Leicester Hospitals Charity Privacy Statement

Policy last updated: 21 January 2022

Leicester Hospitals Charity (LHC) is committed to ensuring that your privacy is protected. This statement sets out how and why LHC collects and uses your personal information, and how we protect it. If we ask you to provide certain information by which you can be identified, it will only be used in accordance with this privacy statement and with current Data Protection Laws.

Notification of change of privacy policy

LHC may change this statement by updating this page. You should check this page from time to time to ensure that you are happy with the changes. For more information, please visit the Information Commissioner’s Office, with whom we are registered.

Information that we collect

We may collect, store and use the following types of personal information about you:

• Full name and title

• Gender

• Contact information including address and post code. This can also include place of work

• Phone numbers and email addresses

• Communications preferences

• Financial information such as bank account details (if setting up a standing order or direct debit) and credit/debit card information you have provided in order to make a payment

• Date of birth

• Emergency next of kin details (if you are taking part in an event or volunteering for us)

• Information about your activities on our website and about the device you use to access these, for instance your IP address and geographical location

• Details of how you have interacted with us, for example purchasing Christmas cards or enquiring about one of our fundraising events

• Your tax status for the purposes of claiming gift aid against your donations.

Special Category Data

Special Category Data is personal data which is stated within the General Data Protection Regulation (GDPR) as being more sensitive and therefore requiring more protection. Examples of special category data include information about your health, religious beliefs, race, ethnicity, sexual orientation, and political opinions.

Leicester Hospitals Charity collects special category data if you have provided us with consent to do so, as outlined in the circumstances below.

• For specific purposes to ensure your safety, such as if you are visiting our premises or undertaking a challenge event on our behalf

• Your stories and images in order to promote the work of our services

• To enable delivery of our services.

How the Charity collects this information

We collect personal information that you give us directly – for example when you:

• Communicate with us

• Make a donation

• Raise funds through participating at an event or challenge

• Sign up via our website to receive news and updates

• Enquire about or pledge to remember us in your will

• Engage with our services

• Share your stories to encourage support of Leicester Hospitals Charity

We collect personal information that you give us indirectly from third parties– these include:

• Fundraising websites such as JustGiving (You should check the Privacy Statements of sites before you give them your information.)

• Event organisers

• Registers which enable us to keep your data up to date (such as Royal Mails’ National Change of Address Register, the National Deceased Register, and The Bereavement Register)

• A probate search company (Smee & Ford) who conduct searches of grants of probate from courts in England and notify us of any potential legacies

• NHS Trusts and other third-party organisations with whom we partner to deliver our services.

We may also collect information through publicly available sources

• We may also access information about you that is available in the public domain from sources including Companies House, the electoral roll, press reports and social media (such as LinkedIn, Facebook) depending upon your settings or the privacy policies of these services.

We also collect data through our website and digital channels

When you interact with our digital platforms, we do not automatically capture or store your personal data but may automatically capture other information about your visit to help us better understand how supporters and beneficiaries use our digital platforms. This is to enable us to create better content and more relevant communications. The type of information we may capture includes:

• How you reached our digital platform and the internet protocol (IP) address you used

• Your browser type, versions and plug-ins, and your operating system

• Your journey through our digital platform, including the links you used, any searches you made, your length of visit overall and to each page, and other page interaction information

• Which videos you watched and for how long

• What content you liked or shared

• Which adverts you saw and responded to

• Which pop up or push messages you might have seen and responded to

• Demographic information such as geographical location and gender if available

• Information collected in any forms you complete

• The marketing activity that led to your taking specific action on our digital platforms (e.g. liking our Facebook page).

By using our website or any of our services, or providing us with any personal data, you agree to your personal data being used and disclosed in the manner set out in this policy.

What we do with the information we collect

We require this information for the following reasons:

• To process donations and claim Gift Aid.

• To respond to you if you have made an enquiry

• To thank you for your donations, volunteering, or other support

• To administer challenge and/or community events you undertake on our behalf

• To keep you informed about the work of Leicester Hospitals Charity – such as our services, impact, fundraising, campaigns and events

• To invite you to participate in surveys or research

• To manage your communications preferences and consents

• To better understand your relationship with us

• For internal record keeping such as the management of feedback or complaints

• We may analyse your personal information to create a profile of your interests and preferences so that we can contact you with information relevant to you

• We may make use of additional information about you, including geo-demographic information and measures of affluence, when it is available from external sources to help us understand the background of the people who support us. This helps us to make appropriate requests to supporters who may be able and willing to give more than they already do

• To administer our website and to troubleshoot, perform data analysis, research and personalise the online communications which are presented to you

• To allow for personalised communications and the targeting and retargeting of relevant adverts which ensure maximum cost effectiveness, by understanding how we can improve our services or information

• To prevent fraud, misuse of services or money laundering and perform due diligence where required

• For financial management or auditing purposes

• To publicise your story and experiences of University Hospitals of Leicester NHS Trust to raise awareness of our work. This will only happen after discussions with you, and with your consent. We keep you updated about when and where we use your story.

