Our privacy and cookie notices

Our Privacy Notice

Last updated: Monday 3 October 2022

Who we are

Rennie Grove Hospice Care

Registered Office: Grove House, Waverley Road, St Albans, Herts, AL3 5QX

Charity No: 1140386

Rennie Grove Hospice Care is a Company limited by guaranteed and registered (England and Wales) 7479930

ICO Registration Number Z2764852

Rennie Grove Hospice Care is regulated by the Care Quality Commission and the Fundraising Regulator.

Rennie Grove Hospice Care is a charity providing care and support for adults and children diagnosed with a life-limiting illness and support for their families. We rely on the generous support of our local community to fund over 85% of our annual running costs to ensure that we can continue to provide our vital care for all who need it in our catchment area in Herts and Bucks.

In the course of delivering our services and raising the funds needed to sustain them, we develop relationships with a large number of people and organisations in the local community which involves collecting and using personal information. Personal information, or personal data, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). This Privacy Notice details how and why we collect and use this information and how we keep it safe. We also explain your rights and choices and how to get in touch with us.

Rennie Grove Hospice Care is the Data Controller for this personal information.

We may update this Notice, so please check this page from time to time. We will place a notice on our website to let you know about major changes.

Merger with Peace Hospice Care

Rennie Grove Hospice Care has recently announced that it is merging with Peace Hospice Care. The organisations began to merge on the 1st of October 2022 under the new name of Rennie Grove Peace Hospice Care. Rennie Grove Hospice Care will still exist as an organisation and data controller until the completion of the merger. In the interim period, staff from Peace Hospice Care will have access to our systems and personal data on a ‘need to know’ basis to aid the merger process. Such access is subject to ongoing impact assessment and review by the Data Protection Officers from both organisation and communications will be sent to all data subjects in due course.

We will be updating this privacy policy regularly as part of the merger process. Where applicable (for example for digital fundraising activity), we will be re-seeking your consent to continue processing this data in the new organisation.

If you have any queries regarding how your data is being used during this process, or to exercise any of your rights, please contact our Data Protection Officer via dpo@renniegrove.org or call 01442 890222.

Our commitment to you

We are committed to protecting your privacy and will only use the personal data that we collect in line with all applicable data protection laws, including the General Data Protection Regulation (GDPR).

We are also committed to respecting your wishes and would like to communicate with you in the way that you would prefer to enable us to build a good relationship. You can change your contact preferences at any time here or by calling us on 01442 890222 or emailing preferences@renniegrove.org. You can contact our data protection officer at: dpo@renniegrove.org.

Please note: we will action your request as soon as we can but it is possible that you may receive further contact such as mailings which are already in progress for up to 28 days.

Click on the following to read more about the data we process and store:

If you, your child or a friend or family member are receiving care or support from one of our services, the information we hold about you will be used only for the purpose of providing care and support and information about our services.

The information we collect about you

This could include:

basic details which identify you and/or your child, or next of kin and family members such as your address, contact numbers, date of birth and email address (with consent)
details of visits we have made to you at home details of other visits/services received
notes and reports about your/your child’s health and treatment which may include information from other healthcare providers
information provided by your family or those who care for you and know you well
information about your story and your experience of our care

How we collect this information

directly from you, verbally, on paper or digitally or through the use of our website
from your GP, hospital doctor or other healthcare professional either by telephone, paper notes or through the referral systems or shared access to medical records
from discussions with your carers, friends or members of your family when you complete our patient/carer survey (either online via an online survey or on paper)
from Care Opinion (the UK’s independent non-profit feedback platform for health and social care)

Why we need this information

Having up-to-date information about your health and your treatment is essential to meet the needs of our patients and their carers, friends and family members and provide high quality, safe and appropriate care.

