Jersey Hospice Care – Data Protection Notice

We are Jersey Hospice Care (Jersey Charity Number AJC 075), a charity that provides specialist palliative care for everyone who requires it, irrespective of cause. We are also a Controller, as defined in the Data Protection (Jersey) Law 2018 (DPJL), in relation to the personal data we process. We take the governance  and security of all personal data in our possession very seriously. This notice  sets out how we do that.

If you have any queries relating to how we approach our compliance duties under the DPJL  then please contact us at our registered address below or alternatively email dataprotectionofficer@jerseyhospicecare.com

Our registered office address is:

Jersey Hospice Care
Mont Cochon
St Helier
Jersey
JE2 3JB

More information about the rights and responsibilities in data protection legislation can be found here www.jerseyoic.org

JHC is committed to processing all personal data in accordance with its responsibilities under the DPJL.

The DPJL requires that personal data shall be:

• Processed fairly, lawfully and transparently
• Collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes
• Limited to what is necessary for the purposes
• Accurate and where necessary up to date
• Kept only for as long as necessary for the purposes
• Processed with appropriate security

As a controller we are accountable for our compliance.

We collect personal data for a number of different specific and lawful purposes as set out below -.

• Patient care - we collect and hold information about patients and next of kin to enable us to give the correct care and treatment and to contact you and your loved ones. The information is held electronically on a system called the Egton Management Information System (EMIS), on paper record or both
• Support for Jersey Hospice Care - we collect and hold information from donors and supporters so that, with their permission, we can inform them of how their support has helped Jersey Hospice Care and the surrounding community
• Website statistics - we automatically collect technical data from visitors to our website (using cookies) to ensure that content from our website is presented in the most effective manner for you and for your computer
• Vistors to Jersey Hospice Care - we collect identifying information, from all visitors to our premises to ensure  safety and security of everyone on site.
• Employees, volunteers and trustees of Jersey Hospice Care – as an employee, we collect and maintain information for the administration of human resources

Lawful purposes

Personal data may only be collected and processed where there is a lawful basis. JHC will collect personal data for a number of purposes as set out above, relying on the following conditions -

• Consent
• Contract
• Vital interests
• Public functions
• Legitimate interests

Where special category personal data are processed for the purposes set out above, JHC rely on the following conditions -

• Consent
• Other legal obligations
• Employment and social fields
• Vital interests
• Non-profit associations
• Public functions
• Medical purposes
• Public Health
• Counselling
• Insurance and pensions

• When our services are accessed by  patients
• When visiting our website to make a donation, sign up to an event or buy one of our products
• When we are  contacted  by any means with queries or complaints
• When information is required for health and safety of our premises . for example, if there is an accident in any of our premises, and we need to complete  an accident form.
• When we are contacted to make a donation, sign up to an event or buy one of our products
• When  applications  for a job are submitted (via website, post or using an agency)When you engage with us on social media
• Our premises are covered by  Closed Circuit Television (CCTV)for  security purposes

Personal data is any information that might allow you to be identified, such as your name, address, date of birth, credit card details, IP address, photo or video image or voice recording. For our patients, some of this data will be sensitive and relate to their health and wellbeing, ethnicity and religious views.

The types of personal data we collect will also be different depending on how you are accessing our services or interacting with Jersey Hospice Care.

For patients – Personal data collected will include

• name
• address and other identifying information
• notes, records and reports relating to their diagnosis as well other aspects of their care and treatment
• the results of investigations such as x-rays and laboratory tests.

Visitors to our website, supporters and financial donors

If you visit our website we may collect your Internet Protocol addresses (also known as IP addresses). This will enable us to understand how users use our website and our services.

If, as a supporter, you wish to sign up to one of our events we will collect your name, address and other contact information such as email address and telephone number.

If you make a donation or purchase a product through our website then your name, address and other contact information such as email address and telephone number will be collected. Your card information will not be held by us. It is collected by our third party payment processors who specialise in the secure online capture and processing of credit/debit card transactions.

