Personal data we collect about patients of the Hospice may include:

• name, address, contact details – to enable us to visit you and maintain contact with you
• date of birth, NHS number – to ensure you are correctly identified, and your records are correctly assigned to you
• next of kin / main carer – to enable us to communicate with them in the case of an emergency
• contact details of other health or social care providers including your GP – to ensure that we can communicate quickly with them to ensure your care is safe, effective and responsive
• details of your health, clinical conditions and treatments, including your medications – to ensure that the care we deliver is safe and effective.

Special category data may be collected related to your health.

Depending on the method of referral or admission to our services, we may collect this data manually or on a computer tablet. Once the data is uploaded, it is immediately and automatically deleted from the tablet. This information is either uploaded via a dedicated telephone signal to our clinical system or entered into our system.

We maintain paper records relating to the care and treatment we provide.

We use this data to provide relevant information to internal staff and volunteers to enable us to provide a safe, effective and responsive service to you. Examples include:

• where we offer you transport to the Hospice, your name and address and any relevant risk assessment would be shared with drivers and escorts
• in order for you to access the full range of services we offer we may share your data with relevant health and social care professionals and therapists either employed directly by the Hospice or contracted in to work for us
• we may need to provide information to the pharmacy at County Hospital in order to obtain medications for you when you are discharged.

We share your personal data only for your benefit. We need to share information we hold about you with other organisations which are, or will be, involved in your care, for example, general practitioners (GPs), district nurses, ambulance services and social services. This is to ensure the care delivered to you is safe, effective, and responsive.

However, we will not disclose any information to other third parties without your consent  unless there are exceptional circumstances, such as when the health or safety of others is at risk or where the law requires it.

If we are asked to share information with another organisation that does not directly relate to your care, we will always seek your consent prior to any information being shared. If you choose not to consent to this when asked, then that decision will be recorded and respected, and data will only be shared if there is a legal requirement to do so.

The lawful basis for processing this data is carrying out a task in the public interest, specifically the provision of health or social care.

How long do we retain your personal data for?

Data about your care is retained for eight years after our last contact with you or longer if required by law to do so.

See also:

• When you share your story, photographs or media
• When you visit our premises
• Website visitors
• Accident and incident reporting.

Personal data that we collect about supporters (e.g. donors, customers of our shops) of the Hospice can include one or more of the following:

• name, address, telephone number(s) and email address
• records of your correspondence with us
• donation and Gift Aid details
• gifts in a will details
• bank details for a Direct Debit or standing order
• card payment details to process a donation or transaction
• information you enter on our website or a third-party website with which we have an agreement (e.g. your date of birth, or criminal conviction status when applying for a (un)paid role)
• any information you choose to share with us (e.g. your relationship to other supporters, such as when you sponsor someone fundraising on our behalf).

We use this information to:

• properly identify you
• process your donation, transaction, registration or service request in accordance with your wishes
• thank you
• claim Gift Aid on donations and provide evidence to HMRC
• deliver services, literature and/or other materials and information you have requested from us
• run our internal administration and keep a record of your relationship with us
• manage your communication preferences, i.e. how you have chosen to be contacted
• unless you tell us otherwise, to send you information we think may be of interest, such as updates on our work, news, fundraising appeals, lottery, shops, volunteering opportunities and events. We would only send you this information by email, text or other electronic communication, if you have given us your consent to use these methods
• carry out occasional research and surveys
• comply with applicable laws and regulations.

Do we share your personal data?

We only provide data to third party companies to enable us to:

• comply with legal obligations, e.g. run the Gift Aid scheme in compliance with HMRC requirements
• contact you by post and/or contact you by email (in line with any communication preferences you have expressed).

We provide only the necessary details when working with third party companies in this instance. For example, names and addresses only will be shared to facilitate a postal mailing.

We use MailChimp to deliver some of our email communications to those supporters who have given their consent to hear from us by email.  MailChimp and its servers are based in the US.

See: MailChimp Data Security and Privacy.

The lawful basis for processing this data is legal obligation for the claiming of Gift Aid, and the legitimate interest of the data controller.

How long do we retain your personal data for?

If you support us via monetary donation, donation of ‘goods in kind’, by fundraising for us or  attending one of our events, your data is retained indefinitely. You may request to have your information deleted. However, records must be kept for HMRC and for financial regulation of charities for a period of at least six years.

If you Gift Aid your donation(s) in our shops, your data is retained for six years after the last Gift Aid claim.

See also:

• When you share your story, photographs or media
• When you visit our premises
• Supporting us via a third party
• Website visitors
• Accident and incident reporting.

The Hospice receive personal data from a number of third parties through which we deliver services and opportunities to donate.

Boxmove

We offer a furniture collection service via BoxMove Limited, a company registered in Scotland with the company number SC541468. Their registered address is 196 Rose Street, Edinburgh, EH2 4AT.

If you support us via Boxmove, your name, address and order information and any other information you provide will be shared with us securely in real-time, stored on our database and treated in the same manner as other

Please view the Boxmove Privacy Policy for further details: https://boxmove.com/privacy.

