This notice to be available on request to all service users and clients of Cancer Connections.
258 Harton Lane
Tyne and Wear
Types of Personal Data we Process (get and use)
The personal data we may request to collect from you is:
Personal details such as
• date of birth
• national insurance number
Medical details such as
• treatment outline
Financial information such as
• Income types
• income amounts
This information will be collected from the subject (you) directly, in person where possible, or by telephone or written communication such as letter or email. You may have given consent to a third party, such as a relative, spouse or medical professional such as your GP or nurse, to pass information to us. You are responsible for the accuracy of the information provided to us.
Lawful Bases for Processing (getting and using) Personal Data
The General Data Protection Regulation sets out six lawful bases for processing personal data. Cancer Connections will request and process your personal data as per:
- The data subject (you) gives their consent
- or if it is necessary:
- Vital interest – where the life of the subject (you) or a third person may be at risk
- For tasks carried out in the public interest or exercise of authority vested in the data controller
- For the purposes of legitimate interests pursued by the data controller
• Where the Data Subject (you) Gives their Consent
When you enter into an agreement to use one of our services, such as complimentary therapy, counselling or welfare benefits advice, you will be asked to provide certain details necessary to provide the service. You will only be asked to provide information necessary to provide the service to you. You consent to the provision and processing of your information by providing it to us; you will usually be asked to sign a document confirming this consent and the accuracy of the information you provide at the time of provision. You have the right to withdraw your consent in writing at any time at which point we will issue a copy of the information, and destroy any records held, within a reasonable timescale.
• Vital Interest
We may be required to process personal information, especially relating to medical conditions, medication, medical devices/implants (such as a pacemaker) or intent to cause serious harm to the data subject (yourself) or another person, where failure to do so would risk the data subject (your) life or the life of a third person – such as where emergency medical treatment is required.
• Public Interest or Exercise of Authority vested in the Data Controller
As part of using our Welfare Benefits Advice service you may be asked to provide in depth information relating to your physical and/or mental health and how this impacts your day to day personal care and mobility. You will only be asked to provide information necessary for supporting your democratic engagement (by helping you to obtain social security benefits you are entitled to).
• Legitimate Interests
As part of using any/all of our services you may be asked to provide in depth information relating to all of the categories listed above, as necessary to provide you with whichever service you are accessing. For example, our complimentary therapists may need to know information about your existing health conditions and medication in order to tailor the services they offer to those that are the most safe and most likely to be effective, or our counsellors or welfare benefits advisors may need to know your religious affiliation so that the service can be delivered to you in a way that is appropriate, sensitive and that you are able to engage with.
You will only be asked to provide information that enables us to provide a service/the services you have requested, and to your benefit. You will be the only person to benefit from the service provided; we do not pass data to a third party unless this is of clear benefit to you and with your knowledge and consent, where the consequences of not doing so would cause some kind of harm to you, e.g. a financial loss resulting from underpayment of benefit because a change in your income was not reported.
How we Process (get and use) your Personal Data
The main purpose in processing (getting and using) your data is to provide you with a tailored service that is as helpful or beneficial to you as can be reasonably provided. Cancer Connections will not pass on your personal data to third parties without first obtaining your consent. Consent to pass on or share data can be given in writing in the following service-specific documents:
- Welfare Benefits Advice service – mandate form and finance sheet
- Counselling service – counselling agreement
- Complimentary therapy service – start of therapy questionnaire and agreement
Information may be provided with your consent to the following third parties, specific to the data subject (you), where it is in your direct best interests to do so (in accordance with the legal bases outlined above):
Medical professionals such as
• Specialist Nurse
• District Nurse
Governmental professionals (Department for Work and Pensions/Her Majesty's Revenue and Customs/Pension Service) such as
• Decision Maker
• Case Manager
• Telephone Advisor
Social professionals such as
• Social Worker
• Support Worker
Where possible we will ensure your personal data is protected by disclosing only the information required to benefit the data subject (you), disclosing only to the professional requesting or requiring it, in writing, via secure email server or confidentially marked mail, with confirmation of receipt. All disclosures and receipts will be recorded. Copies can be requested from the person disclosing (complimentary therapist, counsellor or welfare benefits advisor) in writing, and provided to you within a reasonable timescale.
How Long we will Keep your Data
We will keep data for as long as necessary. Due to the nature of cancer, treatment and follow up, we currently hold data for seven years. At the end of this time period any data not required will be destroyed securely and will therefore no longer be available to the data subject (you) or any other party, including ourselves, as it will no longer exist.
Data Subject Rights
As a data subject (you – a person about whom we hold information) you have the following eight rights regarding your data:
- Right to be informed: we must tell you what data is being collected, how it’s being used, how long it will be kept and whether it will be shared with any third parties.
- Right of access: you have the right to request a copy of the information that an we hold on you.
- Right of rectification: you have the right to correct data that is inaccurate or incomplete.
- Right to be forgotten: in certain circumstances, you can ask for the data we hold on you to be erased from your records.
- Right of portability: you can request that we transfer any data we hold on you to another company.
- Right to restrict processing: you can request that we limit the way we use personal data.
- Right to object: you have the right to challenge certain types of processing.
- Right related to automated decision making including profiling: you are free to request a review of automated processing if you believe the rules aren’t being followed.
You are free to exercise any of the above rights with us (though please note, we do not use automated decision making) in writing, at any time.