1. Who we are
We work in partnership with St George’s University Hospitals NHS Foundation Trust, City St George’s, University of London and our local community to fund major improvements to hospital facilities, research and medical equipment, schemes that make a real difference to the experience of patients, families and staff, as well as projects within the community that support the reduction of health inequalities and preventable hospital admissions.
Underpinning all our activity is our organisational commitment to deliver better care and healthier lives and our determination to put patients first, be collaborative, to listen, make an impact and be responsive.
St George’s Hospital Charity is registered as a charity in England and Wales (registered charity no. 1171195).
2.Our commitment to privacy
St George’s Hospital Charity is committed to protecting your privacy. This Privacy Policy explains how we collect and use the personal information you provide to us, or which is provided to us by third parties.
3.Changes to the Privacy policy
This Privacy Policy replaces all previous versions and is correct as of October 2025. We will regularly review and update this Privacy Policy and will update its contents at our discretion. Any changes will be notified to you either via e-mail or through an announcement on our website.
This privacy policy tells you what to expect us to do with your personal information.
4.Contact details
Address
St George's Hospital Charity St George’s Hospital Blackshaw Road
London SW17 0QT
Telephone
0208 725 4522
5.What information we collect, use, and why
We may collect or use some of the following personal information for recruitment purposes and EDI monitoring (employees, trustees, volunteers, ambassadors, patrons):
· Contact details (eg name, address, telephone number or personal email address)
· Date of birth
· National Insurance number
· Copies of passports or other photo ID
· Employment history (eg job application, employment references or secondary employment)
· Education history (eg qualifications)
· Right to work information
· Details of any criminal convictions e.g Disclosure Barring Service (DBS) checks
· EDI monitoring information including racial or ethnic origin, sexual orientation and disability information
We collect or use the following personal information for dealing with queries or complaints:
· Contact details (eg name, address, telephone number or personal email address)
We collect or use the following personal information for processing donations:
· Contact details (eg name, address, telephone number or personal email address)
· Payment details (including card or bank information for transfers and direct debits)
· Donation history
· Records of consent, where appropriate
· Date of birth (for F2F fundraising)
We collect or use the following information for signing up to take part in a fundraising event:
· Contact details (eg name, address, telephone number or personal email address)
· Payment details (including card or bank information for transfers and direct debits)
· Fundraising history
· Health information
We collect or use the following personal information for dealing with applications to join the Staff Arts Club or Staff Choir Mailing List
· Contact details (e.g. name, address, telephone number or personal email address)
We collect or use the following personal information for dealing with applications for a grant
· Contact details (eg name, address, telephone number or personal email address)
We collect or use the following personal information for gathering case studies and stories to promote the
charity’s work
· Contact details (e.g. name, address, telephone number or personal email address)
· Photography images and film
· Personal details regarding your experience with the charity/ the Trust
6.How do we use personal information?
We will use your personal information only where there is a clear and legitimate need for us to do so. This may include:
· recording how, when and why you have engaged with us
· processing your donation
· processing your application to volunteer
· supporting your fundraising efforts (e.g. by including Gift Aid claims)
· processing your grant application and/or monitoring the progress of a grant award
· sending you communications about the charity’s work and opportunities for you to support us*
· providing any additional information you have requested and directing you to any relevant services
· investigating and responding to complaints or similar issues.
* We will only send you communications if you have given us clear consent to do so. You may update your communications preferences at any time by visiting our website or contacting us using the details at the top of this Privacy Policy.
Depending on the reasons for your involvement with the charity, we may also contact you where there is a legitimate interest for us to do so.
For example, if you are a volunteer and we need to make you aware of changes affecting you as a volunteer, such as updates to our Volunteering Policy or new training/compliance requirements. Or if you are registered for a fundraising event and we contact you about your participation.