Sharing of your information

Unless otherwise stated, your personal information will be kept secure within Leicester Hospitals Charity using appropriate technical controls to protect your details. We will not sell, trade or lease your personal information to others.

We may have to share your personal information (and special category data) with third parties in certain circumstances. Details are included below.

• We will share your details with any individual who is authorised to act on your behalf

• To comply with our legal obligations, we may need to disclose your details to regulators, government departments, law enforcement authorities including the Police, legal advisors, tax authorities, insurance companies, and any relevant dispute resolution body or the courts

• If you make a donation to a tribute fund page, this data may be collected by a third party to process your donation on our behalf

• We may share your details with our third-party payment processing providers who assist us in providing payment services for donations. Our current payment processing providers are JustGiving, PayPal, Donorbox, Access Paysuite and Worldpay

• We may share your name, and details of your donation, with the University Hospitals of Leicester NHS Trust (UHL) in order to ensure your donations are used according to your wishes. This will be limited to senior members of staff only. You can let us know if you would prefer for your details to remain anonymous and we will always respect your wishes

• If you register an interest in volunteering for the hospital, we will share your personal details with the University Hospitals of Leicester NHS Trust so that they can contact you. We may keep your details for project monitoring purposes

• We may use other third party companies to provide services on our behalf, including sending postal mail and emails, checking our supporter’s personal information is accurate and up to date, and processing credit card payments. We will only provide these companies with the information they need to deliver the service. We do comprehensive checks on these companies before we work with them, and we put a contract in place that sets out our expectations and requirements.

UHL Staff Lottery – ‘UHLOTTO’ (Staff Only)

LHC runs the staff lottery UHLotto, raising funds for staff benefit within UHL, as well as giving out weekly prizes. As part of the process, we send details to UHL’s Payroll Provider of those staff who have registered to join the UHLotto so that they may make deductions directly from your salary. We also send details of cancellations and adjustments. We may also contact the payroll provider on your behalf to raise queries. We receive information from the payroll provider relating to those who have deductions from their salary so that we are able to reconcile our database and ensure that those entered into the weekly draw are paying correctly.

Supporters under the age of 18

We are committed to protecting the privacy of the young people that engage with us.

When you register with us, you are stating that you are over 18 years of age or are a minor acting with parental consent so please ensure you have consent of your parent or responsible guardian.

Inappropriate website content

If you post or send any content that we believe to be inappropriate, offensive or in breach of any laws – such as defamatory content on our forums or social media pages – we may use your personal information to inform relevant third parties such as your internet provider or law enforcement agencies.

Cookies

Cookies are small text files that are automatically placed onto your device by some websites that you visit. They are widely used to improve the performance of a website, for saving different options and to provide website owners with information on how the site is being used.

We use cookies to enhance the experience of the websites, to increase the performance, to identify how the website is being used and where we can make improvements and to monitor how our advertisements perform. Some of our cookies are vital for the websites to operate effectively and others are optional, but may decrease the usability or performance of the websites.

We also may host encrypted personal cookie information on third party websites including Google and Facebook, to tailor and personalise our online communications with you. We use this information to identify ways in which you can support Leicester Hospitals Charity, and this allows us to show you more relevant digital content.

These third parties may include:

• Advertisers and advertising networks (for example, social media platforms like Facebook and Google Ad Sense)

• IT Service providers

• Analytics and search engine providers (for example, Google Analytics and Google Search).

These companies are used for the purpose advertising the Charity online and allowing us to effectively report the success of those adverts.

Tracking

We use multiple first and third party technologies such as pixel tags and web beacons to track and improve the user experience on our sites, the quality of service and to monitor the effectiveness of campaigns and digital marketing activity.

We may use them:

• To see what website content is popular and how people are using the site as they allow us to track users’ movements through our website. This type of information is amalgamated so that we can build up a picture of how the site is performing.

• To make sure we offer you a consistent service. For example, if we are testing new website content or we want to run a survey, we use tracking to remember what content you have seen or if you have already been asked to join the survey.

