Privacy notice for supported individuals
What is the purpose of this document?
Royal Voluntary Service is a registered charity (registered number 1015988), whose registered office is at Beck Court, Cardiff Gate Business Park, Cardiff CF23 8RP.
Royal Voluntary Service has been appointed by NHS England to run the NHS Volunteer Responder Scheme. The main objective of the NHS Volunteer Responder Scheme is to ensure that, during the coronavirus crisis, individuals in England who are having to self isolate, are able to obtain certain types of support from a network of volunteers overseen by Royal Voluntary Service.
This document is directed at any individual who is eligible and applies for support under the NHS Volunteer Responder Scheme. Its purpose is to provide important information to such individuals about the use of their personal data by Royal Voluntary Service and about their rights under UK data protection law. Royal Voluntary Service needs to provide this information to individuals who are eligible and apply for support under the NHS Volunteer Responder Scheme because it is categorised as a controller of their personal data under UK data protection law.
In this document, for convenience we use a number of defined terms. In this section, we explain what those terms mean:
|‘GoodSAM’ and ‘GoodSAM Responder App’
||see the definitions set out in the section ‘Who will we share your personal data with?’
||any information about an identified or identifiable living individual
||the NHS Volunteer Responder Scheme, which Royal Voluntary Service has been appointed to run on behalf of NHSE
|Third Party Referrer
||see the definition set out in the section ‘How will we obtain your personal data?’
|‘Us’, ‘We’ or ‘Our’
||alternative terms we use to refer to Royal Voluntary Service
|‘You’ or ‘Your’
||an individual who has been referred into or who self refers into the Scheme
How will we obtain your personal data?
If you self-refer into the Scheme (whether by telephone or using an online form), you will be asked to provide certain personal data to us (see ‘What personal data will we use?’ below). The same applies if you ask a friend or family member to refer you into the Scheme on your behalf.
Third Party Referrals
Alternatively, you may be referred into the Scheme by a health professional, local authority care provider, charitable organisation or other organisation approved by NHSE and Royal Voluntary Service (a ‘Third Party Referrer’) as someone who is likely to benefit from the Scheme. This will involve the Third Party Referrer either filling out an online form, making a telephone referral or sharing your details with us in another way. In each case, the Third Party Referrer will be required to provide us with certain personal data about you (again, see ‘What personal data will we use?’ below). Before approving a request from a Third Party Referrer, we ask the Third Party Referrer to confirm that they have your permission to make the referral on your behalf and to share your personal data with us.
We may also receive personal data about you as a result of:
- Calls you make to our call centre or other communications with us (for example, to raise a query, notify us of an issue or problem or make a complaint);
- Ad hoc conversations or other communications we have relating to you with our volunteers, Third Party Referrers, family members or other individuals or organisations (for example, if one of our volunteers raises a concern with us about your welfare or needs to report an issue or problem you have raised).
Use of our NHS Volunteer Responders Website
We will also collect certain personal data about you if you browse our NHS Volunteer Responders website. More information about this can be found in our NHS Volunteer Responders Privacy Notice.
What personal data will we use?
If you self-refer into the Scheme or a Third Party Referrer makes a referral on your behalf, we will ask for the following information about you:
- Your full name;
- Your address;
- Your date of birth;
- Your email address;
- Your telephone number;
- Details of the category of support you require;
- Details of how urgently and how frequently you require support;
- The name, contact details and email address of your GP. Note: This information will not be required if you are eligible for support because you are a health or care worker; and
- Confirmation of whether you have a cognitive impairment or other significant vulnerability (we need this information to ensure that any volunteer we assign to you has the required level of DBS check).
In addition, we may also collect the following types of personal data about you:
- If you self-refer into the Scheme, you will be asked whether you have received a letter from NHSE telling you to self-isolate. If you indicate that you have not received such a letter, you will be asked to confirm which other category of eligible individuals you belong to (for example, whether you are over 70 years of age with underlying health conditions, are pregnant or registered as disabled or are a health or care worker);
- If you self-refer into the Scheme, we will ask you to choose the language in which you would like to receive certain communications from us;
- We record telephone calls for training and monitoring purposes. As a result, it is possible that we will receive additional personal data about you as a result of information provided to us during telephone calls (whether such calls are made by you, a Third Party Referrer or other person). Such data may include information about your health or welfare;
- If you or someone else raises a safeguarding concern, we will need to obtain, use and store information relating to that concern. This may include sensitive information about your health or welfare; and
- If we are asked to provide you with Community Support (i.e. help with essential shopping or the collection of prescriptions), we will ask you or the relevant Third Party Referrer to confirm whether you have a current diagnosis of COVID-19 or are currently required to self-isolate because you are suspected as having COVID-19 or have recently been in contact with someone who has been diagnosed with COVID-19. We require this confirmation to ensure the safety of our volunteers (see further ‘How will we use your personal data?’ below).
