Privacy policy

Last updated August 2026

This Privacy Notice includes:

This Privacy Notice includes:

Contents

WHO ARE WE
HOW AND WHY, WE PROCESS YOUR PERSONAL DATA
OUR LAWFUL BASIS FOR PROCESSING YOUR PERSONAL DATA
WHO WE SHARE YOUR PERSONAL DATA WITH
HOW LONG WE KEEP YOUR PERSONAL DATA
HOW WE KEEP YOUR DATA SAFE AND WHO HAS ACCESS TO IT
YOUR RIGHTS
WITHDRAWING CONSENT
CHILDREN’S DATA
USE OF ARTIFICIAL INTELLIGENCE (AI)
HOW TO MAKE A COMPLAINT
CHANGES TO THIS PRIVACY STATEMENT
REVIEW

1. WHO ARE WE

St Catherine’s Hospice (Lancashire) Ltd (SCH) is a charitable company registered in England and Wales with registered company number 01602467 and registered charity number 512186.

We take your privacy very seriously and are committed to protecting your personal information. Please read this notice carefully to understand how we collect, use, and store your personal data.

This privacy statement explains how we, St Catherine’s Hospice (Lancashire) Ltd, and our affiliated trading company St Catherine’s Trading, our lottery company St Catherine’s Promotions and The Mill (St Catherine’s Social Enterprise) may collect and use the information you give us. Herein referred to as SCH.

How to contact us:

If you have any questions regarding our privacy statement, or wish to exercise your data protection rights, please write to the Quality Standards Officer using the contact details below or for patient privacy concerns download our Factsheet ‘How & why, we process your data ’ (see point 2) or please contact the Caldicott Guardian.

Our contact details are St Catherine’s Hospice, Lostock Lane, Lostock Hall, Preston, PR5 5XU or call on: 01772 629171.

2. HOW AND WHY, WE PROCESS YOUR PERSONAL DATA

At St Catherine’s Hospice, we are committed to protecting your personal information and privacy. We aim to comply with all legislation regarding the collection and use of personal data.

Care Services

The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

improving the quality and standards of care provided
research into the development of new treatments
preventing illness and diseases
monitoring safety
planning services

This may only take place when there is a clear legal basis to use this information (see point 3 below).

Research

Most of the time, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information isn’t needed. You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out your confidential patient information will still be used to support your individual care.

To find out more or to register your choice to opt out, please visit National Data Opt-Out – NHS England Digital

Supporters, Donors, Fundraising and Lottery Recruitment

Where we process personal information about donors, supporters and event participants this is in order to manage donations, Gift Aid, fundraising activities and event participation.

This may include names, contact details, donation history and payment information. Financial transactions are processed securely by approved third-party payment providers (e.g. WorldPay, Stripe, Sum Up, Access Paysuite and Paypal). SCH does not store card or bank details.

We use SEC Fundraising to help us identify and engage individuals who may be interested in supporting SCH through our lottery and other fundraising activities. In doing so, we may process personal information such as your name, contact details and information about your engagement with our organisation. SEC Fundraising acts on our behalf and processes personal information only in line with our instructions.

Next of Kin

When a patient passes away in our hospice, we may collect and record information about their next of kin, family members, personal representatives, or other individuals acting on behalf of the deceased. This may include names, relationship to deceased, address, email address and bereavement support requirements.

Below is a list of the different ways in which we may process personal data. For more information about how and why we process data in this way, please click here for our Factsheet: With Who, How & Why we process personal data.

When making a donation or a payment to SCH

a) When making a donation or a payment to SCH

b) When enquiring about our activities or services

c) When we send administrative communications to you

d) When we send marketing communications to you

e) When you visit our websites (About cookies)

f) When you fundraise, take part in an event, or meet with us

g) When you volunteer with us

h) When responding to a complaint

i) Internal audits

j) When responding to a safeguarding concern

k) When we may undertake Supporter Analysis, Profiling (and Wealth Analysis)

