Privacy policy

North London Hospice has completed a Data Security and Protection Toolkit self-assessment in June 2023 which demonstrates we are practising good data security and that personal information is handled correctly. 

During the course of its activities, North London Hospice (‘we’ or ‘us’) collects, stores and processes personal information. We are committed to protecting and respecting your privacy. This policy, together with any other documents referred to on it, sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our practices regarding your personal data and how we will treat it.

The North London Hospice address is as follows:

47 Woodside Avenue, London, N12 8TF

The North London Hospice website is, www.northlondonhospice.org, and it is owned and operate by North London Hospice.

We process personal information about our patients and their family members, carers, or friends; about those who volunteer with us in the hospice or in our charity shops; about our donors and supporters; and about prospective, current and former staff. We also collect, store and process some personal information about people in organisations with which we work closely, such as other healthcare professionals and the Health Information Exchange (HIE) System https://www.northlondonpartners.org.uk/ourplan/Areas-of-work/Digital/Info-residents/privacy-notice.htm

The Health Information Exchange (HEI) System is a record of care which is held on each partner’s secure clinical system (local record). Cerner, a supplier of healthcare systems has designed HIE. This system integrates data from those multiple electronic health and care systems to provide a real-time and read-only summary of that data to a health or social care professional when required for the purpose of your direct care.

North London Hospice can see relevant parts of your clinical record; this excludes certain sensitive data items as detailed below and is role-based – for example a doctor sees different information to a health care assistant or a social worker. Each role sees only information relevant to their direct care to you.

We recognise the need to treat personal and sensitive data in a fair and lawful manner. No personal information held by us will be processed unless the requirements for fair and lawful processing can be met.

Access to personal and sensitive data is controlled, and only available on a ‘need to know’ basis. All staff receive training on the principles of confidentiality, data minimisation, purpose limitation, data protection and information security.

PERSONAL DATA

 Under the General Data Protection Regulation (Regulation (EU) 2016/679) (‘GDPR’) and Data Protection Act 2018 (‘the Act’), personal data is defined as ‘any information relating to an identified or identifiable natural person (‘data subject’), by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person’.

THE DATA CONTROLLER

A data controller is the individual or legal person who controls and is responsible to keep and use personal data in paper or electronic files. The North London Hospice is the data controller as defined by both the GDPR and the Act.

LAWFUL PROCESSING

The lawful bases for processing are set out in Article 6 of the GDPR. At least one of these must apply whenever personal data is to be processed:      

• Consent: you have given the North London Hospice freely, specific, informed or unambiguous consent for your personal data to be processed for a specific purpose.
• Contract performance: the processing is necessary for the performance of a contract you have with the North London Hospice, which had asked you to take specific steps before entering into a contract.
• Compliance with legal obligation: the processing is necessary for the North London Hospice to comply with the law, such as tax, social security obligation or employment law).
• Protection of vital interests: the processing is vital to an individual’s survival.
• Public interest: the processing is necessary for the North London Hospice to perform a task that is in the public interest or for its official functions, and the task or function has a clear basis in law.
• Legitimate interests: the processing is necessary for the North London Hospice’s legitimate interests, or the legitimate interests of a third-party, unless there is a good reason to protect the individual’s personal data that overrides those legitimate interests.

DATA SUBJECT RIGHTS

Your data subject rights are listed below:

• the right of access.
• the right to rectification.
• the right to erasure or right to be forgotten.
• the right to restriction of processing.
• the right to be informed.
• the right to data portability.
• the right to object.
• the right not to be subject to a decision based solely on automated processing.

Under the GDPR and the Act, you may ask for a copy of the information we hold about you and you may request rectifications be made to this information if it is inaccurate or not up to date.

DATA RETENTION

Our records management policy sets out the criteria we use for data retention. We will retain personal data for the minimum period required by legislation or national guidance provided by statutory authorities. When no longer required for day to day processing, personal information will be archived, either electronically or if in hard copy, stored in a secure archive held offsite and then destroyed when the retention period has ceased.

Should you have any queries about the retention periods for personal data or on any aspect of the use of your information, please contact one of our data protection leads listed below under each category of data we hold and process.

Should you wish to lodge a complaint about the use of your information, please contact North London Hospice in the first instance on 0800 368 7848 email: complaints@northlondonhospice.co.uk or write to North London Hospice, 47 Woodside Avenue, London, N12 8TF

If you are still unhappy with the outcome of your enquiry you can write to the Information Commissioner’s Office at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF or call 0303 123 1113.

HOW WE USE YOUR PERSONAL DATA

This privacy notice sets out in more detail how we process personal information in the following categories:

• Care records
• Employment, volunteering and training records
• Donor and supporter records
• Care Records

We aim to provide you with the highest quality care. To do this, we must keep records about you and the care we provide for you.

The North London Hospice collects, stores and processes personal information about prospective, current and former patients who have been referred to the hospice for any care service provided by the hospice. We also collect, store and process personal information about prospective, current and former family members, carers or friends of patients, where these details have been provided to us for the purposes of providing care.

What types of personal data do we handle?