If you are provided with support by an NHS Volunteer Responder, we will also keep a record of the type and frequency of the support provided to you.
How will we use your personal data?
Royal Voluntary Service will use your personal data for the following reasons:
- To make initial contact with you by letter to provide you with information about the Scheme (including information to ensure your safety and details about the categories of support available to you);
- To provide you with the volunteer support you require from time to time. Further details about what this will involve can be found in the section ‘Who will we share your personal data with?’ below;
- If you or a Third Party Referrer confirms that you have a cognitive impairment or other significant vulnerability, to ensure that the volunteer assigned to you has the required level of DBS clearance;
- If you or a Third Party Referrer confirms that you have a current diagnosis of COVID-19 or that you are currently required to self-isolate because you are suspected as having COVID-19 or have recently been in contact with someone who has been diagnosed with COVID-19, so that we can provide this information to a volunteer who accepts your request for Community Support and give them the option to cancel their acceptance of the request should they wish to do so. We need to do this because any face to face interaction with a person who has or may have COVID-19 could expose a volunteer to a risk of infection. If a volunteer chooses to cancel a request which they have previously accepted, the request will be re-submitted into our volunteering system so that it can be picked up by another NHS Volunteer Responder. Note: We will cease to provide such information in relation to any request for the provision of Community Support to you, once a period of 3 weeks has elapsed from the date on which we are informed that you have or may have COVID-19;
- To investigate and deal with any problems, complaints, concerns (including safeguarding concerns), grievances or other issues raised by you, our volunteers, Third Party Referrers or other individuals or organisations;
- To keep records for the purpose of enabling us to manage and administer the Scheme, including a record of the support requested and provided; and
- Recordings of telephone conversations will be used for training and monitoring purposes.
Circumstances where we are unable to provide support
In certain circumstances, we may be unable to provide you with the support you require or to continue to support you under the Scheme. There may be a number of different reasons for this including: (i) the support requested may be outside the categories of support we are able to offer under the Scheme; and (ii) our volunteers may be unable to meet your needs. Alternatively, you may change your mind about wanting to receive support under the Scheme.
In such a situation, we will need to ensure that the volunteering system we use to run the Scheme recognises you as an individual we are unable to support or who no longer wishes to be supported (so that we do not subsequently process requests for support relating to you). To do this, we will keep a record of your name, your address, your date of birth, your telephone number and the reason we are unable to support you/continue to support you. We may also use your date of birth and/or telephone number to create alerts on our volunteering system for this purpose.
Provision of statistics to NHSE
We will use the information we obtain about you relating to your use of the Scheme to compile anonymous statistics about the Scheme. We will include those statistics in reports which we and NHSE will use to make decisions about the running of the Scheme. Such reports may be shared with other third parties, such as government departments and local authorities. Your personal data will not be included in and you will not be identifiable from any such reports.
In particular, if you self-refer into the Scheme, we will use the information you provide to us regarding the category of eligible individuals you belong to compile statistics which NHSE will use to evaluate the success of the Scheme and to identify any categories of the population who may not be receiving appropriate levels of support.
Who will we share your personal data with?
GoodSAM and NHS Volunteer Responders
So that we can provide you with the volunteer support you require, we will need to input your personal data into a software platform made available to us by an organisation known as GoodSAM Limited (‘GoodSAM’). That platform will interface with an App also run by GoodSAM (known as the ‘GoodSAM Responder App’). We will notify our network of volunteers of requests for volunteer support via the GoodSAM Responder App. In turn, our network of volunteers will be able to access and accept requests for support via the GoodSAM Responder App.
