Privacy Statement

Easy Read and alternative formats available on request

1. Introduction

Barnsley Hospice collects, stores and processes personal information in order to provide safe, effective care and to deliver its charitable activities. We are committed to protecting personal data and to being open and transparent about how information is used.

This Privacy Notice explains how we collect and use personal information about patients, families, supporters, donors, volunteers, staff, website users and others who interact with the hospice.

2. Data Controller

For the purposes of data protection legislation, the Data Controller is:

Barnsley Hospice
Church Street
Barnsley
South Yorkshire
S75 2RL

Registered Charity Number: 700586

Barnsley Hospice is registered with the Information Commissioner’s Office (ICO)
Registration number: Z6910489

3. Legal Framework

4. Governance and Accountability

Barnsley Hospice has clear governance arrangements to ensure personal information is handled lawfully, securely and ethically.

Senior Information Risk Officer (SIRO)

The Director of Clinical Services & Governance acts as the hospice’s Senior Information Risk Officer (SIRO) and has overall responsibility for information governance and data protection compliance. This includes:

• Ensuring compliance with UK GDPR and data protection legislation
• Managing complex subject access requests and associated complaints
• Advising on and monitoring compliance with data protection principles
• Managing actual or potential legal claims involving personal data
• Ensuring data protection incidents are reported via the Vantage incident reporting system and investigated appropriately
Caldicott Guardian
The Caldicott Guardian provides leadership and guidance on the ethical use of patient information and ensures that:
• Confidential patient information is used legally and ethically
• Information sharing is appropriate and proportionate
• Patient confidentiality is protected in line with the Caldicott Principles

All staff receive regular data protection and information security training. Volunteers receive appropriate training where their role involves handling personal data. Access to personal data is restricted on a need-to-know basis.

5. Contacting Us

If you wish to request further information about this Privacy Notice, exercise your data protection rights or raise a concern, please contact:

📧 enquiries@barnsley-hospice.org
📮 Barnsley Hospice, Church Street, Barnsley, S75 2RL

6. Your Data Protection Rights

Under UK data protection law, including the Data (Use and Access) Act 2025, you have the right to:

• Be informed about how and why your information is used
• Access your personal data
• Have inaccurate or incomplete data corrected
• Request deletion of data where there is no lawful reason to retain it
• Restrict processing
• Request data portability (where applicable)
• Object to certain types of processing
• Not be subject to decisions based solely on automated processing
• Make a statutory complaint if you believe your data protection rights have been breached

Some rights may not apply in all circumstances, particularly where processing is required for legal, safeguarding or clinical reasons.

When responding to Subject Access Requests, Barnsley Hospice will carry out reasonable and proportionate searches in line with legislation and ICO guidance.

7. Lawful Basis for Processing

We process personal data under one or more of the following lawful bases:

• Article 6(1)(e) – task carried out in the public interest
• Article 6(1)(c) – compliance with a legal obligation
• Article 6(1)(b) – performance of a contract
• Article 6(1)(a) – consent
• Article 6(1)(d) – vital interests

Where special category data (including health data) is processed, we rely on:

• Article 9(2)(h) – provision and management of health or social care
• Article 9(2)(c) – vital interests
• Article 9(2)(f) – legal claims
• Article 9(2)(g) – substantial public interest
• Article 9(2)(a) – explicit consent

Barnsley Hospice processes personal information about prospective, current and former patients referred to us for care services. We may also process information about family members, carers or friends where this is necessary to provide care or support.

Information may be provided directly by individuals or by referring healthcare professionals and may include:

• Personal and demographic details
• Contact details and emergency contacts
• Medical and clinical information relevant to care and treatment

Patient records are held securely in paper and electronic formats. We do not use automated decision-making or profiling in relation to patient care.

provided this use does not override the rights and freedoms of the individual.

