If you wish to make a Subject Access Request, please click here for a step-by-step guide.
If you wish to request that we erase your data (the "Right to be Forgotten"), please click here for a step-by-step guide.
If you wish to make a request that we restrict the processing of your data, please click here for a step-by-step guide. 
*Please note that completion of the above forms is not compulsory, and you can exercise your rights in whichever way you feel happy with. It does, however, help us with fulfilling your request by ensuring that the information we need is supplied.

Data Protection Privacy Notice (Clinical)

Forget Me Not Children’s Hospice is committed to protecting and respecting your privacy, and the privacy of the children and families that we care for.

This policy tells you what information we collect, what we do with it, how we will keep it secure and who it might be shared with. For the purposes of clarity, this policy is written within the context that it is read by the parent/guardian of a child receiving care from us.

We offer a wide range of services, and this policy applies when you:

  • Seek care, support or assistance from us (including when you make a referral);
  • Speak to, or enquire, with our care team, which includes our care administrators and family support team;
  • Provide us with personal information relating to a clinical admission, including sensitive information about your physical or mental health (including that of the child).

If you are looking for privacy information for when you support or donate to us, use or website, contact us about a non-clinical matter, or buy something in our shops or online, please read our non-clinical Privacy Policy. This can be found on the website by clicking ‘Privacy Policy’ at the bottom of the page, or by contacting us using the details below.

Who are we?

Forget Me Not Children’s Hospice supports children with life-shortening conditions and their families across West Yorkshire and North Manchester. Forget Me Not Children’s Hospice is a registered charity (no. 1110457). The registered address is Forget Me Not Children’s Hospice, Russell House, Fell Greave Road, Huddersfield, HD2 1NH.

We are the Data Controller, which means we decide how, when and why personal data of you and the child will be used. This is explained in more detail later in this policy.

If you have any questions, please contact us by:

  • Emailing: dataprotection@forgetmenotchild.co.uk
  • Telephoning: 01484 411040
  • Writing to us: Forget Me Not Children’s Hospice, Russell House, Fell Greave Road, Huddersfield, HD2 1NH

How and why do we collect information from you?

The care and services that we offer may apply to more than one child in a family, and we may also support the wider family (for example parents). In the context of this policy, each child has their own clinical record, and this record also contains details of any support we provide to the wider family, including siblings.

We gather information about you and the child from yourself, the child, family members and any other people involved in their care. This includes consultants, GPs, care professionals and social workers.  When seeking support from us, the information is initially collected from the referral form which is completed by the person making the referral (for example a parent). On an ongoing basis, you provide this information to us through discussions and appointments that you have with our care and family support teams, and further information on keeping information accurate and up-to-date can be found later in this policy.

We use this information to allow us to deliver, direct and manage care of the child, and provide support for the wider family. This includes ensuring that:

  • Those involved in the care of the child (including doctors, nurses and care staff) have access to accurate and up-to-date information to assess the health of the child and provide the most appropriate care;
  • We can work well with other organisations that may be involved with the care of the child;
  • Our Family Support teams have access to the information needed to ensure the support we provide to your family is suitable; and
  • Any concerns can be properly investigated.

What type of information do we collect?

The personal information we collect includes:

  • Personal details of the child (including name, address, date of birth, NHS number, language and school information, along with parent/guardian or legal representative details);
  • Information about the child’s care, including appointments and telephone calls, along with details of any professionals involved in the child’s care (such as GP’s and Consultants);
  • Notes and reports about the child’s medical health, diagnosis and treatment, including any allergies.
  • Personal details of parents and other family members receiving care or support from us (including your name, address and date of birth). With your consent only, this will also include any relevant medical information from other organisations (such as your GP) to allow us to ensure we are providing you with the most effective care and support;
  • Results of x-rays, scans and laboratory tests;
  • Contact details of the person referring the child to our services (such as the relationship or job title of the referrer); and
  • Any relevant information from people who cares for, or knows the child well (for example meal choices, wishes and preferences).

The nature of our service means we collect sensitive (special category) information, which includes information on the child’s health and ethnic group. Where we collect this information, we will treat it with extra care and only for the purpose we tell you about. Likewise, this information will always be processed in accordance with this Privacy Policy, and all information will be kept secure, and held for no longer than necessary.

We do not collect or request medical information on parents or other family members, unless you are referred in your own right. For example, we will only collect and request your medical information if you (as a parent/guardian/family member) are referred to us to receive therapy treatment. Likewise, where we request information from other organisations (such as your GP), this will only be with your consent.

As an organisation, we adhere to the Records Management Code of Practice for Health and Social Care 2016, which shows how to effectively manage medical records, and sets legal and professional best practice. For further information on the code of practice, please visit: https://www.gov.uk/government/publications/records-management-code-of-practice-for-health-and-social-care

We retain these records in accordance with the NHS Records Retention Schedule, which sets out the appropriate length of time each type of record should be retained. We will never keep records for longer than necessary, and will always ensure that all records are destroyed confidentially once their retention period has been met and the decision made that the records are no longer required.

