About us Privacy Policy Bluebell Wood Children's Hospice is committed to protecting and respecting your privacy. This policy outlines how we collect, use, and protect personal data relating to babies, children, young people, families who access Bluebell Wood services, fundraising and donations, employees, and volunteers. We adhere to the UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018 (DPA 2018), Privacy and Electronic Communications Regulations (PECR) and the Caldicott Principles. 1. Who We Are For Data Protection Requirements, the data controller is Bluebell Wood Children’s Hospice, Cramfit Road North Anston, Sheffield, South Yorkshire, S25 4AJ. This is also our registered office. Our registered charity number is 1076958. We are registered with the Information Commissioners Officer, and our Registration Number is Z3289382. 2. Definitions Standard Definitions (Taken from the ICOs Website https://ico.org.uk) Controller A person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data Data Protection Officer (DPO) An individual responsible for informing and advising an organisation about its data protection obligations and monitoring compliance Data Subject The identified or identifiable living individual to whom personal data relates. Personal Data Any information relating to a person who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, or online identifier Special Category Data Any personal data that needs more protection because it is sensitive. The ICO defines special category data as: Personal data revealing racial or ethnic origin Personal data revealing political opinions Personal data revealing religious or philosophical beliefs Personal data revealing trade union membership Genetic data Biometric data (where used for identification purposes) Data concerning health Data concerning a person’s sex life Data concerning a person’s sexual orientation Processing Any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, storage, alteration, retrieval, use, disclosure, dissemination, restriction, erasure, or destruction Processor A person, public authority, agency, or other body which processes personal data on behalf of the controller Lawful Basis for Processing Personal Data Consent The individual has given explicit consent for you to process their personal data for a specific purpose. Contract Processing is necessary for a contract you have with the individual or because they have asked you to take specific steps before entering into a contract. Legal Obligation Processing is necessary for compliance with a legal obligation to which the controller is subject. Vital Interests Processing is necessary to protect someone’s life. Public Task Processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. Legitimate Interests Processing is necessary for your or a third party's legitimate interests unless there is a good reason to protect the individual’s personal data that overrides those legitimate interests. Lawful Basis for Processing Sensitive or Special Category Data Explicit consent The individual has given explicit consent to the processing of their special category data for one or more specified purposes. Employment, social security and social protection Processing is necessary for carrying out obligations and exercising specific rights of the controller or data subject in employment, social security, and social protection law. Vital interests Processing is necessary to protect the vital interests of the data subject or another person where the data subject is physically or legally incapable of giving consent. Not-for-profit bodies Processing is carried out during legitimate activities with appropriate safeguards by a foundation, association, or any other not-for-profit body with a political, philosophical, religious, or trade union aim. Made public by the data subject Processing relates to personal data which are manifestly made public by the data subject. Legal claims or judicial acts Processing is necessary for the establishment, exercise, or defence of legal claims or whenever courts are acting in their judicial capacity. Reasons of substantial public interest Processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law. Health or social care Processing is necessary for health or social care purposes, including the management of health or social care systems and services. Public health Processing is necessary for reasons of public interest in the area of public health. Archiving, research and statistics Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes. 3. Data We Collect Children and Families who access Bluebell Wood Children’s Hospice’s services Personal Information Name, address, contact details, date of birth, medical history, treatment plans, and care records. Purpose To provide the best possible care and support, ensuring that medical and personal needs are met. Legal Basis Provision of health and social care, consent, and legitimate interests. Fundraising and Donations Personal Information Name, contact details, donation history, and payment information. Purpose To manage donations, communicate with donors, and comply with legal obligations. Legal Basis Consent, legitimate interests, and legal obligations. Employees Personal Information Name, address, contact details, employment history, performance, sickness, attendance records, payroll, identity and background check information, qualifications, and membership of professional or regulatory bodies, education history, medical information, pension information, Purpose Manage employment relationships, run payroll, and comply with legal obligations. Legal Basis Contractual, legal obligations, and legitimate interests. Volunteers Personal Information Name, address, contact details, bank account details, Bluebell Wood volunteer history, medical information, background and identity checks. Purpose To manage volunteer relationships and ensure the safety and security of our services. Legal Basis Consent, legitimate interests, legal and contractual obligations. Visitors, Contractors and all third parties Personal Information Name, vehicle registration number Purpose For the security and safety of visitors to the hospice. Legal Basis Legitimate Interest CCTV Personal Information Images taken from around the outside of the hospice building and inside the hospice building Purpose To provide safety and security to anyone who visits or uses the hospice Legal Basis legitimate interests Cookies Our website uses cookies and similar technologies to: Remember your preferences and settings Maintain your login session (if applicable) Analyse how you use our website to improve its performance Provide personalised content and recommendations Support functionality of our website Your Control Over Cookies You can manage your cookie preferences through your browser settings or by reviewing the cookies we collect when you first access our website. You may block or delete cookies, but please note that this may affect the functionality of our website. 