This means that we will need to share the personal data we obtain about you with both GoodSAM and our network of volunteers. However, we have put the following measures in place to ensure the safety and security of your personal data:
- We have a contract with GoodSAM which requires GoodSAM to ensure the security of your personal data and only to use it in accordance with our instructions;
- We identity check our volunteers and some of our volunteers are also required to provide copies of clear DBS checks;
- We require our volunteers to act in accordance with strict guidelines we provide to them and to keep your personal data confidential;
- Notifications relating to the Scheme are only accessible on the GoodSAM App by our network of approved volunteers;
- We limit the information we make available to our volunteers via the GoodSAM App as follows:
- If you request our ‘check in and chat’ or our ‘check in and chat+’ service, the volunteer who accepts the request for support will only receive your full name and telephone number;
- If you request Community Support (i.e. help with essential shopping or the collection of prescriptions), the volunteer who accepts the request will receive your name, address, telephone number and details of the support required. In addition, if we have received confirmation that you have a current diagnosis of COVID-19 or that you are currently required to self-isolate because you are suspected as having COVID-19 or have recently been in contact with someone who has been diagnosed with COVID-19, as stated above, our volunteers will also be provided with that information (so that they have the option to cancel their acceptance of the request for support should they wish to do so);
- If you request any other category of support, the volunteer will receive your name, address, telephone number and details of the category of support required;
- The personal data referred to above will only be made available to an NHS Volunteer Responder once they have accepted a request; and
- If any request is accepted but subsequently cancelled 3 times, our volunteering system will provide us with an alert, and we will remove your request from the system and notify you or the relevant Third Party Referrer that we are unable to provide the support requested.
We will also need to share your personal data with certain trusted organisations who are providing essential services to us in relation to the Scheme. This includes Ventrica Limited (the organisation which operates our NHS Volunteer Responder call centre and provides assistance to us with safeguarding matters) and The Woods Group Limited (the organisation which handles mailing on our behalf). We have agreements with these organisations to ensure that your personal data will be safe and only used in accordance with our instructions.
In the event that a safeguarding concern arises (for example, if an NHS Volunteer Responder or Third Party Referrer raises an issue with us about your safety or physical or emotional welfare or you make an allegation about the conduct of an NHS Volunteer Responder), the matter will be referred to our Safeguarding Team for further investigation. As part of any such investigation, it is possible that we will need to share your personal data with other organisations or bodies (for example, your GP, social services or the police). In doing so, we would rely on certain rights which exist under data protection law which permit us to disclose personal data for safeguarding purposes or to prevent the commission of unlawful acts.
As stated above (see ‘How will we use your personal data?’), we will also share anonymous statistics relating to the Scheme with NHSE and other trusted organisations.
If you would have difficulty accessing support under the Scheme because your first language is not English, we will follow a different procedure to try to ensure you receive the help you need. This will mean that the personal data we collect from you and the ways in which we will use that personal data will be different from that described above.
Our support for individuals whose first language is not English will work in the following way:
- If you telephone us for support and it is clear that you need the assistance of a translator, we will ask you for your name and first language. We will then connect the call to one of our partner organisations which provides us with translator services to obtain the assistance of a suitable translator to help us converse with you. The translators we use are subject to confidentiality obligations and understand their obligations under data protection law.
- Once the translator is on the call, we will obtain from you information that we need to try to arrange for alternative support to be provided to you by a charitable or volunteer organisation in your area and which is able to support you in your first language. Details of the personal data and other information we will collect from you during this call are set out below.
- Once we have obtained the personal data/information we need from you, we will contact organisations in your area which may be able to provide you with the support you require. During any calls with such organisations, we will describe the nature/frequency/urgency of the support you have requested but we will not provide them with any personal data about you.
- If we are able to identify a charity or other volunteer organisation which is able to support you, we and our translator will telephone you to find out whether you are happy to contact the organisation in question yourself or whether you would like us to make contact with them on your behalf. If you ask us to make contact with the organisation on your behalf, we will ask you for your consent to share with the organisation in question the information we previously obtained from you.
- If we are unable to identify a charity or other volunteer organisation which is able to support you, we and our translator will telephone you to explain that this is the case. As an alternative, we will ask you if you would like to submit a request for Community Support under the Scheme. If you agree to this, we will make a direct referral into the Scheme on your behalf, which will involve us obtaining additional personal data from you (see the section ‘what personal data will we use’) and use of your personal data in the manner and for the purposes generally necessary in relation to the Scheme (as set out in the above sections). We will do our best to match you with a volunteer who speaks the same language as you.