Our legal bases for processing this information

We are allowed to process your information for one or more of these reasons:

to provide direct care and administration relating to care
we have your consent to use your information for the provision of healthcare and support or to use your story to evidence our care
we have a legitimate interest in providing family and friends with information about the support and services we offer
it is necessary for compliance with a legal or contractual obligation to which we are subject (for example a change in the law)
where we have your consent, we will provide limited information to medical insurers to obtain a contribution towards the costs of your care
we are required to disclose your information by law, for example to law enforcement agencies or government bodies
it is in the public interest, for example a Notification of Infectious Diseases (NOID) which must be reported to the relevant authority

How we use this information

to inform, plan and carry out your treatment and provide advice
to make sure that your wishes are taken into account where we provide treatment or advice
to ensure that all treatment is safe and effective and that advice is appropriate for you
to provide all healthcare providers involved in your care, which may include GPs, hospital-based clinicians, nurses in the community and health visitors, with up-to-date and accurate information about your health and care so that, working together, we can make the best decisions about diagnosis, treatment and care.
to ensure that all professionals involved in your care have up-to-date and accurate information so that we can work effectively together to care for you
to help us improve our services or investigate concerns or complaints
sometimes we will ask you permission to share your story and experience of our care for the purposes of publicising the work we do and for fundraising
We will contact your next of kin or other people important to you express a preference to be contacted by other services and/or receive a newsletter by post, they will be added to our database

Sometimes we use anonymised data (where identifying personal information has been removed) for clinical audit or research purposes and to evidence the care we provide.

How we keep your information safe

In accordance with NHS guidance, Rennie Grove has appointed its Director of Nursing and Patient Services as a Caldicott Guardian. Our Caldicott Guardian is responsible for protecting patient confidentiality and enabling the appropriate sharing of information. The sharing of sensitive personal information is strictly controlled by law. At our first meeting with you we will outline how we share information and ask for your consent. If you are unable to consent for any reason we will only share information where it is in your best interests to do so.

Measures that we use to protect your information include:

we store your information on a patient record system called Infoflex.
we are able to view the patient record systems of other providers and we are aiming to enable other healthcare professionals to view Infoflex to support the co-ordination of your care across organisations. Most patients find that this is helpful in managing their care.
we use security technology to safeguard personal data and have procedures in place to ensure that both paper records and computer systems and databases are protected against unauthorised access, disclosure, loss or damage.
staff and volunteers are appropriately trained in data protection and security and only have access to your information if needed for a proper purpose..
third parties retained by Rennie Grove to provide technical support will only have access to personal data if necessary to perform their role and will be bound by contractual confidentiality agreements.
all staff have a duty to record your personal information and information about your care accurately and to keep it secure and confidential.
on the rare occasions that confidential data is stored on a mobile device, eg memory stick, it is always securely encrypted.
if you choose to participate in video based counselling or therapies, some data may be collected by the video hosting organisation. We recommend you check their privacy policy for more information and if you have concerns, please contact the Rennie Grove Data Protection Officer by emailing dpo@renniegrove.org.

How long we keep your information

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

Your rights

You have the legal right to confidentiality and the following additional rights under current data protection law:

The right to be informed – in this Privacy Notice we are letting you know about how we handle your personal information.

The right of access – you can request a copy of the information we hold about you and we will respond within 30 days.

The right to rectification – if you consider any information we hold about you is inaccurate, you can ask us to correct it, though we may need to verify the accuracy of the new data you provide.

The right to erasure – if we have no lawful basis for keeping your personal data, you can ask us to delete it. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

The right to restrict processing:

you can withdraw your consent to the processing of your information at any time
you can also withdraw your consent to the sharing of your Health Records with other healthcare professionals
you can also tell us that you do not wish any details about your health to be discussed with your family members/carers.

We will comply with your wishes and where we have no legal basis for retaining your data we will stop processing your data according to your request. However, if you do this, please be advised that we may not be able to provide you with safe and informed care. Please note that this will only affect new activity and does not mean that processing carried out before you withdrew your consent is unlawful.

The right to data portability – in some circumstances, you may be entitled to have the personal data you have provided to us sent to you in an electronic form that enables you to make further use of it.

The right to object and complain – you can object to us processing your information if the processing is carried out in our legitimate interests. You also have the right to complain to the Information Commissioner’s Office. We hope that if you have a complaint you will come to us first and we will always do everything we can to help you. You can find our complaints procedure here. However, if you would like to complain to the ICO, you can find information on how to do this at www.ico.org.uk.

Rights in relation to automated decision making and profiling – which we do not carry out.

Checking your identity

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). If you ask a representative to make a request under this Privacy Notice, we will ask them to prove they have your permission to act.

Fees

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

National Data Opt-Out

How the NHS and care services use your information

Rennie Grove Hospice Care is one of many organisations working in the health and care system to improve care for patients and the public.