Profiling
Profiling means gathering information about individuals and analysing their characteristics and behaviour patterns to place them in a certain category to help inform the efficiency of the Charity's fundraising activity or to help identify possible new supporters. It’s a procedure that involves processing personal information using a series of statistical deductions to make predictions about people, which makes an inference based on the qualities of others who appear statistically similar to the individual whose personal information is being processed.
How we use profiling
We aim to ensure that our fundraising activity and marketing communications are appropriate and timely. We want to send you the most relevant information and only promote donation opportunities that we believe you are most likely to be interested in.
To do this, we may use your personal information which at times includes previous transactions and communication history, alongside profiling techniques, machine-learning insight companies and media agencies to help us identify other people who may have an interest in supporting our Charity or to provide us with general information about you such as information you have volunteered about your lifestyle and purchasing habits.
You can request to not have your information used in this way.
Donor research
To allow us to fundraise for high value giving opportunities, we undertake research to identify prospective major donors and supporters under our legitimate interests. This research helps us to identify those who have the capacity to make substantial donations, who appear to have an affinity with our cause. We always seek to conduct such processing in an efficient and appropriate manner whilst taking your right to privacy into account. We may also carry out wealth screening using our trusted third-party partners to identify those on our database who may have the capacity to give more. You will always have the right to opt out of this processing. Research is conducted using reliable, publicly accessible data such as press articles, the Charity Commission, and profiles on social media platforms. We only use information that has been intentionally made public.
Ethical Screening
As a charity, it is our responsibility to take appropriate steps to know who our donors are and to comply with money laundering regulations, especially where substantial donations are made. Using charity law as a legal basis for processing, we may undertake due diligence, in line with our Gift Acceptance Policy, to ensure donations and support originate from legitimate sources. Any information we collect for these purposes will be from publicly accessible sources, will only consist of what is necessary for us to meet these requirements, and will be processed in line with your rights.
Photography
The images are used in media (such as newspapers, magazines, websites or broadcast outlets), on social media, in publications, on our website, in printed or online fundraising materials and in fundraising and awareness films.
Patient Case Studies
Photography, images and film created for patient case studies are taken and used with your consent.
We will discuss with you how your, and/or your child’s, image and information is going to be used and ensure you are happy for it to be used in this way. You can withdraw your consent at any time and we’ll always seek renewed consent if the way we use them changes significantly.
Event Photography
Where an event is organised by the Charity, we will ask you for consent to use any photographs taken where you are the focus of the image. Permission will be requested either prior, during or after the event.
Where the photograph does not focus on you as an individual, e.g. where you appear in the background of the photograph or as one of a number of people in a group shot, it is not normally necessary for us to ask your permission. We will ensure the terms and conditions of the event tell you if there will be photographers present.
If you do not want your photograph taken, please either tell the photographer at the time, if it is convenient to do so, or contact the Charity after the event. You can change your mind at any time, and we will refresh your consent on a regular basis.
Where the event is organised by a third party, we will use photography from the event under our legitimate interests. We will be clear in our terms and conditions of entry if this is the case. If you do not want your photograph taken, please either tell the photographer at the time, if it is convenient to do so, or contact the Charity after the event.
At some events there may be photographers present who represent the media or the event organiser and for whom the Charity is not responsible. Please review the terms and conditions issued by the event organiser for more information and inform the event organiser of your preferences and wishes in respect of photography taken.
7.How do we protect personal information?
We are committed to ensuring that the personal information you share with us is secure. To prevent unauthorised access or disclosure of this information, we have put in place appropriate security features and procedures.
We regularly review our procedures to ensure that your personal information is being stored safely and securely. We will never sell, distribute or lease your personal information to any other organisation, unless you have given us clear consent or we are required by law to do so.
However, we may occasionally share your information with trusted service providers who have been authorised to act on our behalf (F2F agency).
Occasionally, volunteers may have the opportunity to complete accredited training/qualifications with us where we will share basic information, including name and date of birth, to an external training body for the purposes of issuing certificates/qualifications.