If you do not want us to make a referral into the Scheme on your behalf, we will only retain such of your personal data as we need for our internal administration purposes and for safeguarding purposes (see the section below ‘How long will we keep your personal data?’).
Personal data we will obtain from you via our translator
The information we will obtain from you via our translator when we telephone you will be as follows:
- Your Name
- Your Address
- Your phone number (mobile or landline)
- Your email address
- The nature of the support you require
- How frequently you require support
- How urgently you require support
How long will we keep your personal data?
Our general policy
Our general policy is that we will retain the personal data we collect about you as a result of running the Scheme for the duration of the Scheme plus a further period of 6 months after the Scheme has come to an end. It is currently anticipated that the Scheme will run for a period of 6 months from the start of April 2020. However, it is possible that NHSE may extend the duration of the Scheme. If it does, we will review our general retention policy at this stage and assess whether any of your personal data can be deleted at this earlier time.
Our general policy referred to above is subject to the following exceptions:
- Where we have to reject a request to support you under the Scheme because we are unable to provide you with the support you require, we will delete your personal data from our records, other than the details referred to in the section ‘Circumstances where we are unable to provide support’ above;
- If a safeguarding concern arises, we will retain such of your personal data as is necessary to enable us to investigate and deal with the issue properly. Once the concern has been fully dealt with, we will continue to retain the personal data in question for a period of 8 years. This is in line with best practice for adult social care records (as set out in The Records Management Code of Practice for Health and Social Care 2016). After that 8 year period has expired, we will delete the relevant records, provided they are no longer required for the purposes of the safeguarding concern;
- We may need to hold on to your personal data for the purposes of dealing with complaints, grievances, claims or investigations which involve you or for other similar legal reasons. In this situation, we will retain your personal data until the relevant matter is completely resolved;
- Telephone calls which are recorded for training and monitoring purposes are retained for a period of 6 months; and
- We will retain information relating to the Scheme for archiving purposes in the public interest and/or historical research purposes. Such information may include personal data relating to you (which will mean that your personal data may be held by us for longer periods). Any archiving of information by us will be undertaken in accordance with the National Archives Guide to Archiving Personal Data 2018.
Delays in availability of support
Please note that we may be unable to match your request for support with a suitable volunteer straightaway. This is particularly likely to happen if we receive confirmation that you have a cognitive impairment or other significant vulnerability, because we will need to match you with a volunteer in your area who has the necessary level of DBS clearance. If this is the case, we will hold your personal data within our system until a suitable volunteer becomes available (unless you contact us in the meantime to inform us that you no longer require the support, in which case we will delete your personal data).
If it subsequently becomes apparent to us that we are going to be unable to provide you with the support you require, we will notify you or the relevant Third Party Referrer that your application for support has had to be rejected. In this situation, we will only retain the personal data referred to in the section above ‘Circumstances where we are unable to provide support’.
Once it is no longer necessary for us to retain your personal data, we will ensure that it is securely deleted or fully anonymised.
How is our use of your personal data lawful?
Under data protection law, an organisation must only use personal data if it has a lawful reason for doing so. In relation to the Scheme, the lawful reason we will be relying upon is that use of your personal data is necessary for the purposes of both your and our legitimate interests (since you have a legitimate interest in receiving the support you need and we have a legitimate interest in providing that support). This will be our lawful reason for using your personal data both where you are referred into the Scheme by a Third Party Referrer or if you self-refer.
Also, where you are referred into the Scheme by a Third Party Referrer who is a health professional, your personal data will be shared with us by NHSE under the ‘Patient Pathway’. This permits NHSE to share your personal data with organisations involved in providing you with the care and support you need.
In relation to recordings we make of telephone conversations, again, we will rely upon our legitimate interests as our lawful reason for use. This is on the basis that we need to ensure that our call centre staff deal with calls appropriately and in accordance with our instructions and so that we can identify any training requirements.
An organisation can only use certain categories of personal data (known as ‘special category personal data’) if it can satisfy one or more conditions under data protection law. Special category personal data includes information relating to a person’s health.