Whenever you use a health or care service, such as attending Accident & Emergency or using Community Care services, important information about you is collected in a patient record for that service. Collecting this information helps to ensure you get the best possible care and treatment.

The information collected about you when you use health or care services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

improving the quality and standards of care provided
research into the development of new treatments
preventing illness and diseases
monitoring safety
planning services

This may only take place when there is a clear legal basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law.

Most of the time, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information isn’t needed.

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out your confidential patient information will still be used to support your individual care.

To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters. On this web page you will:

See what is meant by confidential patient information
Find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
Find out more about the benefits of sharing data
Understand more about who uses the data
Find out how your data is protected
Be able to access the system to view, set or change your opt-out setting
Find the contact telephone number if you want to know any more or to set/change your opt-out by phone
See the situations where the opt-out will not apply

You can also find out more about how patient information is used at: https://www.hra.nhs.uk/information-about-patients/ (which covers health and care research); and https://understandingpatientdata.org.uk/what-you-need-know (which covers how and why patient information is used, the safeguards and how decisions are made).

You can change your mind about your choice at any time.

Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.

Health and care organisations must have systems and processes in place so they can be compliant with the national data opt-out and apply your choice to any confidential patient information they use or share for purposes beyond your individual care. Our organisation is currently compliant with the national data opt-out policy.

The information we collect about you

As we get to know you, we collect a variety of different information to help us build a strong relationship. How much information we collect depends on the type of relationship we have.

If you shop with us, donate to us, support our fundraising activities or attend one of our education events we may collect the following information:

your personal details, including name, address, telephone number, mobile number, email address, date of birth
details of your donations
your Gift Aid Status
bank and credit card details
records of your correspondence and discussions with us
your motivations for supporting us
publicly available information about your charitable activities
your interests and connections
if you are taking part in one of our active or sponsored events we may need to ask you to provide special category data, for example information relating to your health, height and weight
other event-related information (for example dietary requirements and t-shirt size)
your contact details if you are given as an emergency contact for a participant in one of our events (we do not retain these details after the event)
if you have attended one of our events or activities it may be photographed or video recorded for promotional purposes
other information you choose to share with us – eg relationships with other donors and where you work
your publicly available career overview and whether you are a director of a company
company details of corporate supporters including address, phone numbers, email addresses, publicly available employee information, date of incorporation, business and charitable activities
your fundraising story
how you heard about us/our fundraising activities
how you use our website
your social media links/handles

In certain limited cases we may collect ‘sensitive’ or ‘special category’ data about you. For example if you enter an event, we may ask you if you have any relevant medical conditions. We will only collect this data about you if there is a clear and valid reason for doing so and we will securely dispose of that data once the purpose for which it was collected has expired.

Information about other people

If you provide personal information relating to other people, you must ensure that it is done with their knowledge and consent and that they understand how their personal information will be used.

Information about under 18s

Some of our fundraising activities, such as the Rudolph Run, are targeted at families. Registering children under 18 for these activities can only be undertaken by someone over 18 and with parental consent. Children’s details may be added to our database if they undertake fundraising activities but we will not contact them with any marketing information.

How we collect your information

directly from you when you contact us, make a donation, take part in one of our fundraising or education activities or when you make an online shop purchase or sign up as a Gift Aid donor in one of our shops
indirectly from someone known to you when you give them permission to enter you into one of our events
from a third party when you use other fundraising websites such as Justgiving, Virgin Money Giving, Much Loved, the Big Give and others to raise money for Rennie Grove Hospice Care provided you have given them consent to pass information to us. You should check the privacy policy of these organisations if you wish to understand exactly how they process your data.
from an online or paper survey
from a funeral director if you have made a donation in memory of someone you know
from publicly available information such as Companies House, newspaper articles
from social media – depending on your privacy settings. You should read the Privacy Notices of the individual social media platforms too
from cookies on our website

The legal bases we use for processing your information

If you:

make a purchase from our online shop
make a donation
complete an enquiry form
register for an event

we will collect and process your information in order to fulfil our contractual obligations for the purpose of:

sending you your products
completing and acknowledging your donation
sending you the information requested in an enquiry form
administering your entry into/attendance at an event.

As you have shown an interest in supporting Rennie Grove, we would like to build a relationship with you so that you can continue to support our work with local patients and families in the future or continue to attend our education events. We will therefore add your name and contact details to our fundraising database and will use the legitimate interest basis for sending you news and information about fundraising activities or future education events by post, unless you ask us not to.