l) When we use advertising audiences and audience modelling

m) When we contact Next of Kin

n) When you provide personal data indirectly

o) When you have given other organisations permission to share it

p) When you use social media

q) When we guess business e-mail addresses

r) When we administer legacies

s) When we create promotional material

t) When we process Special Category Data

u) When you apply for a job with SCH

v) When we keep your information accurate and up to date

w) When using CCTV

x) When we record and share an online meeting, event or a lesson that we host

y) When we record a telephone call

z) Who are our named suppliers and processors list

aa) When we may use Automated Decision Making and Profiling

bb) How we treat staff data

cc) What systems we use for Governance, Safety & Compliance

dd) When we undertake Clinical Assessments, Scoring Tools and Triage Processes

3. OUR LAWFUL BASIS FOR PROCESSING YOUR PERSONAL DATA

Data privacy law requires us to have one or more lawful grounds to process your personal information. The following grounds are relevant to our use of your information:

Although in many cases we will seek consent to process your personal data, in some instances we may process your information without consent when we are legally allowed to do so. This will only be where it is in our legitimate interests to do so and where we are confident that such processing is not likely to prejudice your legitimate interests or rights and freedoms.

Where we are processing your personal data on the basis of consent that you have given us, you are entitled to withdraw that consent at any time such that we can no longer rely on it as a basis for continuing to process your personal information.

To protect your vital interests, e.g. to ensure you get urgent medical assistance if needed when taking part in a fundraising event.
Where we have a contractual relationship with you. Though the majority of our relationships are voluntary, if we enter into a contract with you (such as when you purchase something from one of our shops) we will process information to administer that contract.
Legal obligations. We will sometimes pass on personal information to comply with legal obligations such as providing tax and gift aid information to HMRC.
“Legitimate Interests.” Where it is appropriate we rely on the processing being in our legitimate interests, provided we are confident that such processing is not likely to override your own legitimate interests or rights and freedoms. For example, sending you marketing and fundraising post, provided this is done in an unobtrusive manner.

SCH’s legitimate interests are ultimately in pursuit of our charitable objectives, including:

Governance and operational management, such as statutory reporting and intergroup transfers with our trading companies, and employee and volunteer administration and management
Publicity and income generation such as marketing, fundraising, and events.
Sending key administrative communications to keep supporters informed and up to date
Taking and using photos and/or films of event participants and attendees
Recruiting and managing volunteers
Safeguarding
Performing supporter analysis and profiling (and wealth screening) to maximise charitable income and ensure we understand the demography of our supporters and contact them in appropriate ways
Carrying out background research on potential high net-worth donors or business partners

4. WHO WE SHARE YOUR PERSONAL DATA WITH

We share personal data only when it is necessary, proportionate, and lawful to do so. We never sell your personal data to third parties for marketing purposes. We will only share your data in order provide our services to you, in order to enhance our services, or in accordance with a legal obligation. Please see below for more details of the different groups we may share personal data with:

We may share patient data with other healthcare providers with the patient’s consent.
We may sometimes also be legally required to share it with local authorities and our regulators, such as the Information Commission, the Integrated Care Board (ICB), the Charity Commission, the Care Quality Commission (CQC), the Fundraising Regulator, HMRC or Gambling Commission.
SCH may, however, share your information with our trusted partners and suppliers (such as: IT hosting providers, clinical system providers, fundraising platforms, HR and payroll systems, payment processors, website service providers, and professional advisers) who work with us or on our behalf to deliver our services, but processing of this information is always carried out under our instruction. We make sure that they store the data securely, delete it when they no longer need it and never use it for any other purposes. Some examples of where we may share your information are with our fulfilment partners who help to create and send information to you to reduce our costs and with our partners who help us to process donations and claim Gift Aid.
SCH may sometimes use external organisations to process personal data on our behalf – for example suppliers and subcontractors, payment providers, mailing houses and legacy administrators. Before working with these companies, we perform due diligence checks to ensure they provide appropriate safeguards in respect of your personal data and treat it in accordance with the law. We always ensure we have a contract in place with these third-party suppliers, and those contracts include robust data protection requirements.
Where we may rely on Recognised Legitimate Interests (RLIs) under the DUAA such as safeguarding, crime prevention, responding to emergencies, or public task disclosure requests, we will only share the minimum information necessary.
We may occasionally use the services of a supplier based outside the European Economic Area (EEA), which in turn might lead to your personal information being transferred, processed, and stored outside the EEA.

