Care Services
If you use our care services, we will collect your personal data and sensitive or ‘special category’ information that relates to your physical and/or mental health and any other relevant information such as religious beliefs or sexual orientation. This data goes onto form your healthcare record, together with additional information such as the personal details of your family and/or carers, etc.

From time to time, care staff may be asked to take clinical photographs of you for medical or training purposes. Such photographs would form part of your medical record and would not be made publicly available without your explicit consent.

Information will be used to carry out care assessments, book appointments or visits, send you correspondence, complete surveys, record incidents and deliver care. We may receive commendations or complaints and concerns, and process the information contained therein to respond to you and develop our service.

To inform the development of care services for children, young people and families, we may use your data to identify patterns and trends. We will also use it for resource planning. We will keep records to:

• Enable home visits.
• To let you know about services and events.
• To monitor trends and progress in care.
• Undertake research, with your permission, to better understand people’s expectations about how their data will be used.
• To provide you with information, products or services you request.

So that we can provide high quality care and support we need specific data. This is collected from or shared with:

1. You or your legal representative(s);
2. Third parties. We may do this face to face, via phone, via email, via our website, via post, via application forms. Third parties are organisations with whom we have a legal reason to share your data with. These may include:
   • Other parts of the health and care system such as NHS Trusts, your GP, the pharmacy, social workers, and other health and care professionals.
   • Local authorities.
   • The police or other law enforcement agencies or courts subject to law or court order.

We are also required by law to report certain information to appropriate third-party authorities. This is only provided after formal permission has been given by a qualified health professional or Caldicott Guardian. Occasions when we must pass on information include:

• Where we encounter infectious diseases which may endanger the safety of others, such as meningitis or measles.
• Where a formal court order has been issued
• Where information sharing is requested by third parties and no legal obligation to share exists, we will not disclose any health information without your explicit consent, unless there are exceptional circumstances, such as when the health or safety of others is at risk.

The Director of Care, Care Service Leads, Data Protection Officer and Caldicott Guardian may look at your records to monitor and audit the quality of records and care, or if dealing with a complaint.

The Care Quality Commission, our regulatory body, may also look at records as part of their inspection process; they will ask your consent.

There is limited access to identified members of our administration team in support of care and patient and family related events.

For friends, relatives, appointed next of kin, we will record basic details and contact information e.g. name and address.

We require this data because we have a legitimate interest in holding next of kin details about the individuals who use our service and keeping emergency contact details for our staff.

Your right to withdraw consent for us to share your personal information:

• At any time, you have the right to refuse/ withdraw consent to information sharing. The possible consequences will be fully explained to you and could include delays in receiving care.

How can you get access to your own health records?

• The Data Protection Act 2018 gives you the right to see or have a copy of your health records.
• If you want to access your health records you should make a written request (which can be by email) to our Data Protection Officer at dataprotectionofficer@each.org.uk. You should also be aware that in certain circumstances your right to see some details in your health records may be limited in your own interest or for other reasons.

We do not share any patient personal information, or the information of those associated with our patients without their consent to our:

• Fundraising team
• Marketing team
• Retail team

Families - more detailed information regarding how children and families’ information is managed can be found in the Family Information Leaflet ‘What happens to your information’. Please ask our staff for a copy.

National Data Opt Out Programme - From the 25th May 2018, any person aged 13 years or over, with an NHS number, can opt-out of having their confidential identifiable patient information being used for reasons other than their individual care and treatment. A person with parental responsibility can opt out on behalf of a child under 13 years of age. If you wish to opt out or want to find out more information about this, please go to https://digital.nhs.uk/services/national-data-opt-out-programme or ask a member of your local hospice team for a leaflet.

EACH is part of the Shared Care Record for the East of England - Why shared care records matter, every health and social care organisation that you have contact with has their own set of records. To provide you with the best care it is important that authorised health and social care staff have the most up to date information available to them. Shared care records assist staff to make the best decisions by having a more joined-up picture of your information. This is important in providing safe, personalised, and connected care. Please see our privacy notice for the shared care record.