We only use personal information in a way or for a purpose that you would reasonably expect in accordance with this Policy, that does not intrude on your privacy, or is inconsistent with your previously expressed marketing preferences.

We will ask for your consent before we send you our monthly enews or fundraising information by email.

You can change your contact preferences at any time here or by calling us on 01442 890222 or emailing preferences@renniegrove.org. Please note: we will action your request as soon as we can but it is possible that you may receive further contact such as mailings which are already in progress for up to 28 days.

How we use this information:

We use the information we collect to build a picture of our supporters and to ensure that our communications with you are relevant and timely and provide a good experience of supporting Rennie Grove Hospice Care. We will segment the data we hold to give you a personalised experience of supporting Rennie Grove based on how you engage with us. Specifically, we may use information to:

provide you with services, products or information that you have requested
administer your donation, event entry/attendance or support your fundraising
thank you for your support
process a Gift Aid claim
keep a record of your relationship with us
record your contact preferences
send you our newsletters and other information about our charitable or fundraising activities or education events by post if we feel this could be of interest to you. We will email this information where we have consent.
tell your story for publicity purposes with consent or anonymised
gain publicity for current or future events by using photographs and videos taken at our fundraising events. Our event web pages and terms and conditions make it clear that photographs and videos from our events will be used in media coverage and publicity materials. For all other photography we ask for publicity consent forms to be completed.
understand how we can improve our services, products or information
ensure your safe participation in an event by sharing health and other relevant information you provide when you enter with third party providers who carry out health and safety roles as part of the event
group people together to make sure the correspondence they receive is relevant
build a picture of your company and employees to ensure we tailor our contact with you and provide you with the relevant stewardship
Information on under 18s is only used for the purposes for which it has been provided and is securely destroyed afterwards
For fraud prevention, credit risk reduction or otherwise as required by law or regulation

We may use geographic, demographic and other information which is publicly available to help us understand you better and make appropriate requests for support so that we can raise more to fund our vital services in the most cost-effective way.

How we keep your information safe

we store your personal information on databases and in electronic and paper files.
we use security technology to safeguard personal information and have procedures in place to ensure that both paper records and computer systems and databases are protected against unauthorised access, disclosure, loss or damage.
staff and volunteers are appropriately trained in data protection and security and only have access to your information if needed for a proper purpose.
we process all online and telephone donations and payments in accordance with the Payment Card Industry Data Security Standard using Sagepay, a secure payment provider. Find out more about Sagepay’s security here. Rennie Grove Hospice Care does not receive or store any credit or debit card details for online transactions. If you provide your card details over the phone or on a pledge form these will be kept securely until the payment has been processed and then immediately destroyed.
health information you provide when you enter an active event is not retained by any permitted third party contractors after the day of the event, unless required by law. Unless there is a legal requirement to keep the information, Rennie Grove will ensure paper copies are securely destroyed immediately after the event and all electronic information is deleted within a month.
in order to provide our products and services we sometimes use approved third party organisations to carry out processing activities on our behalf. These include technology hosts, online payment bureaux, event companies, consulting services, printing companies and mailing houses.We always ensure that your personal data is properly protected and used in accordance with this Privacy Notice and is securely destroyed when no longer necessary.

where possible we ensure that third party organisations who handle our data, for example our website and our supporter database, are located within the UK and are therefore subject to the same levels of strict data protection legislation. Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
- we will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data.
- where we use certain service providers, we may use specific contracts approved for use in the UK which give personal data the same protection it has in the UK.

If we ever have a need to use an organisation that is based outside of the European Union, we will always take proper steps to ensure that your personal information is protected in accordance with this Privacy Notice.

Updating your information

We want to make sure that your personal information is accurate and up-to-date. Please let us know if your details change. You can update your details here or email us at preferences@renniegrove.org or call us on 01442 890222.

We also use publicly available information to keep our information as accurate and up to date as possible. We screen our supporter data against nationally approved registers Mortascreen, a bereavement register and NCOA (National Change of Address), to ensure our information is accurate before we send fundraising appeals and newsletters. This also helps to reduce wasted mail and postage.

If you use the Fundraising Preference Service to withdraw consent to receiving direct marketing, we will update our records accordingly.

