If you wish to make a Subject Access Request, please click here for a step-by-step guide.
If you wish to request that we erase your data (the "Right to be Forgotten"), please click here for a step-by-step guide.
If you wish to make a request that we restrict the processing of your data, please click here for a step-by-step guide.
*Please note that completion of the above forms is not compulsory, and you can exercise your rights in whichever way you feel happy with. It does, however, help us with fulfilling your request by ensuring that the information we need is supplied.
Privacy Statement: Clinical
This privacy statement tells you what information we collect, what we do with it, how we will keep it secure and who it might be shared with. For the purposes of clarity, this privacy statement is written within the context that it is read by the parent/guardian of a child receiving care from us, or a parent/guardian receiving support from us directly.
We offer a wide range of services, and this privacy statement applies when you:
- Seek care, support or assistance from us (including when you make a referral);
- Speak to, or enquire about support, with our care team, which includes our care administrators and family support team;
- Provide us with personal information relating to a clinical admission, including sensitive information about your physical or mental health (including that of the child).
Who are we?
Forget Me Not Children’s Hospice supports children with life-shortening conditions and their families across West Yorkshire. Forget Me Not Children’s Hospice is a registered charity (no. 1110457). The registered address is Forget Me Not Children’s Hospice, Russell House, Fell Greave Road, Huddersfield, HD2 1NH.
We are the Data Controller, which means we decide how, when and why personal data about you and the child will be used. This is explained in more detail later in this statement.
If you have any questions, please contact us by:
- Emailing: email@example.com
- Telephoning: 01484 411040
- Writing to us: Forget Me Not Children's Hospice, Russell House, Fell Greave Road, Huddersfield, HD2 1NH
How and why do we collect information from you?
The care and services that we offer may apply to more than one child in a family, and we may also support the wider family (for example parents). In the context of this statement, each child has their own clinical record, and this record also contains details of any support we provide to the wider family, including siblings. In some cases, we provide support to family members whose child has not been cared for by the hospice - and in these cases, records contain information about the family, including the child and siblings.
We may gather information about you and the child from yourself, the child, family members and any other people involved in their care. This may include consultants, GPs, care professionals and social workers. When seeking support from us, the information is initially collected from the referral form which is completed by the person making the referral (for example a parent). On an ongoing basis, you may provide this additional information to us through discussions and appointments that you have with our care and family support teams, and further information on keeping information accurate and up-to-date can be found later in this statement.
We use this information to allow us to deliver, direct and manage care of the child, and provide support for the wider family. This includes ensuring that:
- Those involved in the care of the child (including doctors, nurses and care staff) have access to accurate and up-to-date information to assess the health of the child and provide the most appropriate care;
- We can work well with other organisations that may be involved with the care of the child, and/or the wider family as appropriate;
- Our Family Support teams have access to the relevant information needed to ensure the support we provide to your family is suitable; and
- Any concerns can be properly investigated.
What type of information do we collect?
The personal information we collect includes:
- Personal details of the child (including name, address, date of birth, NHS number, language and school information, along with parent/guardian or legal representative details);
- Information about the child’s care, including appointments and telephone calls, along with details of any professionals involved in the child’s care (such as GP’s and Consultants);
- Notes and reports about the child’s medical health, diagnosis and treatment, including any allergies.
- Results of x-rays, scans and laboratory tests;
- Personal details of parents and other family members receiving care or support directly from us (for example support provided by our Family Support Team). In this case, information we collect may include name, address, email, telephone number, date of birth, notes of our communications with you / work with you, and other details relevant to your request for our support. With your consent only, this may also include any relevant medical information from other organisations (such as your GP) to allow us to ensure we are providing you with the most effective care and support. Sometimes we may need to share your information with external agencies, however this would only be with your consent unless there is a concern for safety;
- Contact details of the person referring the child to our services (such as the relationship or job title of the referrer); and
- Any relevant information from people who cares for, or knows the child well (for example meal choices, wishes and preferences).
The nature of our service means we collect sensitive (special category) information, which includes information on the child’s health and ethnic group. Where we collect this information, we will treat it with extra care and only for the purpose we tell you about. Likewise, this information will always be processed in accordance with this Privacy Statement, and all information will be kept secure, and held for no longer than necessary.
We do not collect or request medical information on parents or other family members, unless you are referred in your own right. For example, we will only collect and request your medical information if you (as a parent/guardian/family member) are referred to us to receive therapy treatment. Likewise, where we request information from other organisations (such as your GP), this will only be with your consent.