Enthuse

We receive online donations and offer event registration and fundraising page creation via Enthuse, the trading name of Online Giving Ltd. Online Giving Ltd is a company limited by guarantee in England and Wales (reg. no. 06886190). Their registered address is Office 6, 155 Minories, London, England, EC3N 1AD.

If you support us via the Enthuse platform, you will be given the choice to share your data with the charity you support. Your name, address, marketing preferences and any other information you provide will be shared with us securely in real-time, stored on our database and treated in the same manner as all other supporters.

Please view the Enthuse Privacy Notice for more information: https://enthuse.com/privacy/.

JustGiving

We receive online donations via JustGiving. JustGiving operates its business in a number of countries and thought different entities. In the United Kingdom, JustGiving’s service is provided by Giving.com Limited, a company limited by guarantee in England and Wales (reg. no. 03871904). Their registered address is 5 Churchill Place, 10th Floor, London, United Kingdom, E14 5HU.

If you support us via the JustGiving platform, you will be given the choice to share your data with the charity you support. Your name, address, marketing preferences and any other information you provide will be shared with us securely on a monthly basis, stored on our database and treated in the same manner as all other supporters.

Please view the JustGiving Privacy Policy for more information: https://www.justgiving.com/info/privacy

Just Helping

We provide a Christmas tree collection and recycling service in partnership with Just Helping, a company registered in England and Wales with the company number 08194567. Their registered address is Unit 29b Atlantic Business Centre Atlantic Street, Broadheath, Altrincham, England, WA14 5NQ.

If you support us via Just Helping, your data will be shared with us automatically. Your name, contact details, marketing preferences and any other information you provide will be shared with us securely in real-time, stored in our database and treated in same manner as all other supporters.

Please view the Just Helping Privacy Notice for more information: https://just-helping.org.uk/privacy-policy/

Local Hospice Lottery

We run our lottery in partnership with Local Hospice Lottery Ltd. Local Hospice Lottery Ltd is a company limited by guarantee in England and Wales (reg. no. 03226004). Their registered address is Farleigh Hospice, North Court Road, Broomfield, Chelmsford, Essex, CM1 7FH.

If you support the Hospice by playing the Local Hospice Lottery, you will be given the choice to share your data with the Hospice you support. Your name, address and marketing preferences are shared with us securely on a monthly basis, stored on our database and treated in the same manner as all other supporters. If you end your contract with Local Hospice Lottery, your data will be shared again so that we can keep our database up to date.

Please view the Local Hospice Lottery privacy policy for more information: https://www.localhospicelottery.org/hospices/katharine-house-hospice/

Much Loved

We offer an online tribute service in partnership with Much Loved. Much Loved Charitable Trust is a registered charity (no. 1118590). Their registered address is Nash House, Repton Place, White Lion Road, Amersham, Buckinghamshire, HP7 9LP.

If you support the Hospice via Much Loved, ** further details pending on how we receive and use data from Much Loved **

Please view the Much Loved privacy policy for more information: https://www.muchloved.com/gateway/privacy-policy/

Octopus Legacy

We provide a free will writing service in partnership with Octopus Legacy Limited, a company incorporated and registered in England and Wales with the company number 11111047. Their registered address is Work.Life, 20 Red Lion Street, London, England, WC1R 4PS.

If you support us via Octopus Legacy, ** further details pending on how we receive and use data from Guardian Angel **

Please view the Octopus Legacy Privacy Notice for more information: https://octopuslegacy.com/privacy-notice

Visufund

We receive online donations via Visufund Ltd, a company limited by guarantee in England and Wales (reg. no. 10141346). Their registered office address is 20–22 Wenlock Road, London, England, N1 7GU.

If you support us via the Visufund, you will be given the choice to share your data with the charity you support. Your name, address, marketing preferences and any other information you provide will be shared with us securely in real-time, stored on our database and treated in the same manner as all other supporters.

Please view the Visufund Privacy Policy for more information: https://visufund.com/help/privacy-policy.

Personal data we collect about volunteers can include:

• name, address, email and telephone – to contact you
• interests and experience – to assign you a role that you would like
• volunteering work undertaken – to monitor volunteer work and hours undertaken
• criminal convictions or police investigations – to process applications to volunteer and safeguard our patients and the public.

Do we share your personal information?

The Hospice may share your name and email address with an email marketing platform to send you invites to events, news and updates about the Hospice. You can opt out of these communications at any time.

The Hospice use MailChimp to send these communications. MailChimp and its servers are based in the US.

The lawful basis for processing this data is legitimate interest.

How long do we retain your personal data for?

We retain your data for as long as our insurers stipulate after you cease volunteering for us.

See also:

• When you share your story, photographs or media
• When you visit our premises
• Website visitors
• Accident and incident reporting.

Personal information we collect about job applicants may include:

• name, address, email, telephone number(s) – to enable us to contact you
• education, training and employment details – to assess your suitability for the position
• equal opportunities monitoring form – to assess our compliance with legislation
• professional registration details where required for the position – e.g. NMC registration
• criminal records form for positions – where DBS clearance is required
• eligibility to work in the UK – legal requirement.