Income Generation

For the purpose of income generation, we may use your personal data to:

• Steward your fundraising, ensuring we are offering you the support you need during your activity or donation.
• Provide pertinent stewardship and support for your fundraising for EACH. If you ask us to support you with a fundraising activity, we will continue to do so unless you make a change to your request as we consider this to be good stewardship. We differentiate our communications between stewardship and marketing to ensure we can effectively comply with the Privacy and Electronic Communications Regulations (PECR) which require consent for electronic marketing. We will always ensure we have your consent for electronic marketing.
• Claim Gift Aid from HMRC and/or to register you for retail Gift Aid as a donor of second-hand goods.
• Report to fundraising bodies on anonymised statistics and activity.
• Provide you with information, products or services you request.
• Comply with Money Laundering Legislation and we may not always be able to accept a gift anonymously.
• Ensure we contact supporters with the most appropriate communication we may profile your data by combining the information we hold with other sources of information or carry out other analysis techniques. This will enable EACH to contact you in the most relevant way and provide an improved experience. It will also enable EACH to have a greater insight and understanding of its supporters and use the information to develop the charity’s donor base. If you do not want your data to be used in this way then you can opt out at any time by emailing supportercare@each.org.uk or by telephoning 01223 800807.
• We send some data to specialist agencies for data cleaning which includes correcting and may include enhancing the data.
• Ask for your support to help EACH continue our work of caring for children, young people and families. This may be through volunteering, fundraising, becoming a Gift Aider or other means of providing support to the charity.
• Steward your fundraising, ensuring we are offering you the support you need during your activity or donation.

Marketing

We may use your personal information:

• If you have consented to our processing your personal data for marketing purposes, in accordance with this privacy policy, we may send you information (via email, post, phone or text) about our activities and services we consider of interest to you or those that you have requested.
• To provide web services for the enrolment and processing of volunteers.
• To interacting with you on our website providing information, online shopping and forums.
• We may take individual or group photos at events and your image may be used in promotional material if you attend our events or sites.
• EACH does not sell personal details to third parties for the purposes of marketing.

Running our organisation

We may use your personal information to:

• Ensure you receive excellent stewardship and are updated on our work and progress.
• Ask for your support to help EACH continue our work caring for children, and families. This may be through volunteering or other means of providing support to the charity.
• Record payment information, depending on your payment method, we may need to record your payment details and pass them on to a third-party mercantile service to process the payment.
• We may record telephone conversations for the purposes of staff training or other development.

If you are an employee or volunteer, we will use your personal information to:

• Process staff personal data for payroll and Human Resource Management purposes.
• Issue contracts of employment or volunteer service agreements. We will need your employment history and details about you for this which we will store securely.
• To carry out diligence checks, for example, checking driving licences to verify eligibility to drive, taking a copy of your passport to establish right to work and place of residence.
• To notify our insurers of employees age and any driving points you may have on your licence if you drive EACH vehicles.
• To administrate employee or corporate pension or insurance schemes. In this case, salary, medical and contact details may be shared with third party pension and insurance providers.
• If you are a member of staff or a volunteer, more information will be required. Depending on the work you do we may need to ask you for sufficient information to carry out some background checks. You will be asked to complete a personal details form when you join EACH and you should provide updates if that information changes. Records of your employment, appraisals, supervision, progression and HR processes are also kept on your personnel record but not kept longer than required.
• Information required for us to comply with legal obligations, for example, Disclosure and Barring Service applications, financial accounts or payroll records.

For administrative purposes, we may process and store your personal data to:

• Verify the identity of Trustees or senior managers, to ensure they qualify as ‘fit and proper persons’ and to provide identity verification to banks or financial institutions.
• To process personal information to support contractual arrangements.
• Process or store personal information to comply with legal obligations, for example, disclosure and barring service, VAT records and payroll records.
• Monitor and audit our services and ensure quality and accountability.
• To provide you with other services, for example, our library service.
• We may share your data with a third-party specialist, under a confidentiality agreement, in assisting with large volume Subject Access Request redaction.
• To maintain a relationship with you as a supplier of services.
• To provide you with IT systems, to set up your accounts and connect to your personal mobile devices.
• We may share your personal data with solicitors or other advisors if there is a legitimate, contractual or legal reason to do so.
• Provide Companies House and the Charity Commission with details of Trustees and Directors.
• Provide information to financial institutions for key staff or Trustees to verify identity for the purposes of authorising transactions.
• Storing information which you may have provided us with as a matter of your own vital interest, i.e. to maintain your own personal safety such as next of kin or information about your health.