If you make a donation over the phone or face to face on one of our premises, your card information is entered directly into a payment terminal by the Jersey Hospice Care staff member you are speaking to. Your payment information will not be held by us and will only be used to process the donation.

When making a donation, either through our website, on the phone or face to face, we will also collect your name, address and contact details so that they can be put into our donation management system (DonorFlex). This will also include any marketing preferences that you have given so that we can be sure that we only use these contact details for the purposes in which you have consented to.

Visitors to Jersey Hospice Care premises

If you visit our premises, your image may be captured on Closed Circuit Television (CCTV), which is in use for security purposes.

When visiting our registered office on Mont Cochon, you will also be asked to provide your name at reception, after which an identification badge will be issued for you to wear whilst on the premises. This is in order to ensure your safety whilst on the premises and that of other visitors and service users.

As with why we collect personal data and what personal data we collect, the use of this information will differ depending on the service you are using or how you are interacting with Jersey Hospice Care.

Personal data for patients will be used to:

• provide appropriate care, by giving the staff caring for them access to up-to-date and accurate information
• share with other health professionals who may be involved in their care
• help staff review and improve the quality of their care
• train and educate staff
• help us when investigating concerns or complaints they may have about their care
• manage and plan future care services
• support palliative care research that has been approved by the local ethics committee
• contact their next of kin

Personal data of visitors to our website, supporters and financial donors will be used to:

• process a donation that you have made
• process orders that you have submitted
• carry out our obligations arising from any contracts entered into by you and us
• deal with entries into a competition or attendance at one of our events
• seek your views or comments on the services we provide
• notify you of changes to our services
• send you communications you have requested and that may be of interest to you. These may include information about campaigns, appeals, other fundraising activities, promotions of our goods and services
• process a job application

Personal data of visitors to Jersey Hospice Care premises may be used:

• to inform the relevant Jersey Hospice Care staff of your arrival if you are visiting patients within our Inpatient Unit or attending an onsite meeting or event
• as part of investigations conducted as a result of damage to Jersey Hospice care equipment or premises or injury to staff, volunteers, services users or visitors. This may include the passing of CCTV images to the police if we are legally required to do so

We take our obligations under the data protection law very seriously and have robust data governance policies and procedures in place These include:

• training and education of staff and volunteers on aspects of Data Protection
• Ensuring access to systems which contain personal data is limited to authorised staff only.
• Ensuringsecure access to all transactional areas of our websites
• Putting in place a wide range of technical security measures to safeguard data.

We will only keep personal data for as long as is necessary for the purpose for which it was collected. This is known as the retention period.

At the end of the retention period your personal data will be deleted.

Any Jersey Hospice Care staff member or representatives, permanent or temporary, who come into contact with your information, must be aware of and adhere to the requirements of the Data Protection (Jersey) Law 2018.

• We will not disclose personal data except where we have a lawful basis for doing so.
• We will not sell or rent  personal data to third parties.
• We will not share personal data  with third parties except where we have a lawful basis for doing so,.

For patients, all electronic information held in relation to their care is maintained on the Egton Management Information System (EMIS). This is a secure, encrypted patient record system and access to it is strictly controlled. Only staff who are authorised to see the personal data and who have a legitimate reason for doing so can access the system. Access to paper records of patient’s personal data is also strictly controlled and accessible to authorised personnel only.

Access to all other personal data is restricted to only authorised members of staff who need access to that information in order to carry out their duties.

