Farleigh Hospice (charity number: 284670) is committed to protecting your privacy, upholding your right to confidentiality and keeping any personal information that you share with us safe and secure.
This privacy notice applies to our use of any and all data collected by us or provided by you in relation to your use of any service that Farleigh Hospice provides.
Please read this privacy notice carefully to understand our practices regarding your personal data and how we collect, use and store your information.
For more information, please contact our Data Protection Officer:
Email: [email protected]
Telephone: 01245 457300
1. What information we collect and how we use it
This section outlines how Farleigh Hospice collects, uses and protects personal data from our clinical service users, staff, volunteers and supporters, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1.1 Clinical service users
A clinical service user is anyone who:
- Is currently receiving support or care from one of our services
- Has previously received support or care from one of our services
- Has made an enquiry or been referred but is yet to receive support
- Was previously referred but did not receive a service
What information do we collect?
We may collect:
General personal data
- Name and title
- Address
- Date of birth
- Contact details
- Next of kin and family information
- GP and healthcare provider details
- CCTV footage
Special category data
- Health and medical information
- Information from relatives or professionals
- Lifestyle information (e.g. smoking status)
- Religion, ethnicity and language
- Safeguarding status
How do we collect this information?
- Directly from you
- From healthcare or social care referrals
- From third-party systems (e.g. NHS)
- Through CCTV systems
How do we use this information?
We use your data to:
- Deliver and manage your care
- Ensure accurate records
- Coordinate with healthcare providers
- Improve services
- Meet legal obligations
- Contact you about appointments or updates
We process your data under:
- Article 6(1)(e) – public interest
- Article 9(2)(h) – health or social care provision
1.2 Supporters
This includes donors, event participants, volunteers and individuals engaging with us in a non-clinical capacity.
When do we collect your information?
- When you donate
- When you contact us
- When you attend events
- When you complete forms
- When you subscribe to communications
- Through social media or third-party platforms
- Via CCTV
What information do we collect?
- Name and contact details
- Communication preferences
- Donation and event history
- Volunteering information
- Payment details (securely processed)
How do we use this information?
- Process donations
- Manage events and volunteering
- Respond to enquiries
- Send communications (if opted in)
- Meet legal obligations
- Improve services
Lawful basis
- Consent
- Contract
- Legal obligation
- Legitimate interests
You can update your preferences at any time by contacting us.
1.3 Applicants – staff and volunteers
What information do we collect?
- Contact details
- Employment and education history
- Right to work documentation
- Bank details
- Health and DBS information
- Equality monitoring data
How do we use this information?
- Recruitment and onboarding
- Payroll and administration
- Legal compliance
- Training and development
- Health and safety
- Internal communications
We process your data under:
- Article 6(1)(b), (c), (f)
- Article 9(2)(b) and (h)
2. Storage and security of personal data
We take appropriate technical and organisational measures to protect your data, including:
- Encryption
- Access controls
- Multi-factor authentication
- Regular audits
- Staff training
- Secure data disposal
2.1 Data location and transfers
Your data is stored in the UK or EEA. If transferred internationally, appropriate safeguards will be in place.
3. External links
Our website may contain links to third-party websites. We are not responsible for their privacy practices and recommend reviewing their policies.
4. Your rights
You have the right to:
- Access your data
- Correct inaccuracies
- Request deletion
- Restrict processing
- Object to processing
- Withdraw consent
To exercise your rights, contact:
[email protected]
5. Data retention
We retain personal data only as long as necessary, including:
- Clinical records – in line with NHS guidance
- Employment records – in line with legal requirements
- Financial records – minimum 6 years
- Marketing preferences – until withdrawn
6. Changes to this policy
We review this policy regularly.
Last updated: July 2025
7. Cookies and website data
We use cookies to:
- Improve website functionality
- Analyse usage
- Support marketing activity
Data collected may include:
- IP address
- Device and browser type
- Pages visited
- Location (approximate)
All data is anonymised where possible.
8. Media permissions
We may use images, video or audio recordings with your consent.
You can withdraw consent at any time by contacting us.
9. Contact us
General enquiries
Farleigh Hospice
North Court Road
Chelmsford
Essex CM1 7FH
Email: [email protected]
Telephone: 01245 457300
Data protection enquiries
Data Protection Officer
Email: [email protected]
Telephone: 01245 457300
Sub-licensing
Integrated Care Systems (ICSs) are partnerships that bring together providers and commissioners of NHS services across a geographical area with local authorities and other local partners to collectively plan health and care services to meet the needs of their population. The central aim of the ICS is to integrate care across different organisations and settings, joining up hospital and community-based services, physical and mental health, and health and social care. All parts of England are now covered by one of 42 ICSs.
The new Health and Care act 2022 established 42 Integrated Care Boards (ICBs) across England as statutory bodies and abolished the 106 Clinical Commissioning Groups (CCGs). The ICB will take on the NHS commissioning functions of the former CCGs as well as some of NHS England’s commissioning functions. It will also be accountable for NHS spend and performance within the system. The Board of the ICB will, as a minimum, include a chair, the CEO and representatives from NHS providers, general practice and local authorities.
In order to assure a smooth transition to the new commissioning landscape, the ICB need to be able to share data with providers and local authorities within their ICS so they are fully able to contribute to commissioning decisions.
The ICS Sub-License approach will allow the ICB to share data they receive from NHS Digital via their commissioning agreements with members of their ICS. This will be limited to pseudonymised commissioning data without the provider unique local patient id included.
Re-identification – This is permitted but the ICB will be responsible for determining which users will have this ability. They must be a health or social care professional with a legitimate (direct care) relationship to the patient.
It is important to note that direct care relies on the “implied consent” legal basis. Therefore, the patient must be aware of this relationship through clear communication.
Type of Information Used
Different types of commissioning data are legally allowed to be used by different organisations within, or contracted to, the NHS. Information used by the ICS Partners include:
· Age
· Gender
· GP Practice, Community and Hospital attendances and admissions
· Medications prescribed
· Medical conditions (in code form) and other things that affect your health.
Legal Basis
Statutory requirement for NHS Digital to collect identifiable information.
A Section 251 approval (CAG 2-03(a)/2013) from the Secretary of State, through the Confidentiality Advisory Group of the Health Research Authority, enables the use of pseudonymised information about patients included in the datasets.
The legal basis for sharing the data with ICS members is:
Article 6 (1) (e) – processing is necessary for the performance of a task in the public interest or in the exercise of official authority vested in the controller
and Article 9 (2) (h) – processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems
Data Processing Activities
The ICB processes this data internally. Data is also processed by Arden & GEM Commissioning Support Unit.
The ICS Partners currently involved in the Sub-Licensing process are:
· Essex County Council
· Southend City Council
· Thurrock Council
· Mid and South Essex NHS Foundation Trust
· East of England Ambulance
· Essex Partnership University NHS Foundation Trust
· North East London NHS Foundation Trust
· Provide CiC
· Integrated Care 24
The ICS Partners will become Data Controllers in their own right for the data received under the sub-licensing, however certain rules will apply to this:
· Onward sharing of the data by ICS members is not permitted.
· Data must be segregated from other datasets and additional linkage is not permitted.
Opt out details
You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do not wish your data to be included (even though it is in a format which does not directly identify you) you can choose to opt-out.
In this case, because pseudonymised data is being used, the National Data Opt-Out does not apply.
Instead, please inform your GP practice who will apply an opt-out code to your record to ensure that your information is not included in the programme.