When required by law, we may disclose your personal information to the police or any other appropriate regulatory authority.
8. Lawful bases and data protection rights
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.
Which lawful basis we rely on may affect your data protection rights which are in brief set out below. You can find
out more about your data protection rights and the exemptions which may apply on the ICO’s website:
· Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. You can read more about this right here.
· Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. You can read more about this right here.
· Your right to erasure - You have the right to ask us to delete your personal information. You can read more about this right here.
· Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information. You can read more about this right here.
· Your right to object to processing - You have the right to object to the processing of your personal data. You can read more about this right here.
· Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. You can read more about this right here.
· Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. You can read more about this right here.
If you make a request, we must respond to you without undue delay and in any event within one month.
To make a data protection rights request, please contact us using the contact details at the top of this Privacy Policy.
Our lawful bases for collecting or using personal information for recruitment purposes (employees, trustees, volunteers, ambassadors, patrons) are:
· Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
· Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
· Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:
· Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
· Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Our lawful bases for collecting or using personal information for fundraising and marketing purposes:
· Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
· Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.
Our lawful bases for collecting or using personal information for signing up to take part in an event are:
· Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
· Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.
Our lawful bases for collecting or using personal information for dealing with applications to join the Staff Arts Club or Staff Choir Mailing List are:
· Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
· Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.
Our lawful bases for collecting or using personal information for applying for grant or becoming a fund adviser
are:
· Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
· Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.
Other lawful bases for collecting or using personal information that may be necessary from time to time are:
· Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.
· Public task – we have to collect or use your information to carry out a task laid down in law. All of your data protection rights may apply, except the right to erasure and the right to portability.
9.How long we keep information
For information on how long we keep personal information, please refer to our Data Retention Schedule available upon request.
10.Who we share information with (data processors)
HR data processors
HR data processors do the following activities for us: They store our HR records in line with our Data Processing Agreement.
Email marketing and automation software platforms
These data processors do the following activities for us: process supporter data by sending emails, manage subscriber lists, and analyse campaign performance.
IT infrastructure and support
St George’s University Hospitals NHS Foundations Trust provides us with the Information Technology (IT) infrastructure and support necessary to enable staff working for the Charity to work efficiently and effectively, including data backup (secondary backup and cloud archive).
11. Sharing information outside the UK
Where necessary, we may transfer personal information outside of the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place.
Organisation name: Mailchimp
Category of recipient: marketing automation
Country the personal information is sent to: USA
How the transfer complies with UK data protection law: We have a data processing addendum which allows them to lawfully process data on our behalf.
For further information or to obtain a copy of the appropriate safeguard for the transfers, please contact us using the contact information provided above.
St George’s Hospital Charity may, from time to time, employ the services of other parties including outsourced service providers for dealing with matters that may include, but are not limited to, payment processing, delivery of purchased items, search engine facilities, advertising and marketing. Data processing agreements will be put in place where outsourced service providers are acting as data processers on behalf of St George’s Hospital Charity.
12. Marketing preferences
With respect to newsletter subscribers and donors, we will provide you with regular opportunities to tell us your marketing preferences, including in our communications to you. To tell us your marketing preferences and to opt out, you can contact us using the contact details provided above.
Receiving email messages and text messages from us: If you no longer want to receive marketing-related emails or text messages from us an ongoing basis, you may opt out of receiving these marketing-related messages by clicking on the link to ‘unsubscribe’ provided in each message or by contacting us using the contact details provided above.
Receiving telephone communications and postal mail from us: If you no longer want to receive mobile messages, telephone communications or postal mail from us on an ongoing basis, you may opt out of receiving these marketing-related communications by contacting us using the contact details provided above.
Our sharing of your Personal Information with selected third-party partners for their marketing purposes: If you have provided your consent we may share your Personal Information on an ongoing basis with our third-party partners for their own marketing purposes. If you change your mind, you may opt out of this sharing on an ongoing basis by contacting us using the contact details provided above.