How long we keep your information

sensitive information for example about health conditions or t-shirt size, height or weight is destroyed on conclusion of the event for which it was supplied, unless there is a legal requirement to retain it
supporter records are kept for a minimum of seven years after the date of the last donation/engagement
details about legacy pledges are kept indefinitely
information about financial transactions is kept for seven years.
anonymised statistical information about website visitors is kept in accordance with Google’s Analytics data privacy and security policy for analytical purposes.

Your Rights

Under current data protection law, you have the following rights:

The right to be informed – in this Privacy Notice we are letting you know about how we handle your personal information.

The right of access – you can request a copy of the information we hold about you and we will respond within 30 days (This is also known as a Subject Access Request).

The right to rectification – if you consider any information we hold about you is inaccurate, you can ask us to correct it, though we may need to verify the accuracy of the new data you provide.

The right to erasure – if we have no lawful basis for keeping your personal data, you can ask us to delete it. Please note that if you ask us to erase your details, we cannot guarantee no future contact unless you give us permission to retain minimal data to inform do not contact lists. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

The right to restrict processing – you can withdraw your consent to direct marketing at any time and we will update your preferences. You can also withdraw your consent to other processing at any time and providing we have no legal basis for retaining your data we will stop processing your data. Please note that this will only affect new activity and does not mean that processing carried out before you withdrew your consent is unlawful.

The right to data portability – in some circumstances you may be entitled to have the personal data you have provided to us sent to you in an electronic form that enables you to make further use of it.

The right to object – you can object to us processing your information if the processing is carried out in our legitimate interests.

Rights in relation to automated decision making and profiling – which we do not carry out

You also have the right to complain to the Information Commissioner’s Office. We hope that if you have a complaint you will come to us first and we will always do everything we can to help you. You can find our complaints procedure here. However, if you would like to complain to the ICO, you can find information on how to do this at www.ico.org.uk.

Fees

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

Checking your identity

To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request that requires us to disclose information to you. If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to act.

Getting in touch:

If you have any queries or would like to contact us about anything contained in this Privacy Notice, please contact our Data Protection Officer:

dpo@renniegrove.org

The information we collect about you

When you apply for and accept a volunteering role with us, we collect information relevant to your volunteering activities which may include:

your personal details, including name, address, telephone number, mobile number, email address, date of birth
how you heard about us
how you contacted us about volunteering
reference information and contact details of people providing references
biographical information relevant to your application
contact details of someone to contact in the event of an emergency
your bank account details if you claim for expenses
information about your health that is relevant to your volunteering
training courses you have attended
details of relevant qualifications
copies of documents relating to your role – eg driving licence, car insurance, therapist insurance
confirmation of any unspent convictions and, if the role you are applying for requires it, we will ask you for additional information to enable us to carry out a DBS (criminal record check)
how you wish to be contacted
if you are under 18, we keep a record of parental consent on your database record and we will only contact you with information relevant to your volunteering role.

Please be aware that if you are a volunteer and a supporter, we may hold additional information about you as detailed in the supporter section.

How we collect your information

directly from you when you contact us, fill in an application form or face-to-face in meetings/interviews
indirectly from a third party when they supply a reference for you or recommend you for a role. We may also request information from third parties, for example, where the role requires a criminal record check from the Disclosure and Barring Service.

Why we need this information

To ensure that you can fulfil your volunteering duties safely and with the appropriate training and support.

The legal bases we use for processing your information

We process your information as a volunteer using the legitimate interest basis in order to provide you with volunteering opportunities in a safe and appropriate way.

How we use this information

to provide your line manager with information about you relevant to your role
to contact you according to your preferences
to apply for a DBS check if required for your role
to send you volunteering related information such as newsletters by email and post
to pay expense claims should you make them
to understand the profiles of our groups of volunteers and to assist with planning volunteer strategy
to pass to our fundraising team if you indicate that you are happy for us to do so

How we keep your information safe

we store your personal information on databases and in electronic and paper files.
we use security technology to safeguard personal information and have procedures in place to ensure that paper records and computer systems and databases are protected against unauthorised access, disclosure, loss or damage.
staff and volunteers are appropriately trained in data protection and security and only have access to your information if needed for a proper purpose.

How long we keep your information

When you finish volunteering for us, we will keep your information for three years after which time it is securely destroyed. If you give us information but do not start a volunteering role, we keep your information for one year.