We enter into contracts with these service providers that require them to comply with Data Protection Laws (such as UK GDPR, Data Protection Act, 2018 and the Data (Use & Access) Act 2025) and ensure that they have appropriate controls in place to secure your information.

5. HOW LONG WE KEEP YOUR PERSONAL DATA

We will hold your personal information on our systems for as long as is necessary for the relevant activity, for example we will keep a record of any donations you have made for at least six years.
After such a period, within our database, we anonymise records so we can reference behavioural patterns in our data analytics, but the information is no longer personal to you.
We may however keep certain data for a longer period, such as data in connection to Legacy Gifts or Safeguarding. Legacy income is vital to sustaining SCH’s work. We may keep data you provide to us indefinitely, both to administer legacy gifts and to communicate effectively with the families of people leaving us legacies. This also enables us to identify and analyse the source of legacy income we receive.
If you ask us to stop sending you marketing materials, we will keep a record of your contact details and appropriate information to enable us to comply with your request not to be contacted by us.
Where you contribute material to us, e.g. through user generated content or in response to a particular campaign, we will generally only keep your content for as long as is reasonably required for the purpose(s) for which it was submitted, unless otherwise stated at the point of collection.

6. HOW WE KEEP YOUR DATA SAFE AND WHO HAS ACCESS TO IT

We place great importance on the security of your personal information and will always try to take appropriate precautions to protect it.
We ensure that there are appropriate technical controls in place to protect your personal details. For example, we use encryption technology on our websites and carry out regular security reviews on our network.
We always ensure only authorised personnel have access to your information i.e. SCH staff, volunteers, or contractors and that they are appropriately trained to manage your data.

Despite all of our precautions however, no data transmission over the internet can be guaranteed to be 100% secure. So, while we strive to protect your personal information, we cannot guarantee the security of any information you disclose to us online, and you must understand that you do so at your own risk. However, any payment card details (such as credit or debit cards) we receive through our website are passed securely to our payment processing providers who meet the required Payment Card Industry (PCI) Security Standards. You can find out more information about PCI DSS here.

7. YOUR RIGHTS

Under UK GDPR, individuals have the right to object to the processing of their personal data in certain circumstances:

The right of access: To request a copy of the personal data we process regarding you. Please note that we will seek proof of your identity before proceeding with an access request.
The right to rectification: To have personal information amended if it is inaccurate or incomplete. You can ask us to check the personal data that we hold about you if you are unsure.
The right to erasure: To request the erasure of your personal data. Please note that the right to erasure is not an absolute right, but we will erase your data where we are processing it under the basis of your consent, your information is being unlawfully processed, or it is no longer necessary for us to process it.
The right to data portability. Where we are processing your information on the basis of consent you can request it to be transferred from one service provider to another in a suitable format.
The right to object. You can ask us to stop processing your personal information in certain circumstances, including an absolute right to ask us to stop processing for direct marketing.
The right to restrict processing. If there is any disagreement about the accuracy or legitimate usage of your personal information, you can ask us to “hold” it but not use it further, whilst the issue is resolved.
Right to be informed. We will provide individuals with information including: our purposes for processing their personal data, our retention periods for that personal data, and who it will be shared with. We call this ‘privacy information’. This will be provided at the time we collect personal data from you.
You also have rights in relation to “automated decision making.” SCH does not currently undertake this activity, which involves complex computerised processes which produce legal effects.

If you want to enforce any of these rights in respect to your personal information, please contact St Catherine’s Hospice on 01772 629171.

8. WITHDRAWING CONSENT

Where we are processing your personal data with your consent (e.g. to send you event information via email, post, or telephone call) then please be advised that you can withdraw this at any time.

If you would like to withdraw your consent, then please call us on 01772 629171.

If you do ask us to stop sending marketing communications, please note that we will continue to send you administrative communications as needed, and that we may be unable to stop some marketing communications that you had been selected for prior to you withdrawing consent.

