St Wilfrid's Hospice Privacy Notice – Clinical Care and Counselling

St Wilfrid's Hospice is committed to being fair, open, honest and transparent in relation to the collection, processing and sharing of your personal data - in full accordance with the UK General Data Protection Regulation (UKGDPR) and the Data Protection Act 2018.

This privacy notice covers data processing for clinical care (patients, relatives and carers) and for counselling services. It tells you what to expect us to do with your personal information. Processing of other data by the hospice is covered in separate privacy notices.

Contact details

Post: St Wilfrids Hospice (Eastbourne), 1 Broadwater Way, Eastbourne, East Sussex, BN22 9PZ

Phone: 01323 434200

eMail:  Patient-related enquiries should be via email to stwh.spcreferrals@nhs.net.

If you have any non-patient related questions or concerns about how we use your personal information, please contact us via email to Hospice@stwhospice.org

What information we collect, use, and why

We will normally keep your information in an electronic format. This includes:

Personal details, such as:

• Name,
• Home address
• email address (if you agree to contact via this method)
• Home and/or mobile telephone number

For people referred for care and counselling:

• NHS number
• Date of birth/Age
• Ethnicity, religion, gender, preferred language, disability, sexual orientation
• Next of kin, carer and relevant relationships/support networks

Additionally for people referred for clinical care: health information, including:

• Health information (including medical conditions, allergies, medical requirements and medical history)
• Information about care needs (including disabilities, home conditions, medication and dietary requirements and general care provisions)
• Test results (including psychological evaluations, scans, bloods, x-rays etc))
• Records of meetings and decisions
• Information about income and financial needs for funding or personal budget support
• Your General Practitioner (GP) details
• Your nominated pharmacy (for electronic prescriptions)

How we use your information

We use data in many ways.  A list of our reasons for processing data is shown below:

• For the care and treatment of a person using our hospice palliative care services
• For pre/post bereavement counselling and support
• For provision of our Befriending service
• In order to support carers
• In order to support families/next of kin and inform them on what the organisation does and how they can get involved if they wish
• To invite people to remembrance services
• In order to ask the bereaved to complete and return national bereavement surveys
• To follow up any incidents, events or occurrences that require notification to the Care Quality Commission (CQC)
• Providing legally mandated datasets to the NHS such as the Community Services Data Set (CSDS)

If your information is to be collected and used for any other purposes in the future, we will tell you about it and confirm our legal basis for processing that information.

Lawful basis for processing

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

We ask for your consent to processing such as:

• A parent/guardian referring their child for bereavement counselling via our Seahorse service.
• An individual requesting counselling services via a web-form on our website.
• A patient asked to consent to the sharing (in and out) of their healthcare information, providing healthcare professionals with a quick view of essential patient information (including medications, allergies, and adverse reactions) from systems such as their GP practice or NHS Summary Care Record. This improves patient safety and can help reduce the risk of medication errors and ensure that patients receive appropriate care. Similarly, sharing out enables professionals involved in the patient’s care from other healthcare organisations to see up to date information from us (GP practice, community/district nursing, out-of-hours on-call services, ambulance services etc).

Sometimes it is necessary for us to process your data to comply with a legal obligation, such as:

• Incidents, events or occurrences requiring notification to the Care Quality Commission (CQC)
• Providing legally mandated datasets to the NHS eg Community Services Data Set (CSDS)
• NHS Medical examiners review of records of the deceased.

The hospice will process certain information under the basis of ‘Legitimate interest’ in circumstances where any individual would reasonably expect us to be using their information.

St Wilfrid’s Hospice will still protect your rights and interests, ensuring that processing remains lawful, fair, and necessary, without causing harm and where there is no less intrusive way to achieve the same result. Examples include:

• Providing patients and clients referred to us, with safe care, treatment and support
• Inviting people to remembrance services
• Holding family contact details and their relationship to a patient under our care eg next of kin
• To allow families/next of kin to know what the organisation does and how they can get involved.
• Patients needing prescriptions (generated from the hospice via ePrescribing to their nominated pharmacy)

The hospice will carry out a Legitimate Interest Assessment (LIA) for cases where legitimate interest is being used as the basis for processing information.

We may process personal data under the legal basis of ‘vital interests’ when safeguarding if necessary to protect someone's life or prevent harm. This is particularly relevant in situations where safeguarding children or vulnerable adults is concerned.

St Wilfrids may also access records in someone’s vital interests in extreme circumstances such as emergency clinical care.

Note that for our patients, processing of their special category health data is also covered under the provisions of the General Data Protection Regulation: Article 9(2)h “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services”.

Are you required to provide data and what happens if you don’t?

If you register to receive services from our clinical teams, then we have to obtain personal information from you in order for us to deliver safe care and treatment.

Where we get personal information from

• Directly from you
• Family members or carers
• GP Practices
• Other health and care providers
• Social services
• Charities or voluntary sector organisations
• CCTV footage or other recordings

Note that if a patient has opted-out of data sharing elsewhere (such as from their GP’s system) then that information will not be viewable by our clinicians here at the hospice. Whilst this is the patient’s choice, we would usually encourage the sharing of essential patient information (including medications, allergies, and adverse reactions) to those involved in your care for improved patient safety, to help reduce the risk of medication errors and ensure that patients receive appropriate care.