We rely on legitimate interests for activities such as:

• Communicating with supporters, donors and volunteers about our work
• Fundraising and promotional activities
• Managing relationships with supporters and stakeholders
• Improving and developing our services
• Ensuring the security of our systems and premises
• Preventing fraud and protecting the hospice from misuse
• Administrative and governance purposes

When we rely on legitimate interests, we carry out a Legitimate Interests Assessment (LIA) to ensure that:

• The processing is necessary for a legitimate purpose
• It is proportionate
• It does not override the rights, freedoms or expectations of the individual

You have the right to object to processing that is based on legitimate interests. If you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing is required for legal reasons.

You can exercise this right at any time by contacting us using the details in Section 5.

8. Yorkshire and Humber Shared Care Record

Barnsley Hospice uses the Yorkshire and Humber Shared Care Record to support safe, coordinated patient care.

The Shared Care Record allows authorised health and care professionals to view relevant patient information shared by other NHS and social care organisations.

Barnsley Hospice does not upload or contribute patient data into the Shared Care Record.
Access is view-only, role-based and fully auditable.

The lawful basis for access is:

• UK GDPR Article 6(1)(e) – task in the public interest
• UK GDPR Article 9(2)(h) – provision of health or social care

Patients may opt out of shared care records via the NHS. Opting out does not affect hospice care.

For more information, please see attached.

9. National Data Opt-Out

Barnsley Hospice supports the National Data Opt-Out, which allows patients to choose whether their confidential patient information is used for purposes beyond their individual care, such as research, planning, audit and service evaluation.

Where information is used for these purposes, it will be anonymised or pseudonymised wherever possible.

If a patient has registered a National Data Opt-Out, we will respect this choice unless there is a legal requirement or overriding public interest.

Opting out does not affect the care a patient receives.

Further information is available at:
https://www.nhs.uk/your-nhs-data-matters

10. Supporters, Donors and Fundraising

Barnsley Hospice processes personal information about donors, supporters and event participants in order to manage donations, Gift Aid, fundraising activities and communications.

This may include names, contact details, donation history and payment information. Financial transactions are processed securely by approved third-party payment providers. The hospice does not store card or bank details.

Supporters can update their communication preferences or opt out of marketing at any time.

11. Website, Cookies and Online Services

When you visit our website, we may collect limited information such as IP address, browser type and usage data to help us improve our services.

We use cookies and similar technologies in line with our Cookie Policy, which explains how cookies are used and how you can manage your preferences.

Personal information submitted via the website (for example enquiries or donations) is used only for the stated purpose and is held securely.

Our website may contain links to external sites. Barnsley Hospice is not responsible for the privacy practices of those sites.

12. Children and Young People

Where services are provided to children and young people, personal data is processed in line with data protection legislation, safeguarding requirements and professional guidance.

Where appropriate, rights may be exercised by a person with parental responsibility, unless the child is assessed as having capacity to exercise their own rights.

13. Data Security and Breaches

Barnsley Hospice has appropriate technical and organisational measures in place to protect personal data.

In the event of a personal data breach that is likely to result in a risk to individuals’ rights and freedoms, we will notify the Information Commissioner’s Office and affected individuals in accordance with legal requirements.

14. International Data Transfers

Personal data is not routinely processed outside the United Kingdom.

Where third-party systems involve processing outside the UK, appropriate safeguards will be in place in accordance with UK data protection law and the Data (Use and Access) Act 2025.

15. Data Retention

Personal data is retained in line with the hospice’s Data Retention Schedule and relevant statutory and professional guidance, including the NHS Records Management Code of Practice.

Information is securely archived and destroyed once retention periods expire.

16. Accessibility

An Easy Read version of this Privacy Notice and alternative formats (including large print and accessible digital formats) are available on request.

17. Changes to This Privacy Notice

This Privacy Notice may be updated periodically to reflect changes in law, guidance or organisational practice. The most recent version will always be published on our website.

18. Complaints

If you are unhappy with how your information has been used, you may raise a complaint with:

Senior Information Risk Officer
Barnsley Hospice
Church Street
Barnsley
S75 2RL

You also have the right to complain to the Information Commissioner’s Office at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Last updated: 14 January 2026