As an organisation, we adhere to the Records Management Code of Practice for Health and Social Care 2021, which shows how to effectively manage medical records, and sets legal and professional best practice. For further information on the code of practice, please visit: https://www.gov.uk/government/publications/records-management-code-of-practice-for-health-and-social-care
We retain these records in accordance with the NHS Records Retention Schedule, which sets out the appropriate length of time each type of record should be retained. We will never keep records for longer than necessary, and will always ensure that all records are destroyed confidentially once their retention period has been met and the decision made that the records are no longer required.
If you agreed to it, we collect your e-mail address to allow us to send you information on upcoming family events that you may be interested in. You can opt-out at any time by e-mailing firstname.lastname@example.org, or by writing to us using the address at the top of this page.
When you visit our hospice, footage from outside of the building will be recorded on our CCTV system for the purposes of crime prevention and public safety. We do not use CCTV anywhere inside the hospice.
Any information provided and obtained by Forget Me Not Children’s Hospice may also be used to support auditing (including local clinical audits). This is done to monitor the quality of our service, and to ensure we are providing safe and effective care. Where possible, we will seek to anonymise clinical audits unless there is a compelling and/or legal reason not to – and we will always ensure privacy rights are upheld.
The legal basis for processing information
The legal basis that we rely on for processing information will depend on the circumstances in which it is being collected and used. You can ask us which lawful basis applies to each processing activity, however we have included a description and examples of the different lawful reasons that we rely on below:
- Where you have provided your consent for us to use the data in the way that we have explained. This provides you with an opportunity to choose whether you agree to us processing this type of information, and we break down each processing activity to give you a real choice into whether you wish us to process information in this way. This includes asking you whether you are happy to share information with other health and social care settings (i.e. GP’s), including through our clinical records system (SystmOne). This is done on the form you complete when signing up to our services, and we break down each processing activity to give you a real choice into whether you wish us to share information in this way. Further information on SystmOne is provided later in this privacy statement.
- We may need to process information for the purposes of fulfilling our legitimate interests. Broadly speaking, legitimate interests means we may process your personal information where we have a genuine and legitimate reason, and are not harming any of your rights or interests. This includes providing our care services (such as bereavement support). When we process your information for our legitimate interests, we will always consider and balance any potential impact on your rights, and you have the right to object to such processing. As such, we will never use information for activities where our interests are overridden by the impact on you.
- For sensitive personal data (Health Records), we also process data under 9(2)h, where processing the information is necessary for the “reasons of preventative or occupational medicine, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services” and, where appropriate, 9(2)(c) “when it is necessary to protect the vital interests of a person who is physically or legally incapable of giving consent”. This allows us to ensure that we understand the full range of clinical information about the child in order to ensure we can provide safe and effective care.
- Where we need to process your information to carry out our legal obligations, such as responding to information requests from our regulators (including the Care Quality Commission CQC).
- We may also need to process information for the performance of a contract between you and ourselves.
Who has access to this information, and is it shared with other professionals?
Our staff and clinical support clerks have access to this information, and may share and discuss relevant information about you or the child with each other. This includes our nurses, doctors, therapists, administrators and family support teams. This is to allow us to provide the best care and support to the child and wider family. On occasions, this information may include health and social care students or trainees who are working in our team.
We often need to share relevant information about the child’s medical records with health or social care professionals in other settings who are directly involved in their care. For example, we may need to share information with GP’s, hospital teams, ambulance staff or social care services. Where we do this, it will only be for medical and care purposes, and where they have a genuine need for it (or if we are under a legal obligation to do so). You can choose whether you agree to us doing this, and you can change your preferences at any time by contacting us using the details in this statement, and we will fully respect this. However, please note that we can only do this where we are not prohibited from doing so by any legal obligation, and this may affect the child’s care (although we will discuss this with you if this applies). Likewise, sometimes disclosure may be justified in the public interest, with this decision made by the Director of Service Delivery and Development.
We may also need to share information about you and/or the child with our regulatory body (the Care Quality Commission) or NHS organisations who commission services from us. This may be to carry out audits of our care, respond to complaints, incidents or near-misses, or seek feedback from you about the services we offer. We may also share this information with local organisations or commissioners to gain commissioned care funding. However, if you do not want us to share this information, we will respect this decision and the organisation seeking it will aim (where possible) to carry out their checks without looking at this information.