If you agreed to it, we collect your e-mail address to allow us to send you information on upcoming family events that you may be interested in. You can opt-out at any time by e-mailing dataprotection@forgetmenotchild.co.uk, or by writing to us using the address at the top of this page.

When you visit our hospice, footage from outside of the building will be recorded on our CCTV system for the purposes of crime prevention and public safety. We do not use CCTV anywhere inside the hospice.

The legal basis for processing information

The legal basis that we rely on for processing information will depend on the circumstances in which it is being collected and used. You can ask us which lawful basis applies to each processing activity, however we have included a description and examples of the different lawful reasons that we rely on below:

  • Where you have provided your consent for us to use the data in the way that we have explained. This provides you with an opportunity to choose whether you agree to us processing this type of information, and we break down each processing activity to give you a real choice into whether you wish us to process information in this way. This includes asking you whether you are happy to share information with other health and social care settings (i.e. GP’s), including through our clinical records system (SystmOne). This is done on the form you complete when signing up to our services, and we break down each processing activity to give you a real choice into whether you wish us to share information in this way. Further information on SystmOne is provided later in this privacy policy.
  • We may need to process information for the purposes of fulfilling our legitimate interests. Broadly speaking, legitimate interests means we may process your personal information where we have a genuine and legitimate reason, and are not harming any of your rights or interests. This includes providing our care services (such as bereavement support). When we process your information for our legitimate interests, we will always consider and balance any potential impact on your rights, and you have the right to object to such processing. As such, we will never use information for activities where our interests are overridden by the impact on you.
  • For sensitive personal data (Health Records), we also process data under 9(2)h, where processing the information is necessary for the “reasons of preventative or occupational medicine, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services” and, where appropriate, 9(2)(c) “when it is necessary to protect the vital interests of a person who is physically or legally incapable of giving consent”. This allows us to ensure that we understand the full range of clinical information about the child in order to ensure we can provide safe and effective care.
  • Where we need to process your information to carry out our legal obligations, such as responding to information requests from our regulators (including the Care Quality Commission).
  • We may also need to process information for the performance of a contract between you and ourselves.

Who has access to this information, and is it shared with other professionals?

Our staff and clinical support clerks have access to this information, and may share and discuss relevant information about you or the child with each other. This includes our nurses, doctors, therapists, administrators and family support teams. This is to allow us to provide the best care and support to the child and wider family. On occasions, this information may include health and social care students or trainees who are working in our team.

We often need to share relevant information about the child’s medical records with health or social care professionals in other settings who are directly involved in their care. For example, we may need to share information with GP’s, hospital teams, ambulance staff or social care services. Where we do this, it will only be for medical and care purposes, and where they have a genuine need for it (or if we are under a legal obligation to do so). You can choose whether you agree to us doing this, and you can change your preferences at any time by contacting us using the details in this policy, and we will fully respect this. However, please note that we can only do this where we are not prohibited from doing so by any legal obligation, and this may affect the child’s care (although we will discuss this with you if this applies). Likewise, sometimes disclosure may be justified in the public interest, with this decision made by the Director of Care.

We may also need to share information about you and/or the child with our regulatory body (the Care Quality Commission) or NHS organisations who commission services from us. This may be to carry out audits of our care, respond to complaints, incidents or near-misses, or seek feedback from you about the services we offer. We may also share this information with local organisations or commissioners to gain commissioned care funding. However, if you do not want us to share this information, we will respect this decision and the organisation seeking it will aim (where possible) to carry out their checks without looking at this information.

Sometimes, we are required by law to share records, and this may mean we are unable to respect your wish not to share the records. Examples include if a formal court order has been made, or we find an infectious disease that may put others in danger, or if other organisations (i.e. the police/social services) need it to prevent serious crime or where a child is at risk of abuse or neglect. Likewise, we are legally required to share information about the child with the Child Death Overview Panel if the circumstances necessitate it.

Some non-identifiable information (meaning we have anonymised the data) may be shared with other professionals or relevant organisations. This may be for statistical or research purposes, and to help support the teaching of health or social care professionals. Again, if you would rather that we didn’t share information in this way, we will fully respect this.

Consent for SystmOne

We use an electronic patient health records system called SystmOne, which allows us to access and share clinical information about a patient in our care. This also includes adults and other individuals receiving other types of support from us (such as family support). The information processed includes any GP notes and medical and treatment history information, along with appointment details. Only those involved with the treatment and support of the child or adult are authorised to access this information, with our administrative staff only ever viewing records in order to facilitate care and support (such as booking appointments). The use of SystmOne ensures that we have the most up-to-date and accurate information available to us, which ensures we offer the most appropriate care and support to you.

Within SystmOne, we are also able to retrieve information from those involved with the care, treatment and support of the child or adult (called ‘Sharing In’). Likewise, we are able to share our own information (such as any observations), and this is called ‘Sharing Out’. Both options are explained below, and when you sign up to our services, we ask for your explicit consent to give you a real choice as to whether you are happy for us to share, and/or, receive information in this way. If you have any queries about the way your information is used, please contact us using the details at the top of this policy.

Within SystmOne, we receive information from those involved in the care and support of the child or adult (such as from GP’s), and this is called Sharing In. By having access to the full medical information, we can ensure that we are providing the most appropriate care and treatment services, and we access these records throughout the period of us treating the child or providing support to the adult.