In the circumstances where Jersey Hospice Care are required to use personal data we will only do this if:

• the information is necessary for your direct healthcare such as if you are a patient of one of our services
• we have gained consent from you to use your information for a specific purpose or purposes such as direct marketing of our products and services or fundraising events
• to comply with a legal obligation to which Jersey Hospice Care is subject to
• it is necessary to the performance of a contract you have entered into with us
• it is necessary for the legitimate interests of Jersey Hospice Care to process your personal data but our legitimate interests do not outweigh your rights

In order to provide our products and services, we may, occasionally, appoint other organisations to carry out some of the processing activities on our behalf. These may include, for example, technology hosts, event administration, printing companies and mailing houses. In these circumstances, we provide only the information they need to perform their specific services and we will ensure that your personal data is properly protected and processed in compliance with the DPJL..

When you are using our secure online donation pages, your donation is processed by a third-party payment processor who specialises in the secure online capture and processing of credit/debit card transactions. If you have any questions regarding secure transactions, please contact us.

The sharing of personal data is strictly controlled by law. There are circumstances where the sharing of information is valid. These are set out below:

Patients

With their consent information may be shared with:

• other professionals involved in their care
• relatives, partners or friends who act as a carer for them
• Social Services and local authorities
• voluntary sector providers
• regulators

We are sometimes asked for medical reports by solicitors. In these cases, we will always obtain your written consent for us to disclose the information.

Without consent personal data can be shared:

• where there is a risk of harm to you or others
• where we have been instructed to do so by law
• where we believe the reasons for sharing are so important they override our obligation of confidentiality. Such as to support the investigation and prosecution of offenders or to prevent serious crime
• where we are legally required to do so

Visitors to our website or Jersey Hospice Care premises, supporters and financial donors

In order to provide our products and services, we may, occasionally, appoint other organisations to carry out some of the processing activities on our behalf. These may include, for example, technology hosts, event administration, printing companies and mailing houses. In these circumstances, we provide only the information they need to perform their specific services and we will ensure that your personal data is properly protected and that it is only used in accordance with this Privacy Policy.

When you are using our secure online donation pages, your donation is processed by a third party payment processor, who specialises in the secure online capture and processing of credit/debit card transactions. If you have any questions regarding secure transactions, please contact us.

Under the Data Protection (Jersey) Law 2018, you have certain legal rights in relation to how your personal data is processed.

These are:

• Right of Access (We have to tell you if we have your personal data, what it is used for and let you have access if you request it, which is known as a Subject Access Request)
• Right to Rectify (We have to correct your personal data if you request us to)
• Right of Erasure (If we do not have a lawful basis for holding your information, for instance we are relying on your consent and you withdraw that consent, then we have to delete your personal data)
• Right to Restriction (If you want us to stop processing your personal data but do not want it deleting)
• Right of Portability (If you request us to give you your personal data in a common, machine readable format)
• Right to Object (You can object to your personal data being used for direct marketing, including profiling for direct marketing or being processed for scientific / historical research or statistics)

Under the new Data Protection law, you have the Right of Access to the personal data that we have collected and processed about you. This right includes both the right to know if we have collected personal data on you and also the right to see what personal data we have collected.

In most cases, it is likely that we would be able to deal with any requests to see personal data we hold on you in an informal way. For example, if a patient wanted to see a single, specific document or set of notes that had been made about them, this would be fulfilled at the time the request is made.

If a request is made to see lots of different documents or, for example, the information also contains the personal data of another individual, this is likely to be more complex and therefore requires a more formal request. This is known as a Subject Access Request.

If you wish to make a Subject Access Request this should be done in writing, either by post or email and can be sent to either of the following addresses:

Governance Team
Jersey Hospice Care
Mont Cochon
St Helier
Jersey
JE2 3JB

or email dataprotectionofficer@jerseyhospicecare.com

You can also contact us about anything else relating to your personal data.

If an individual considers that their personal data have not been handled correctly, or is unhappy with theresponse to any requests  made to us regarding the use of  personal data, there is  aright to lodge a formal complaint with the Office of Information Commissioner.

They can be contacted  by calling +44 (0)1534 716530 or by visiting their website -   Office of the Information Commissioner’s website (This opens in a new window; please note we are not be responsible for the content of any external websites).