Sometimes, we are required by law to share records, and this may mean we are unable to respect your wish not to share the records. Examples include if a formal court order has been made, or we find an infectious disease that may put others in danger, or if other organisations (i.e. the police/social services) need it to prevent serious crime or where a child is at risk of abuse or neglect. Likewise, we are legally required to share information about the child with the Child Death Overview Panel if the circumstances necessitate it.
Some non-identifiable information (meaning we have anonymised the data) may be shared with other professionals or relevant organisations. This may be for statistical or research purposes, and to help support the teaching of health or social care professionals. Again, if you would rather that we didn’t share information in this way, we will fully respect this.
Sharing information with Medical Examiners
We are required to share details of deaths to the Medical Examiner and local NHS Trust. The role of the medical examiner is to (1) review care records, (2) ensure the cause of death is recorded accurately, and (3) to decide whether any further investigations are needed by the coroner. The medical examiner also provides opportunities for relatives to ask questions. In order to support their work, we are legally required to pass medical and contact records to the Medical Examiner. Medical records associated with deceased patients are outside scope of the UK GDPR. However, next of kin details are within the scope. All data will be processed in line with under Article 6.1(e) of the GDPR: This being that processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority invested in the controller. The information is being processed for the purposes of the running the medical examiner system, as part of the NHS Patient Safety strategy and within NHS Trust functions for activities carried out in connection with the provision of health services. It is necessary for medical purposes, and is undertaken by either a health professional, or a person who, in the circumstances owes a duty of confidentiality to the patient equivalent to that of a health professional.
Consent for SystmOne
We use an electronic patient health records system called SystmOne, which allows us to access and share clinical information about a patient in our care. This also includes adults and other individuals receiving other types of support from us (such as family support). The information processed includes any GP notes and medical and treatment history information, along with appointment details. Only those involved with the treatment and support of the child or adult are authorised to access this information, with our administrative staff only ever viewing records in order to facilitate care and support (such as booking appointments). The use of SystmOne ensures that we have the most up-to-date and accurate information available to us, which ensures we offer the most appropriate care and support to you.
Within SystmOne, we are also able to retrieve information from those involved with the care, treatment and support of the child or adult (called ‘Sharing In’). Likewise, we are able to share our own information (such as any observations), and this is called ‘Sharing Out’. Both options are explained below, and when you sign up to our services, we ask for your explicit consent to give you a real choice as to whether you are happy for us to share, and/or, receive information in this way. If you have any queries about the way your information is used, please contact us using the details at the top of this policy.
Within SystmOne, we receive information from those involved in the care and support of the child or adult (such as from GP’s), and this is called Sharing In. By having access to the full medical information, we can ensure that we are providing the most appropriate care and treatment services, and we access these records throughout the period of us treating the child or providing support to the adult.
Within SystmOne, we also share information with other services involved in the direct care and support of the child or adult, such as GP’s, and this is called Sharing Out. This allows those who have appropriate controls in place (such as the local NHS hospital or GP) to access information in order to provide direct care. The term ‘Direct Care’ means a clinical health activity concerned with the prevention and investigation and treatment of illness, and provision of safe and high-quality care and treatment. We share information out through SystmOne throughout the period of us treating the child or providing support to the adult.
Only authorised services are able to access this system, and there are strict controls governing the use of it. The types of organisations that we share this information with includes NHS health and social care services involved with the direct care, support and treatment of the child or adult, such as:
- GP Practices
- NHS Community services
- Urgent Care (such as A&E or Minor Injury Units)
- Palliative care services
- NHS Hospitals
This will only be used to share relevant information related to care and support, such as any observations we have made through caring for them, and only those who have a legitimate and lawful need have the ability to access these records. You can, at any time, change your preferences as to whether you agree to sharing data in this way. To do this, please contact us using the details in this statement.
Whilst we will always endeavour to care for children and families who choose not to give consent, the range of services that we offer may become more limited (for example we may be unable to safely make clinical decisions), so we will inform you if decisions about consent have implications for the provision of care or treatment.
Consent for other services
For some of the services that we offer, we may seek consent to understand whether you are happy for us to process information in this way, and we will always inform you if decisions about consent have implications for the provision of our services to you.
If, at any time, you wish to withdraw this consent, please contact us by e-mailing email@example.com, or by writing to Director of Service Delivery and Development, Forget Me Not Children’s Hospice, Fell Greave Road, Huddersfield HD2 1NH.
Please note that where the legal basis for processing information relies on a statutory law, duty or power, the right to withdraw consent may not be possible (such as if we have to transmit information for legal purposes).