Within SystmOne, we also share information with other services involved in the direct care and support of the child or adult, such as GP’s, and this is called Sharing Out. This allows those who have appropriate controls in place (such as the local NHS hospital or GP) to access information in order to provide direct care. The term ‘Direct Care’ means a clinical health activity concerned with the prevention and investigation and treatment of illness, and provision of safe and high-quality care and treatment. We share information out through SystmOne throughout the period of us treating the child or providing support to the adult.

Only authorised services are able to access this system, and there are strict controls governing the use of it. The types of organisations that we share this information with includes NHS health and social care services involved with the direct care, support and treatment of the child or adult, such as:

  • GP Practices
  • NHS Community services
  • Urgent Care (such as A&E or Minor Injury Units)
  • Palliative care services
  • NHS Hospitals

This will only be used to share relevant information related to care and support, such as any observations we have made through caring for them, and only those who have a legitimate and lawful need have the ability to access these records. You can, at any time, change your preferences as to whether you agree to sharing data in this way. To do this, please contact us using the details in this policy.

Whilst we will always endeavour to care for children and families who choose not to give consent, the range of services that we offer may become more limited (for example we may be unable to safely make clinical decisions), so we will inform you if decisions about consent have implications for the provision of care or treatment.

Consent for other services

For some of the services that we offer, we may seek consent to understand whether you are happy for us to process information in this way, and we will always inform you if decisions about consent have implications for the provision of our services to you.

 If, at any time, you wish to withdraw this consent, please contact us by e-mailing dataprotection@forgetmenotchild.co.uk, or by writing to Director of Care, Forget Me Not Children’s Hospice, Fell Greave Road, Huddersfield HD2 1NH.

Please note that where the legal basis for processing information relies on a statutory law, duty or power, the right to withdraw consent may not be possible (such as if we have to transmit information for legal purposes).

Accessing and updating information, or finding out more

The accuracy of your information, and information of the child, is important to us. If you need to correct any information that we hold, please contact us using the details at the top of this page. We will always complete assessments, plans and records in conjunction with you where possible. Therefore, it is important to keep these records up to date when requested by the care team, which in turn helps us ensure that we have accurate plans in accordance with you and the child’s wishes.

We can also tell you what information we hold about you or the child, and how it is processed. To do this, please complete a Subject Access Request form, which can be found by visiting our website or emailing us at dataprotection@forgetmenotchild.co.uk.

You can also ask us about how we use or handle information about you or the child, including:

  • How we have decided how, why and when we process personal information;
  • What categories of personal data we collect, store and process, including the purpose and legal basis for this processing;
  • If we intend to transfer the personal data to a country outside of the European Economic Area, information about how we ensure this is done securely;
  • How long we will store this data.

Photographs and films of children in our care

We may, from time-to-time, photograph or video film children in our care and use these for publicity purposes. Where we do this, this will only be with the consent of the parent/guardian, and you have the right to change your preferences at any time by contacting us. Likewise, you can specify if you only wish the photographs/video film to be used for a certain purpose, such as promoting an event.

Your rights

You have the right to object to processing that we may carry out. This includes requesting that we stop, erase or restrict the processing of information about you or the child. You can do this by writing, e-mailing or telephoning us using the details provided at the top of this page. However, please bear in mind that this may affect our ability to carry out care or support, and we may be prevented from actioning your request in certain circumstances (for example if we are lawfully required to retain the information). Where this occurs, we will inform you in writing.

You also have the right to request that data is provided electronically to allow transfer to another organisation (Data Portability).

How we protect information

When you give us personal information, we take steps to ensure that it’s treated securely. All those involved with the child’s care undergo strict Information Governance training, and all those working or supporting us has a legal duty to keep records confidential. Our Caldicott Guardian, who is the senior clinician responsible for ensuring that rights to confidentiality are respected, can be contacted by the following methods:

Caldicott Guardian

Post: Caldicott Guardian, Forget Me Not Children’s Hospice, Fell Greave Road, Huddersfield HD2 1NH

Tel: 01484 411040

Making a complaint

You have the right to make a complaint about how we (or any third parties) use personal data of you or the child. As a local charity, we encourage people to come forward with any suggestions and queries, and welcome people challenging us if they feel that the use of information is unfair, misleading or inappropriate. You can contact us by using the details at the top of this policy.

You also have the right to make a complaint directly to the supervisory authority, which is the ICO. They can be contacted by telephone on 0303 123 1113. Alternatively, please visit their website: https://ico.org.uk/concerns

Reviewing this policy

We regularly review this policy to ensure it reflects how we use and handle information, and it was last updated in April 2019. We may, from time to time, change this policy, however we will inform you of any changes to how we use personal information.

Updates in version 2.1

Updated to provide more clarity as to when we will seek explicit consent for processing data in SystmOne.

Provided more clarity and examples on the different lawful bases that we use to process your information.

Added an explanation that we will only ever request medical information of parents or family members from other organisations (such as GP’s) where they have been referred to our services in their own right, and always with consent.

Updated contact details.