• Through meeting you face to face when you use our services
• When you provide us information over the telephone
• Through family members or friends that have contacted us
• From records you have supplied to us from healthcare professionals

•  If you are a patient, we will collect your information to validate and update your medical records or check on your eligibility for using our service.
• If you are a patient’s family member we will only collect your information if you choose to use any of our services.
• If you are a patient’s family member we may be provided with your information by one of our patients that have named you as their next of kin. This may include your name, address, date of birth and telephone number.
• If you donate money or give us gifts, please read the Supporter Privacy Notice for information on how we process your donation. This privacy notice can be found on our website or you can ask our staff for a copy.

• If you are a patient, we will only share your medical information with the NHS. We will provide an internal notification of death to our fundraising team to ensure we do not contact the deceased.
• If you are a patient’s family member we will share your contact details with the NHS on your relative’s patient record and we will also record your information on our internal supporter database.
• We also share data with Local Authorities e.g. Schools, Social Care organisations

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing your information is:

• We are using consent as the bases for processing your data

• To provide the NHS, GPs and other health professionals with our patient’s health information
• To invite patient family members to events and other services and provide bereavement support
• To send communications you have requested
• To give to Law enforcement authorities if we are required to release your personal information by law due to a court order or for the prevention of fraud or other crime

Your information is securely stored within our Clinical Database held by the software supplier The Phoenix Partnership (TPP), our Network Drive and a small amount of data in paper format which is held securely in locked cupboards.

Our Record Management Procedure describes the retention period for care records. This is In line with the NHS Record Keeping guidelines. The following lists the length of time records are kept:

• Adult Records – 8 years
• Children records – until the child’s 25th birthday or 26th if young person was 17 at conclusion of treatment, or 8 years after death.
• Chaplaincy records – 2 years
• Child Protection Register records – 26th birthday or 8 years after the patient’s death if patient died while in the care of the organisation
• Clinical audit – 5 years
• Counselling records – 8 years after the patient’s death if patient died while in the care of the organisation

We will then dispose your information held in paper format by means of secure shredding. All data held on our Clinical Database is maintained and destroyed by the software supplier in line with the contracts agreed with NHS Digital. Data held on our Network Drives are deleted in line with our record keeping policy timeframes

Under data protection law, you have rights including:

Your right of access - You have the right to ask us for copies of your personal information. For Subject Access requests relating to your personal information

caldicottguardian@havenshospices.org.uk

Your right to rectification - You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. If you just want to change the personal information you have provided to us at any time then please visit our website www.havenshospices.org.uk, or call us on 01702 220310, or email us on changeme@havenshospices.org.uk

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing - You have the right to ask us to restrict the processing of your information in certain circumstances.

Your right to object to processing - You have the the right to object to the processing of your personal data in certain circumstances.

Your right to data portability - You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. Please contact us at dataprotection@havenshospices.org.uk if you wish to make a request.