Accessing and updating information, or finding out more
The accuracy of your information, and information of the child, is important to us. If you need to correct any information that we hold, please contact us using the details at the top of this page. We will always complete assessments, plans and records in conjunction with you where possible. Therefore, it is important to keep these records up to date when requested by the care team, which in turn helps us ensure that we have accurate plans in accordance with you and the child’s wishes.
We can also tell you what information we hold about you or the child, and how it is processed. To do this, please complete a Subject Access Request form, which can be found by visiting our website or emailing us at firstname.lastname@example.org
- You can also ask us about how we use or handle information about you or the child, including:
- How we have decided how, why and when we process personal information;
- What categories of personal data we collect, store and process, including the purpose and legal basis for this processing;
- If we intend to transfer the personal data to a country outside of the European Economic Area, information about how we ensure this is done securely;
- How long we will store this data.
Photographs and films of children in our care
We may, from time-to-time, photograph or video film children in our care and use these for publicity purposes. Where we do this, this will only be with the consent of the parent/guardian, and you have the right to change your preferences at any time by contacting us. Likewise, you can specify if you only wish the photographs/video film to be used for a certain purpose, such as promoting an event.
Use of interpreters
To ensure our services reach as many families and communities as possible, it is sometimes necessary to use transcribers. Our transcribers are provided by a service called Enable2, who also work with other charities and NHS organisations. Where we use this service, any discussions Enable2 translate (such as chats between you and Forget Me Not clinical staff) will be kept strictly confidential, and processed for the sole purpose of transcribing. Transcribing can take place face-to-face, in writing, or over video conferencing (such as through Zoom or Microsoft Teams).
We only use transcribers where we feel it is necessary, and to ensure we’re offering you the best care and support possible. We have carefully vetted and checked Enable2 to ensure they meet our Data Protection standards - and have agreements in place to ensure they treat information privately. Using a transcriber is entirely optional - and you have the right to ask us not to use them, or to use them in a more limited way (such as only for certain conversations). If you have any questions or concerns, please get in contact with us.
National Data Opt-Out
As a healthcare organisation, Forget Me Not Children’s Hospice are required to assess our compliance with the National Data Opt-Out, which gives you the right to decide whether personal data is used for non-healthcare purposes - specifically research and planning. We have carefully reviewed our data-flows, and at present, none of our data-flows fall into the criteria provided by the Opt-Out. Should this change, we will review our privacy notice to ensure you are provided with accurate and timely information.
You have the right to object to processing that we may carry out. This includes requesting that we stop, erase or restrict the processing of information about you or the child. You can do this by writing, e-mailing or telephoning us using the details provided at the top of this page. However, please bear in mind that this may affect our ability to carry out care or support, and we may be prevented from actioning your request in certain circumstances (for example if we are lawfully required to retain the information). Where this occurs, we will inform you in writing.
You also have the right to request that data is provided electronically to allow transfer to another organisation (Data Portability).
How we protect information
When you give us personal information, we take steps to ensure that it’s treated securely. All those involved with the child’s care undergo strict Information Governance training, and all those working or supporting us has a legal duty to keep records confidential. Our Caldicott Guardian, who is the senior clinician responsible for ensuring that rights to confidentiality are respected, can be contacted by the following methods:
Post: Caldicott Guardian, Forget Me Not Children’s Hospice, Fell Greave Road, Huddersfield HD2 1NH
Tel: 01484 411040
Making a complaint
You have the right to make a complaint about how we (or any third parties) use personal data of you or the child. As a local charity, we encourage people to come forward with any suggestions and queries, and welcome people challenging us if they feel that the use of information is unfair, misleading or inappropriate. You can contact us by using the details at the top of this policy.
You also have the right to make a complaint directly to the supervisory authority, which is the ICO. They can be contacted by telephone on 0303 123 1113. Alternatively, please visit their website: https://ico.org.uk/concerns
Reviewing this statement
We regularly review this statement to ensure it reflects how we use and handle information, and it was last updated in August 2023. We may, from time to time, change this statement, however we will inform you of any changes to how we use personal information.
Updates in version 2.3
Updated to include information on when we use interpreters, including details on who the service is provided by, and what data protection measures are in place.
Updates in version 2.4
Updated to include information on our privacy practices concerning auditing, including details on when patient information will be used to support local clinical auditing. Furthermore, we have updated details on our compliance approach towards the NHS National Data-Opt Out.
Updates in version 2.5
Updated to include information on when medical and next-of-kin records will be shared with the Medical Examiners.