We may be processing your special category personal data when providing you with support under the Scheme since:
- If you self refer into the Scheme and confirm that you have not received a letter asking you to self-isolate, you will be asked to provide information about the basis on which you are eligible for support under the Scheme (for example, whether you are pregnant or registered as disabled);
- You/Third Party Referrers will be asked to confirm whether you have a cognitive impairment or other significant vulnerability;
- Where a request is made for Community Support (i.e. help with essential shopping or the collection of prescriptions), you or the relevant Third Party Referrer will be asked to confirm if you currently have a diagnosis of COVID-19 or are currently required to self-isolate because you are suspected as having COVID-19 or have been in contact with someone who has a diagnosis of COVID-19;
- It is possible that the recording of telephone conversations for training and monitoring purposes, will result in the processing by us of additional information about your health or wellbeing; and
- We may receive information about your health or wellbeing if a safeguarding issue arises.
This means that we also need to satisfy one or more conditions for using your special category personal data. The conditions we will rely upon are:
- Your explicit consent: If you self-refer into the Scheme, we will generally rely upon this condition to process any special category personal data which you provide to us;
- Substantial public interest (preventing unlawful acts/safeguarding): We will rely upon these conditions where we need to process special category personal data about you in connection with a safeguarding concern. The relevant conditions are set out in Paragraph 10 and Paragraph 18 of Part 2 of Schedule 1 of the Data Protection Act 2018;
- Substantial public interest (safeguarding): We will rely on this condition where you are referred into the Scheme by a Third Party Referrer and we need to process special category personal data about you to ensure that you are supported by a volunteer with an appropriate level of DBS clearance. The relevant condition is set out in Paragraph 18 of Part 2 of Schedule 1 of the Data Protection Act 2018;
- Employment and social protection: We will rely on this condition where we need to process information about a diagnosis of or suspected or possible COVID-19 to ensure the safety and wellbeing of our volunteers. The relevant condition is set out in Paragraph 1 of Part 1 of Schedule 1 of the Data Protection Act 2018.
Where do we store your personal data?
Your information will be securely stored within the UK on the GoodSAM software platform.
What data protection rights do you have?
Under data protection law, you have a number of different rights which you can exercise free of charge. These are described in the table below. Some of the rights only apply in certain circumstances and not all of the rights will be relevant in relation to our use of your personal data:
||The right to be provided with a copy of your personal data (the right of access)
||The right to require any mistakes in your personal data to be corrected
|To be forgotten
||The right, in certain circumstances, to require that your personal data is deleted
|Restriction of processing
||The right, in certain circumstances, to require use of your personal data to be restricted (for example, if you contest the accuracy of the data)
||The right, in certain circumstances, to receive your personal data in a structured, commonly used and machine-readable format and/or transmit that data to a third party
||The right to object to your personal data being processed for direct marketing (including profiling) and the right, in certain circumstances, to object to the continued processing of your personal data on the basis of legitimate interests
|Not to be subject to automated individual decision making
||The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you
For further information on each of these rights, including the circumstances in which they apply, please contact us or see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights under the General Data Protection Regulation.
If you would like to exercise any of your rights, please email, call or write to our Data Protection Officer (email: firstname.lastname@example.org, telephone: 029 2073 9184 postal address: Data Protection Officer at Beck Court, Cardiff Gate Business Park, Cardiff, CF23 8RP). Please note that we will ask you to:
- Let us have enough information to identify you;
- Provide us with proof of your identity and address (e.g. a copy of your driving licence or passport); and
- Let us know what right you want to exercise and the information to which your request relates.
Who should you contact if you have any queries?
If you have any queries about our use of your personal data, please contact our Data Protection Officer at email@example.com , telephone 029 2073 9184 or write to our Data Protection Officer at Beck Court, Cardiff Gate Business Park, Cardiff, CF23 8RP.
What if you have a complaint?
If you have any concerns about our use of your personal data, you can make a complaint to us by emailing firstname.lastname@example.org, telephoning 029 2073 9184 or writing to our Data Protection Officer at Beck Court, Cardiff Gate Business Park, Cardiff, CF23 8RP.
If we are unable to resolve your concerns to your satisfaction, you can make a complaint to the Information Commissioner’s Office (‘ICO’).
The ICO’s address is: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Alternatively, you can telephone the ICO’s helpline number (0303 123 1113) or make a complaint via the ICO website (ico.org.uk).
Changes to this privacy information document
This document was first published on 4 April 2020.
This version of our privacy notice was published on 5 August 2020.
We will make any updated versions of our privacy notice available on our NHS Volunteer Responders website.