Application forms are anonymised during the shortlisting process. Personal details, equal opportunities forms and DBS details are separated and are not sent to the shortlisting panel.

Do we share your personal data?

Personal details are not shared with third parties.

The lawful basis for processing this data is to meet our legal obligation for the monitoring of equal opportunities, for the legitimate interest of the data controller, and to meet our contractual obligations.

How long do we retain your personal data for?

For unsuccessful applicants, data is retained for six months after the recruitment has been completed.
Some applicants may be contacted to give their consent if the Hospice wish to retain their details on file for future employment opportunities.

See also:

• When you share your story, photographs or media
• When you visit our premises
• Staff
• Website visitors
• Accident and incident reporting.

Personal data we collect about staff may include:

• personal details to ensure accurate records are kept of all employees relating to all aspects of employment
• contractual details to ensure we can maintain the employer/employee relationship
• information on health, including sickness details, to ensure we can manage employees effectively, including entitlement to sick pay
• induction/training information to ensure we retain legally required information to support the running of the organisation
• appraisal/reviews to record employees’ progress with the organisation and the formal discussions held with managers
• disciplinary/grievance/formal processes to maintain records of what issues arose, how they were handled, what decisions were reached.
• maternity to ensure we comply with relevant legislation, for example, in regard to maternity leave, maternity pay, risk assessments and reintroduction to work
• risk assessments where risk assessments are carried out relating personally to an employee
• letters sent to you to maintain a record of information supplied to employees
• copies of DBS certificates (for required roles only) where roles require a DBS check, we retain a record of the check, and the check itself until the Care Quality Commission inspects us
• all relevant information necessary to run a payroll that complies with the law – to ensure we pay employees accurately and make all necessary deductions required by law or as agreed with employees.

Personal emails may be used for business purposes.

Do we share your personal data?

Where there is a statutory requirement to do so, the Hospice will provide information to the CQC regulator, HMRC and other regulatory bodies.  Data may also be shared with third parties where appropriate; this includes occupational health service, pension providers, the Disclosure & Barring Service, UK Healthcare and when responding to requests regarding references/mortgages/tenancies, etc.

We also provide personal data to our payroll provider for the sole purpose of paying our employees and complying with HMRC requirements.

We may share your name and date of birth to allow you access to NHS email and NHS training.

Personal data may also be shared with our insurers and legal advisors, e.g. when seeking advice and guidance about a specific employment situation or responding to legal action by employees.

The lawful basis for processing this data is to meet contractual obligations, to comply with our legal obligations, and to meet our legitimate interests.

How long do we retain your personal data?

Employee information is kept in line with the requirements of our insurers and stored as above.

Copies of DBS certificates are kept until a CQC inspection has taken place.

See also:

• When you share your story, photographs or media
• When you visit our premises
• Website visitors
• Accident and incident reporting.

When you use our website, we use Google Analytics and Microsoft Clarity to collect anonymised information such as how you came to our site (e.g. directly or via a link or search engine), your device and browser, what time you visited and your interactions on our pages. This information helps us to improve our online services and diagnose any issues with our website.

We do not use your personal information, nor do we share this data.

The lawful basis for processing this data is legitimate interest of the controller.

See also:

• How we use cookies.

When you share your story, photography or media (e.g. video and audio) with the Hospice to help us raise awareness of our services, you will be asked for consent to use your content in our publicity. Photographs and video may also be captured at our events. Content will be shared as part of our publicity work.

You can withdraw your consent by emailing marketing@khhospice.org.uk

The lawful basis for processing this data is legitimate interest of the controller.

The Hospice CCTV cameras may capture images and video of any visitors, members of the public, staff and volunteers visiting our premises. We use CCTV at various sites, specifically the main Hospice and Norton Bridge.

We collect images and videos of people on the site for the security and safety of our patients, staff, visitors, the public and equipment.

We only review images or footage when incidents or accidents are reported, including theft and malicious damage to property or storage containers. Authorised personnel only can access the images or footage and only do so for the purposes of investigation.

We do not share data – unless reporting a criminal act to the police.

The lawful basis for processing this data is legitimate interest of the controller.

We retain these images for 28 days, unless they are required for legal reasons, in which case they may be kept up to three years as part of an investigation or prosecution.

Personal data we collect in the event of an accident or incident may include:

• name, address and telephone number(s) to enable us to contact you
• injury to the part of the body or person to assess suitable treatment
• description of what has happened as part of our compliance with MHSWR (management of health and safety at work regulations).

We do not use your personal data unless required to do so by law or to carry out a serious accident investigation.  We use aggregated data to monitor accident and incident trends.

Do we share this data?

Personal data is not shared unless we are required to do so by law – specifically if we have to make a report to the Health and Safety Executive if the accident meets the relevant criteria.  Patient data may be shared with the Care Quality Commission.

Personal details may be shared with the Hospice insurance company, which may require copies of the relevant documents; this will only happen when a serious accident or incident has occurred, including vehicle accidents.

The lawful basis for processing this data is to meet our legal obligation.

How long do we store the data for?

Paper copies are kept for as long as is stipulated by our insurers. Electronic information is stored indefinitely and is anonymised.