Our legal basis for processing your information

We process your data as described in this Privacy Statement because we have a legitimate need to do so to meet our charitable objectives. Some processing of data may be carried out to perform a contract with you, or it is required by law, such as the completion of due diligence, or obligations for processing Gift Aid on your donations.

Legitimate interests

In order to meet our charitable objectives, we need to undertake processing activities to enable us to deliver against our mission. We will only use your email information to contact you for marketing purposes if we have your explicit consent to do so. In some cases, we may not yet have received consent from you to contact you by post or telephone, but feel that you may be interested in our communications (for example, if you have recently supported us in some way, perhaps by donating or signing up for a fundraising event). We may exercise our legitimate interest to contact you by post or telephone in these circumstances, but we will always carry out an assessment beforehand to ensure that the way we use your data is fair and does not exceed what you would reasonably expect to receive from us.

You will always be given the opportunity to opt out of communication by any channel at any time, and we will always make it clear to you how to do this.

Specific consent

• Where you have provided your consent for us to process your data

• This is where we will have asked explicitly if we can use your information for specified purposes, for example, so we can send you marketing information via email

• For our services we generally ask for consent to process your details as we require health information. Due to the nature of our services, we may not always be able to obtain consent directly from the patient due to their condition or age. In this instance we may instead obtain consent from an authorised third-party representative of the patient (e.g. parent, guardian, power of attorney, next-of-kin)

• You have the right to withdraw consent for any purpose at any time.  Please see the ‘Your rights’ section later in this statement.

Security of your data

We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online.

Your debit and credit card information

If you use your credit or debit card to donate to us or pay for a registration online or over the phone, we will ensure that this is done securely and in accordance with the Payment Card Industry Data Security Standard. Only staff authorised and trained to process payments will be take your donation.

We do not store your credit or debit card details at all. Following the completion of your transaction, all card details and validation codes are securely destroyed once the payment or donation has been processed. Only staff authorised and trained to process payments will be able to see your card details.

If we receive an email containing any credit or debit card details, it will be immediately deleted, no payment will be taken and you will be notified about this.

Links to other websites

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that external website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

Your rights

You have a right to restrict our collection or use of your personal information. When you are asked to fill in a form on our website, there will always be a box that you can tick if you do not want the information to be used for marketing purposes. You can also control the means by which we contact you, e.g. telephone, post, email. You can change your contact preferences at any time.

If you have previously given us your permission to contact you and have now changed your mind, you can let us know by emailing uhl-tr.lhcharitymailbox@nhs.net calling 0116 258 8709, or writing to Leicester Hospitals Charity, Belgrave House, Leicester General Hospital, Leicester, LE5 4PW.

If you request that we do not contact you again for marketing purposes, we will respect your wishes. It may take up to 28 days for us to update our records and for you to stop receiving communications from us. After this time, we may still send you administrative communications, for example in relation to payments you have made or events you have signed up to take part in.

If you ask not to receive any fundraising communications from us, please be aware that your personal information may still retained and marked to prevent you from receiving any communications and to allow us to have our work independently audited. You have a right to ask us to remove your personal information, and if it’s not necessary for the purpose you provided it to us for, we will do so. In doing so, we will be unable to guarantee that you will not receive communications in the future, because we will have deleted your data and will therefore have no record of past requests from you.

If you want to guarantee that you will not receive communications from us, it is in your best interest for your data to be retained on our system so that your contact preference is recorded and adhered to.

We do not have any access to your medical records. We will not sell or lease your personal information to third parties. We will not share your information with a third party for their own purposes unless required by law to do so. You may request details of personal information which we hold about you under Data Protection Law.

If you would like a copy of the information held on you please request this in writing to the address below. If you believe that any of the information we are holding on you is incorrect or incomplete, please contact us as soon as possible, so that we can correct the information.

We require you to prove your identity with two pieces of approved identification. Please address requests to the Director of Charity, Leicester Hospitals Charity, Belgrave House, Leicester General Hospital, LE5 4PW and we will respond within 40 days of receipt of your written request and confirmed ID. Please provide as much information as possible about the nature of your contact with us to help us locate your records. We reserve the right to charge a fee of £10 for this process.

Keeping your records

We keep records for as long as required to operate the service in accordance with legal requirements, tax and accounting rules. Where your information is no longer required, we will destroy all paper records and archive all digital data.

We appreciate your support and aim to ensure that your privacy is treated with respect at all times, in compliance with the current Data Protection Laws.