The personal data we process in relation to our care is provided to us both by the individual and by a third-party healthcare professional who has referred the individual to us for care.

• Personal demographics (including gender, race, ethnicity, sexual orientation, religion);
• Contact details such as names, addresses, telephone numbers and emergency contact(s); and
• Medical information including physical health or mental condition, medications, previous treatments, records of care and other personal information given by the individual or other health and social care organisations.

Health records are held on paper and electronically and we have a legal duty to keep these confidential, accurate and secure at all times in line with the GDPR and the Act.

What is the purpose of processing this data?

The legal basis for the processing of data for these purposes is that North London Hospice has a duty to care for its patients and is contracted to provide healthcare by the National Health Service (‘NHS’). Processing this data is necessary for the provision of health and social care and the treatment of patients, and for the management of health or social care systems and services.

Information collected about you to deliver your health care is also used to assist with:

• Making sure your care is coordinated and of a high standard.
• Assessing your condition against a set of risk criteria to ensure you are receiving the best possible care.
• Using statistical information to plan services to meet the needs of the population.
• Preparing statistics on our performance for NHS commissioners, the Care Quality Commission and other regulatory bodies.
• Helping train staff and support research.
• Supporting the funding of your care.
• Reporting and investigation of complaints, claims and untoward incidents.
• Reporting events to the appropriate authorities when we are required to do so by law.

If we need to use your personal information for any reason beyond those stated above, we will discuss this with you. You have the right to ask us not to use your information in this way. However, there are exceptions to this.

• If the public interest is thought to be of greater importance: for example, if a serious crime has been committed; if there are risks to the public or our staff; to protect vulnerable children or adults.
• Where we have a legal duty, for example reporting some infectious diseases, wounding by firearms and complying with court orders.
• If we need to use the information for medical research. We have to ask permission from the Confidentiality Advisory Group (appointed by the NHS Health Research Authority) to do this.

Our staff are trained to handle your information correctly and protect your confidentiality and privacy; we do not undertake automated decision-making such as profiling.

We aim to maintain high standards, adopt best practice for our record keeping and regularly check and report on how we are doing. Your information is never collected for direct marketing purposes, and is not sold on to any other third parties. Your information is not processed overseas.

Sharing your information

In the main, we will only share your personal data without consent where we have a legal duty to ensure your personal health and well-being. The need to share information between members of different care teams and between different organisations involved in your healthcare provision will be explained, if considered appropriate. This is particularly important where disclosure extend to both NHS and non-NHS bodies, such as District Nurses or Social Services

In all other cases we will not routinely disclose any information about you without your express permission. However, there are circumstances where we must or can share information about you owing to a legal/statutory obligation.

If you want further information about the handling of care records and patient information, please contact the Caldicott Guardian and Medical Director at North London Hospice by phone on 020 8343 8841.

2. Employment, Volunteering and Training Records

The North London Hospice collects, stores and processes personal information about prospective, current and former staff, including applicants, employees (and former employees), workers (including agency, casual and contracted staff), volunteers, trainees and those carrying out work experience.

What types of personal data do we handle? 

The personal data we process in relation to employment, volunteering and training is provided to us by individuals at the point of application for a role at the North London Hospice, or by the agency where we engage agency staff.

In order to carry out our activities and obligations as an employer we handle data in relation to:

• Personal demographics (including gender, age, race, ethnicity, sexual orientation, religion);
• Contact details such as names, addresses, telephone numbers and emergency contact(s);
• Employment records (including professional membership, references and proof of eligibility to work in the UK and security checks);
• Bank details;
• Pension details;
• Medical information including physical health or mental condition (occupational health information);
• Information relating to health and safety;
• Trade union membership;
• Offences (including alleged offences), criminal proceedings, outcomes and sentences; and
• Employment Tribunal applications, complaints, accidents, and incident details.

Our staff are trained to handle your information correctly and protect your confidentiality and privacy; we do not undertake automated decision-making such as profiling.

We aim to maintain high standards, adopt best practice for our record keeping and regularly check and report on how we are doing. Your information is never collected or sold for direct marketing purposes and it is not processed overseas.

2.2 What is the purpose of processing this data? 

We have a legal basis to process this as part of your contract of employment or agreement (either permanent or temporary) or as part of our recruitment processes following data protection and employment legislation.

We process your data for the following reasons:

• Staff administration and management (including payroll and performance);
• Pensions administration;
• Business management and planning;
• Accounting and Auditing;
• Accounts and records;
• Crime prevention and prosecution of offenders;
• Provision of education and training; and
• Health administration and services.

The provision of personal data is therefore part of a contractual requirement, including the fulfilment of an agreement to volunteer or be a trainee at North London Hospice. Failing to provide the personal data required would consequently mean we would be unable to complete our recruitment processes and we could not engage you in a contract of employment.

2.3 Sharing your information

Any disclosures of personal data are always made on case-by-case basis, using the minimum personal data necessary for the specific purpose and circumstances and with the appropriate security controls in place. Information is only shared with those agencies and bodies who have a “need to know” or where you have consented to the disclosure of your personal data to such persons.