4. How Long We Keep Your Data for We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, insurance or safeguarding requirements. We review our retention periods regularly to ensure we are not retaining data longer than needed. Children and Families who access Bluebell Wood Children’s Hospice’s services 10 years after death. Or up till the child is 25 OR 8 years after leaving the service, whichever is longest Family members, supported by our bereavement services 15 years following a child's death. Fundraising and Donations 15 years after the last contact Employees 15 years after employment People whose application did not progress to employment: 6 months Volunteers 15 years after volunteering People whose application did not progress to a volunteer role: 6 months 5. How we Share your Data with other processors Children and Families Medical and Care Information Shared with healthcare professionals involved in your child's care, including doctors, nurses, and therapists, to ensure coordinated and comprehensive care. This includes sharing with social care services and key stakeholders, where necessary, in accordance with Working Together to Safeguard Children legislation (2018). Legal Requirements Shared with regulatory bodies or authorities when required by law, such as safeguarding concerns or court orders. Fundraising and Donations’ Donor Information Shared with third-party service providers who assist with processing donations, managing fundraising campaigns, and fulfilling communication requests. These providers are contractually obligated to protect and use your data only for specified purposes. Legal and Compliance Shared with financial institutions and regulatory bodies as required to comply with legal and financial regulations. Employees Employment Records shared with the employee's line manager and senior leadership to support effective management, ensure compliance with legal and regulatory obligations, and enable HR processes such as performance reviews, career development, and workplace wellbeing. It is also shared with payroll processors, pension providers, and HM Revenue and Customs (HMRC) to facilitate accurate payroll management and the administration of employee benefits Occupational Health Shared with occupational health professionals for assessments and health management, with your consent. Training and Development Shared with training providers to facilitate professional development and mandatory training. Information Technology Shared with third-party IT-managed service providers to facilitate IT support, infrastructure management, and security Volunteers Volunteer Information Shared with third-party service providers who manage volunteer programs and background checks. These providers are contractually obligated to protect and use your data only for specified purposes. Safety and Security Shared with relevant authorities if required to ensure the safety and security of our services and those who use them. Digital Identities and Cookies IP Addresses and Device Information Shared with IT service providers to manage and improve our website and online services. This includes analytics providers who help us understand how our website is used and how we can improve it. Cookies Shared with third-party service providers who assist with website functionality, performance, and advertising. These providers are contractually obligated to protect and use your data only for specified purposes. Legal and Regulatory Compliance We may share your data with regulatory bodies, law enforcement agencies, and other authorities when required to comply with legal obligations, protect our rights, or ensure the safety and security of our services and those who use them. Anonymised Data Where possible, we anonymise data before sharing it with third parties to ensure that individuals cannot be identified. This is typically done for research, statistical analysis, and service improvement. Third-Party Service Providers We engage third-party service providers to perform various tasks on our behalf, such as data cleaning, direct mail fulfilment, IT support, data hosting, and secure archiving. These providers are contractually obligated to protect and use your data only for specified purposes. 6. Data Protection Principles We adhere to the following principles under the UK GDPR: Lawfulness, Fairness, and Transparency We process personal data lawfully, fairly, and in a transparent manner. Purpose Limitation We collect data for specified, explicit, and legitimate purposes. Data Minimisation We collect only the necessary data for the purposes for which it is processed. Accuracy We ensure that personal data is accurate and kept up to date. Storage Limitation We retain personal data only for as long as necessary. Integrity and Confidentiality We process data securely to protect against unauthorised or unlawful processing and against accidental loss, destruction, or damage. 7. Your Rights Under the UK GDPR, you have the following rights: Right to be Informed You have the right to be informed about the collection and use of your personal data. Right of Access You can request access to your personal data. Right to Rectification You can request correction of inaccurate or incomplete data. Right to Erasure You can request the deletion of your personal data in certain circumstances. Right to Restrict Processing You can request the restriction of processing your data in certain circumstances. Right to Data Portability You can request the transfer of your data to another organisation. Right to Object You can object to the processing of your data in certain circumstances. For further information about your rights please speak to your contact at the hospice or click on this link https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/ 8. NHS National Data Opt-Out The NHS National Data Opt-Out allows individuals to opt out of their confidential patient information being used for research and planning purposes beyond their individual care. What It Is The National Data Opt-Out applies to the disclosure of confidential patient information for purposes beyond an individual's direct care. Your Choice You have the right to choose whether your confidential patient information is used for research and planning. If you opt-out, your data will still be used to support your individual care. How to Opt-Out You can make or change your choice at any time by visiting the NHS website or using the NHS app. More information can be found on the NHS website under "Your NHS Data Matters" https://www.nhs.uk/your-nhs-data-matters/ 9. Contact Us If you have any questions about this privacy policy or your data, don't hesitate to contact us at: Bluebell Wood Children's Hospice Cramfit Road, North Anston, Sheffield, S25 4AJ Email: [email protected] Phone: 01909 517360 10. Complaints If you have complaints or concerns about this privacy policy or how we handle your data, don't hesitate to contact the Data Protection Officer above. However, if you are unhappy with our response to any data protection issue, you have the right to file a complaint with the Information Commissioner's Office (ICO) at https://ico.org.uk/concerns/. Last updated: April 2026 Manage Cookie Preferences