Should you no longer want your healthcare data shared with other health professionals, then you can request to ‘share out’ by contacting a member of our Clinical Team at St Catherine’s Hospice on 01772 629171.

9. CHILDREN’S DATA

Children’s health data – where we collect children’s personal data, we usually require consent from a parent or guardian for children under thirteen and we will make reasonable efforts to verify their identity.

For those aged thirteen and over who may consent for themselves, we will make reasonable efforts to verify they are old enough to do so.

However, if a child under sixteen is assessed as competent, they can give consent, and their wishes can be respected even if their parents disagree. In these situations, we consider the Gillick Competency[1] principles.

[1] Gillick competency is a legal principle in the UK that determines if a child under 16 has the capacity to consent to their own medical treatment without parental permission. To be considered Gillick competent, a child must be mature enough to understand the nature, purpose, risks, and implications of the proposed treatment. SCH use this principle to balance a child’s autonomy with their safety, and it is applied in situations where the child seeks treatment without their parents’ knowledge or against their parents’ wishes.

SCH will protect the child’s information, and staff are trained on the importance of confidentiality.

Safeguarding – In the event of a safeguarding concern, information may be shared with other professionals without consent if there is a concern for a child’s safety or the safety of others, as we have a legal obligation to do so. Refer to the section 10 on ‘When responding to a safeguarding concern’ within the Factsheet.

Supporters – while we do not actively collect information from children (under-16s), we appreciate that our supporters are of all ages. Where appropriate, we will always ask for consent from a parent or guardian to collect information about children.

All SCH events will have clear rules on whether or not children can take part, and the collection of data will be managed in accordance with each individual event, with appropriate safeguards in place.

10. Use of Artificial Intelligence (AI)

We may use an AI system or a service that includes AI functionality.

AI has the potential to make SCH more efficient, effective and innovative and we will implement appropriate measures dependent on the nature, scope, context and purpose of any processing we intend to do using AI to ensure we identify the risks to people’s data protection rights associated with those processing activities.

Where AI is integral to a service we use or a process we follow and that element is outside our control, but necessary to reach our aim to provide care for patients and families across Chorley, Preston and South Ribble who are affected by life-shortening conditions we will adhere to the AI guidance provided by the Information Commissioner who in turn is delivering the UK government’s vision of a pro-innovation approach to AI regulation and more specifically its intention to embed considerations of fairness into AI.

For more information click here: Guidance on AI and data protection | ICO

11. HOW TO MAKE A COMPLAINT

At St Catherine’s Hospice, we take your privacy seriously and aim to handle your personal information in a fair, respectful, and lawful way. If you have any concerns about how your information has been used or managed, we encourage you to let us know so we can put things right.

In the first instance, please call us on 01772 629171 or click here for our ‘leaflet or email us at communications@stcatherines.co.uk

We will listen to your concerns and work with you to resolve any issues promptly and sensitively, recognising the importance of trust and dignity in the care we provide.

If you remain dissatisfied after raising your concern with us, you have the right to lodge a complaint with the UK’s independent supervisory authority:

Information Commissioner’s Office (ICO)
Website: www.ico.org.uk
Helpline: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Making a complaint will not affect the care or support you receive from St Catherine’s Hospice in any way. We are committed to ensuring you feel safe, respected, and confident in how your information is handled at all times.

Please note that you can also register with the following services to stop receiving unsolicited marketing communications from a selected charity or charities:

The Mail Preference Service (MPS), in relation to postal communications.
The Telephone Preference Service (TPS), in relation to phone calls.
The Fundraising Preference Service (FPS), in relation to email, telephone, addressed post and/or text messages.

12. CHANGES TO THIS PRIVACY STATEMENT

This policy may change from time to time. If we make any significant changes to this policy, we will publicise these changes clearly on our website or contact you directly with more information.
This Privacy Policy is regularly updated.
Please revisit this policy each time you consider giving your personal information to SCH.

13. REVIEW

In order to ensure that the Privacy Statement continues to meet SCH’s aims and complies with the objectives, the document(s) will be monitored and reviewed on an annual basis or earlier if there is significant change to relevant law or working practices.