This policy was last updated on June 2018

Who are we?

We, Strathcarron Hospice a registered charity (number SC006704) are the data controller.

If you have any questions about our privacy notice or data protection, please contact us as follows:

Email: [email protected]

Post: Strathcarron Hospice, Randolph Hill, Denny, FK6 5HJ

Telephone: 01324 826222


Patients, service users and family

This privacy notice applies to you if we collect personal information from you; when you are referred to us, and when you or a family member are using any of our services. It is an open and honest account of how and why we use your information; how we keep it safe; your rights and the choices we offer.

This privacy policy may be updated from time to time. If material changes are made to this Privacy Policy we will notify you by placing a prominent notice in the Hospice, on our website or providing leaflets as appropriate.

We aim to provide you with the highest quality care. To do this, we must keep records about you and the care we provide for you.
Strathcarron Hospice collects, stores and processes personal information about prospective, current and former:

·         patients who have been referred to the hospice for any care service provided by the hospice.

·         family members, carers or friends of patients, where these details have been provided to us for the purposes of providing care.

Patient information we collected and how we collect it

The personal data we process in relation to your care is provided to us by you, by other healthcare professionals who have referred you to us for care and those who are/have been involved previously in providing the individual care. Information includes:
• Personal demographics (including date of birth, healthcare ID number (CHI number), gender, race, ethnicity, sexual orientation, religion)
• Contact details such as names, addresses, telephone numbers, email address and emergency contact(s)
• Medical information including physical or mental health condition, medications, previous treatments and records of care given by other health and social care organisations.

•Any issues about you as patients, relatives and close friends which are related to your wellbeing.

We create records about the care you receive and the services you are provided with whilst you or a family member are involved with us.
Health records are held on paper and electronically and we have a legal duty to keep these confidential, accurate and secure at all times in line with Data Protection Laws.

How do we use your personal information?

We keep your information in full identifiable format to enable us to holistically assess your needs and give the best quality care tailored to you as patients and families.

We use your personal information to compile a detailed clinical record in order to meet our professional and contractual obligations as a health care provider.

We may also use your personal information if you are the family member or friend of a patient who has died in hospice services to send out offers of bereavement support.

Information collected about you to deliver your health care is also used to assist with:
• Making sure your care is coordinated and of a high standard.
• Assessing your condition against a set of criteria to ensure you are receiving the best possible care.
• Using statistical information to plan and evaluate services to meet the needs of the population.

• Contributing to the National Health Service Scotland datasets and the development of NHS datasets.
• Preparing reports and statistics on our performance for NHS commissioners, Healthcare Improvement Scotland and other regulatory bodies.
• Helping train staff and support research.
• Reporting and investigation of complaints, claims and untoward incidents.
• Reporting events to the appropriate authorities when we are required to do so by law.


Where possible this information will be kept in a format which minimises the risk e.g. anonymisation.

Patient information collected during any care process is never collected for direct marketing purposes and is not sold on to any other third parties. Your information is not processed overseas.

Sharing your care information

The Hospice is obliged to share health and social information with other parties such as the National Health Service including National Services for Scotland and their Information Services Division to comply with national reporting and statistical requirements. The Hospice is also be required to share information with Healthcare Improvement Scotland and the Care Inspectorate in order to ensure that the care we provide meets the standards expected of a Scottish healthcare provider.

We share clinical information with other health and social care providers who are also involved in your/ your families care. If we feel it would be beneficial, we will refer you to other members of a care team which might include people from other organisations such as health; social care or education and we ask for your consent to share your information with them. If you do not want us to do this, you have the right to ask us not to and we will discuss with you the implications this may have for your care.
We only share clinical with parties whose professional regulation obligates them to confidentiality. We will not routinely disclose any information about you without your express permission. However, there are circumstances where we must or can share information about you owing to a legal/statutory obligation.

How do we secure your information?

All clinical data remains within the Hospice on our secure password protected databases and servers behind firewalls or stored on external servers by organisations that have the certifications to ensure your information is stored securely. Where we store information on a portable device, the information on those devices will be encrypted to protect against unauthorised access. All Hospice servers, PCs and laptops are protected and monitored by up-to-date anti-virus software. Where clinical information requires to be sent electronically to another health or social care provider it will only be sent using the NHS Mail secure email system.

Clinical data is accessible only to employees, selected volunteers and external consultants who require access to do their jobs and have both a legal duty to keep information about you confidential and receive regular training in data protection and Information Governance.

The Hospice has a Caldicott Guardian who is a senior person responsible for protecting the confidentiality of service users and service users’ information and enabling appropriate and lawful information-sharing

What is the legal basis for processing clinical information?

Data protection legislation requires that we have a legal basis and an additional condition to process your clinical information. Examples of our main processing activities are given below with the associated legal basis.

The lawful basis for creating the clinical record is that processing is necessary for compliance with contractual obligations with the NHS and good documentation is considered a professional responsibility by all health-related professional bodies. This processing is necessary for the provision of treatment, diagnosis and management of health care.

Data shared with NHS and regulatory bodies such as ISD (Information & Statistics Division – part of the National Health Service in Scotland) is processed with the purpose of creating and developing SMR (Scottish Morbidity Records). The lawful basis is that processing is necessary for compliance with contractual obligations. An additional condition is that the production of health statistics is in the public interest in the area of public health and ensuring high standards and quality in health care.

Other lawful bases we use are legitimate interests of the Hospice, consent, contractual obligations and legal obligations.

How can you access, update or delete your personal information?

You have the legal right to ask to see the personal information we hold about you and know exactly how we process it.  All applications to see health records or access clinical information must be made in writing to the Chief Executive.

If you, your family or friends would like to no longer receive any clinical communication from the hospice then please contact Chief Executive.

We will aim to respond within a month.  We will amend any inaccurate information we hold about you. You can also request that we restrict or stop processing your data, keep it for longer than we normally do and possibly even delete your details entirely. These requests are considered on a case by case basis as legal implications require to be balanced with your privacy rights.

Retention periods for the information we hold

Within Strathcarron Hospice we keep personal information as set out in the Scottish Government Records Management: NHS Code of Practice (Scotland) Version 2.1 January 2012.  The NHS Code of Practice sets out minimum retention periods for information, including personal information, held in different types of records including personal health records and administrative records.  As directed by the Scottish Government in the Records Management Code of Practice, each department must maintain a retention schedule detailing the minimum retention period for the information and procedures for the safe disposal of personal information. For clinical information, this can be between 3 to 30 years.

Concerns, complaints and further information

If you have any concerns or complaints about how we are handling your data please do not hesitate to get in touch (see Who Are We? ).  You can also contact the Information Commissioner’s Office and can find information on how to do this at They also provide valuable up to date information about your rights under data protection laws.