We aim to comply with your opt-out request within one calendar month. Please note that if you opt out as described above, we will not be able to remove your Personal Information from the databases of third parties with whom we have already shared your Personal Information (ie to those to whom we have already provided your Personal Information as of the date on which we respond to your opt-out request). Please also note that if you do opt out of receiving marketing communications from us, we may still send you other important administrative communications from which you cannot opt out.
13. Website cookies
Cookies are used to gather information on how you use our website.
Cookies are text files, which identify a user’s computer to our server. Cookies in themselves do not identify the individual user, just the computer used. Our website uses persistent cookies – these are used to track returning visitors. They expire after 12 months and enable us to compare website traffic from month to month.
Cookies help us identify which pages are most visited and which events or activities are of most interest. This information can be used to help us improve our website and services and ensure we provide you with the best service. Wherever possible, the information we use for this purpose will be aggregated or anonymised i.e. it will not identify you as an individual visitor to our website.
You can reject cookies. Most browsers allow you to refuse cookies – consult the help section of the browser toolbar. Information on controlling cookies or rejecting cookies is available from several web sites,
14. Website analytics
This website uses Google Analytics tracking codes to measure performance enabling us to enhance and improve services for our audiences. However, we do not collect personally-identifiable information (PII) as all data collected is anonymous. For full details on how Google Analytics works, please visit Google Analytics Terms of Service. If you do not want Google Analytics to use your data, then please visit Google Analytics opt-out browser add-on.
This website also uses Pixel tracking to optimise our advertising, such as the paid advertising campaign with Facebook and Instagram. The website does not collect or send names, email addresses or contact information. The Pixels track data including standard HTTP header info (such as IP address, location) and buttons clicked on the website. This data is used by us to measure the effectiveness of our advertising, and by the advertising companies to serve more relevant ads (known as interest-based advertising).
15. Social Media and Online Platforms
The Charity uses social media and online platforms to communicate with you and share information about campaigns or events. Currently we use platforms such as Meta, LinkedIn, X (formerly Twitter), Instagram and Google. We do this through displaying advertisements on your social media platforms, search engines and their partnered websites when you are browsing the web, as well as posting messages and information on our own
social media pages which you may choose to “like”, “follow” or interact with.
We work with these providers to use tools that they make available to us to advertise to you. These tools enable our communications to appear on news feeds or through your account and this can be known as, for example, “custom audience” or "customer match". We will only do this if you have already consented to us sending you
marketing via email and where we believe the marketing communication may be of interest to you. Where this is the case, your name and e-mail address will be uploaded in an encrypted format to the relevant platform. The platform will then determine if you have an account and, if so, place the marketing so it is visible to you when you are logged in. We may also use the same tool in a slightly different way to ensure you don’t receive unnecessary marketing communications.
We take your privacy and rights seriously but still deem your interest to us important. For this reason, we use our legitimate interest to use your information and communicate with you in this way. Therefore, we will not ask for your permission to market to you through social media or online platforms where you have already consented to receiving marketing by email, but you are always free to inform us that you do not want us to contact you in in this way. Please see the Changing Marketing Preferences section above.
You can also update your preferences within the social media site to stop receiving marketing. For further information on Meta in particular, please see their terms of service and their data policy.
16. Use of email products for bulk mailing
We also use products for sending emails to large numbers of people and can identify from this product whether the email has been opened, and whether links within the email have been clicked. This enables us to determine whether our emails are of interest to the recipient.
17. Changes to this Privacy Policy
We review this Privacy Policy regularly and reserve the right to make changes at any time to take account of changes in our business and legal requirements. We will place updates on our website.
18. How to complain
If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this Privacy Policy.
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to
the ICO.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House Water Lane Wilmslow Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint
This website has been designed and built by Made Simple Media.