There are a number of reasons why we share information. This can be due to:

• Our obligations to comply with legislation; and
• Our duty to comply any Court Orders that may be imposed.

We may use the information we hold about you to detect and prevent crime or fraud. We may also share this information with other bodies that inspect and manage public funds.

We will not routinely disclose any information about you without your express permission. However, there are circumstances where we must or can share information about you owing to a legal/statutory obligation.

To enable effective staff administration, we share your information with some specific external organisations in order to comply with our obligations as an employer.

Further details can be provided by our Human Resources Department, who can be contacted on 0800 368 7848.

3. Donor Records

North London Hospice collects, stores and processes personal information about prospective, current and former donors and supporters of the charity.

3.1 What personal data do we hold?

The personal data we hold in relation to donors is provided by individuals at the point at which they choose to support North London Hospice or through fundraising donations or via the donation of Gift Aid on the sale of donated goods in one of our charity shops.

In order to carry out our activities in relation to donors and supporters, we handle data in relation to:

• Contact details such as names, addresses, telephone numbers and emails;
• Bank account and credit card details; and
• Estate information.

Our staff are trained to handle your information correctly and protect your confidentiality and privacy; we do not undertake automated decision-making such as profiling.

We aim to maintain high standards, adopt best practice for our record keeping and regularly check and report on how we are doing. Your information is only collected for our own marketing purposes and is never collected for or sold to other organisations

We always try to work with organisations that operate within the European Economic Area (EEA). Where we work with a supplier operating outside the EEA, we will ensure they provide an appropriate level of protection. This is called an “adequacy decision”, and is guaranteed by schemes such as the EU-US Privacy Shield framework. By submitting your personal information to us you agree to this transfer, storing or processing at a location outside the EEA. If you want more information about the non-EEA suppliers we use, please contact our Fundraising Department at fundraising@northlondonhospice.co.uk or via our switchboard 0800 368 7848.

3.2 What is the purpose of processing this data?

We process the information you provide to us on the basis of your explicit consent. You may withdraw your consent for us to process this data at any time.

We process your data for the following reasons:

• Fundraising activities, soliciting donations and support in kind;
• Marketing and communication about the activities of North London Hospice, including events; and
• Securing your consent to the donation of Gift Aid to North London Hospice on the sale of donated goods.

3.3 WEALTH SCREENING 

As a fundraising organisation, we undertake in-house research and from time to time engage specialist agencies to gather information about you from publicly available sources, for example, Companies House, the Electoral Register, company websites, ‘rich lists’, social networks such as LinkedIn, political and property registers and news archives.

We may also carry out wealth screening to fast track the research using our trusted third-party partners. You will always have the right to opt out of this processing. The North London Hospice uses appropriate technical and organisational methods to ensure that such profile information is secure against unauthorised access or disclosure. In addition, the North London Hospice limit staff access to such information on a need to know basis and take reasonable measures to ensure that staff are aware that such profile information is only used for authorised purposes in accordance with our Privacy Policy.

We may also carry out research using publicly available information to identify individuals who may have an affinity to our cause but with whom we are not already in touch. We also use publicly available sources to carry out due diligence on donors in line with the charity’s Gift Acceptance Policy and to meet money laundering regulations. This research helps us to understand more about you as an individual so we can focus conversations we have with you about fundraising and volunteering in the most effective way, and ensure that we provide you with an experience as a donor or potential donor that is appropriate for you. If you would prefer us not to use your data in this way, please email us at fundraising@northlondonhospice.co.uk or call 0208 446 2288

3.3 Sharing your information

Any disclosures of personal data are always made on case-by-case basis, using the minimum personal data necessary for the specific purpose and circumstances and with the appropriate security controls in place. In order to process your information and donations to the highest possible standards, we will sometimes need to give other organisations access to your data. Examples include database storage, printers and email software providers.

There are a number of reasons why we share information. This can be due to:

• Our obligations to comply with legislation; and
• Our duty to comply with any Court Orders that may be imposed.

We may use the information we hold about you to detect and prevent crime or fraud. We may also share this information with other bodies that inspect and manage public funds.

We will not routinely disclose any information about you without your express permission. However, there are circumstances where are required to share information about you to comply with legal/statutory obligation (such as HMRC for Gift Aid records).

CHANGES TO NORTH LONDON HOSPICE PRIVACY POLICY

This privacy policy was last updated on 15^th July 2020. North London Hospice reserves the right to vary this privacy policy from time to time. Such variations become effective on posting on this website. Your subsequent use of this website or submission of personal information to North London Hospice will be deemed to signify your acceptance to the variations.

For more details, please contact our Fundraising Department at fundraising@northlondonhospice.co.uk or for details of information sharing in respect of Gift Aid of sales proceeds of goods given to our shops, please contact our Finance Department at accounts@northlondonhospice.co.uk. Both departments can be contacted via our main switchboard 0800 368 7848.

COMPLAINTS

For further information on your rights and how to complain to the ICO, please refer to the ICO website https://ico.org.uk/concerns

Contact details

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 1113 (local rate)