we keep your personal data as up to date as possible for example, to prevent us writing to people who have moved house and have not provided their new address. We may, from time to time, get in touch with you to confirm that your details are still accurate and that you still wish to hear from us. The Ayrshire Hospice tries to be as open as it can be in terms of giving people access to their personal information. Individuals can find out if we hold any personal information by making a ‘subject access request’. If we do hold information about you, we will: Give you a description of it Tell you why we are holding it Tell you who it could be disclosed to Let you have a copy of the information in intelligible form Fundraising You can request access to any fundraising information we hold about you by phoning the Ayrshire Hospice Fundraising Office on 01292 288488, emailing us at [email protected] or by writing to us at The Ayrshire Hospice, 29 Miller Road, Ayr, KA7 2AX. You can also let us know if you would no longer like to receive fundraising communications from us or if you would prefer us not to profile you for the purposes of targeting or tailoring our fundraising efforts, by phoning the Ayrshire Hospice Fundraising Office on 01292 288488, emailing us at [email protected] or by writing to us at 29 Miller Road, Ayr, KA7 2AX. Clinical All applications to see health records or access clinical information must be made in writing to Cat Killin, Lead Consultant, The Ayrshire Hospice, Lochranza Building, Ailsa Hospital Campus, Dalmellington Road, Ayr KA6 6AB If you, your family or friends would like to no longer receive any clinical communication from the hospice then please contact Patient and Family Services Director, The Ayrshire Hospice, Lochranza Building, Ailsa Hospital Campus, Dalmellington Road, Ayr KA6 6AB Other Requests Any other requests for access to information should made in writing to the Human Resources department, The Ayrshire Hospice, Lochranza Building, Ailsa Hospital Campus, Dalmellington Road, Ayr KA6 6AB If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone. If we do hold information about you and you notice any mistakes, then please get in touch with the relevant department to allow us to update the information.
Changes to this policy Expand We will review and may change our privacy policy from time to time so please check back periodically. If you have further questions regarding the Privacy Policy please contact Tracy Flynn, Interim Chief Executive Officer, The Ayrshire Hospice, 35-37 Racecourse Road, Ayr, KA7 2TG. This Privacy Policy was last updated March 2022. March 2022 Update: Updated main contact for the Ayrshire Hospice August 2019 Update: Updated "How does the hospice use them?" under "How do we use cookies?". Added "Why does the hospice use cookies?" under "How do we use cookies?". Added "Website data" to "Who we share your information with". May 2018 Update: Privacy policy completely redeveloped in line with new GDPR regulations.