 

Further processing of your data

Internally, patient data used for the care and treatment of a service user will be anonymised, aggregated and reported regularly (monthly, quarterly, annually) for analysis and planning of services. This will not identify individuals.

Who we share information with

Others we may share personal information with:

• Other health providers (eg GP practice, community/district nursing, out-of-hours on-call services, ambulance services etc)
• Organisations we need to share information with for safeguarding reasons
• Organisations we’re legally obliged to share personal information with such as the CQC

Duty of confidentiality

We are subject to a common law duty of confidentiality. However, there are circumstances where we will share relevant health and care information.

These are where:

• you’ve provided us with your consent (we have taken it as implied to provide you with care, or you have given it explicitly for other uses);
• we have a legal requirement (including court orders) to collect, share or use the data;
• on a case-by-case basis, the public interest to collect, share and use the data overrides the public interest served by protecting the duty of confidentiality (for example sharing information with the police to support the detection or prevention of serious crime);
• In England & Wales – the requirements of The Health Service (Control of Patient Information) Regulations 2002 are satisfied; or

Holding and protecting your data

Everyone working at St Wilfrid’s Hospice has a legal and professional duty to keep information about you confidential. We follow strict guidelines about how information is collected, stored and shared.

Your information is further protected by St Wilfrid’s Hospice’s compliance with the requirements of the:

• Data Protection Act (2018) / UK General Data Protection Regulation (UKGDPR)
• Data (Use and Access) Act 2025
• Regulators Code of Fundraising Practice (2016)
• Care Quality Commission
• Access to Health Records Act 1990

Patient confidentiality is monitored by our Caldicott Guardian, a senior clinician who ensures St Wilfrid’s Hospice protects patients’ right to confidentiality and by our Privacy Officer, Tara Schrikker – Registered Manager / Associate Director for Quality & Governance.

Patient data in our new electronic patient record system is stored securely in UK based datacentres.

National data opt-out

We comply with England’s national data opt-out in that we are not using confidential patient information for purposes beyond individual care. In addition, the NHS have provisions in place whereby you can opt-out of your patient personal data being used beyond direct care ( eg research). To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters

How long do we hold your data for?

We follow national guidance or best practice (sources such as the Records Management Code of Practice ) and as such, retention periods will vary according to the nature of the record.

Our full record retention schedule sits within our Data Retention Policy which includes the following examples:

• Patient records where they have received a blood transfusion under our care - 30 years
• Patient records - 8 years
• Duty rosters - 4 years
• Any incidents, events of occurrences that require notification to the CQC - 3 Years
• Complaints -10 years

Your rights

Which lawful basis we rely on may affect your data protection rights which are in brief set out below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

• Right of Access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for.
• Right to Rectify - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
• Right of Erasure - You have the right to ask us to delete your personal information
• Right to Restrict Processing - You have the right to ask us to limit how we can use your personal information
• Right of Portability - You have the right to ask that we transfer the personal information you gave us to another organisation
• Right to Object - You have the right to object to the processing of your personal data
• Right not to be Profiled - Not be subject to a decision based on automated processing.
• Right to Withdraw Consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time
• Right to Complain - to us, the Information Commissioners Office or the Fundraising Preference Service

If you make a request, we must respond to you without undue delay and in any event within one month.

Where we process data with your consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object.

Where we process your data as a Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Where we process your data under Legitimate interests – we’re collecting or using your information because it benefits you and our organisation without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability

What should I do if I have concerns?

Patient related enquiries should be via email to stwh.spcreferrals@nhs.net.

If you have any non-patient related questions or concerns about how we use your personal information please contact us via email to Hospice@stwhospice.org or via telephone ( 01323 434200).

Comments, complaints, compliments and general enquiries can also be registered via our Contact Us web-form on the website https://www.stwhospice.org/about-us/contact-us/  Complaint outcomes will be made without undue delay. If you remain unsatisfied with the outcome of our handling of a complaint, you can then escalate it to the Information Commissioners Office. https://ico.org.uk/make-a-complaint/data-protection-complaints/

Subject Access Requests (SAR) for requesting access to your personal data/records can be made via stwh.spcreferrals@nhs.net for the attention of Tara Schrikker – Registered Manager / Associate Director for Quality & Governance. Inclusion of one of the corresponding SAR request forms is helpful for us to understand exactly what information you are trying to obtain. These can be downloaded from the SAR page on our website https://www.stwhospice.org/information/subject-access-requests/

Whilst St Wilfrid’s Hospice is not currently required to appoint a legally defined role of Data Protection Officer, we continue to demonstrate our strong commitment to data protection, security and confidentiality with the following key IG roles in place:

Dr David Barclay – Caldicott Guardian

Darren Mackenzie – Senior Information Risk Owner (SIRO)

Steve Clarke – IG Lead

Changes to this information notice

Our privacy notices are reviewed a minimum of every 2 years and updated when there is a known change to our systems or processes. This information notice was last updated July 2025.