Get in Touch

Privacy Policy

Introduction

Protecting your personal information is extremely important to St. Saviour’s Medical Charity (“the Charity”, “we”, “us”, “our”). Our applicants trust us with sensitive information about their health and their finances, and we take that trust seriously.

This policy explains what personal information we collect, why we collect it, how we use and protect it, who we share it with, how long we keep it, and the rights you have. It reflects UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), as amended by the Data (Use and Access) Act 2025.

Please take a few minutes to read it, and share it with anyone else connected to your application (for example, a family member or carer who is helping you apply).

Who we are

St. Saviour’s Medical Charity is the “controller” of your personal information. This means we decide how and why it is used and we are responsible for looking after it.

We provide grants for private healthcare to people in need who live in the Folkestone & Hythe Local Authority area.

What we mean by personal information

Personal information is any information about a living person that identifies them, or could identify them, such as a name, address, email address, telephone number or financial details. Some personal information is more sensitive and is given extra protection by law. This is called “special category” data and includes information about your health.

What information we collect

Depending on how you deal with us, we may collect and use:

  • Contact details: your name, address, telephone number and email address.
  • Personal details: your date of birth or age, sex, and details of your household and family circumstances.
  • Financial details: information about your income, savings, benefits and outgoings, which we need to assess whether you are eligible for a grant, and bank details where we need to make or process a payment.
  • Health information (special category data): your medical history, current condition, proposed treatment, and reports or letters from your GP, consultant or hospital.
  • Application history: records of your application, our assessment and decision, any grant awarded, and our correspondence with you.
  • Details of other people: if someone applies or contacts us on your behalf, their name, contact details and relationship to you.

Where we get your information from

  • Directly from you – when you complete our application form, or contact us by phone, email, post, in person or through our Facebook page.
  • From healthcare professionals – with your agreement, from your GP, consultant or hospital, to confirm your condition and the treatment you need.
  • From people acting on your behalf – such as a family member, carer or support worker helping with your application.
  • From our website – see “Our website and cookies” below.

How and why we use your information

We use your personal information to:

  • assess your application and decide whether we can offer a grant;
  • contact you about your application, including arranging a visit from one of our Trustees;
  • liaise with your GP, consultant or hospital about your treatment;
  • arrange and make payments for treatment that we have agreed to fund;
  • respond to your enquiries and requests;
  • keep proper records, manage our finances, and meet our governance, audit and reporting duties as a registered charity;
  • meet our legal and regulatory obligations;
  • protect the safety and wellbeing of applicants, particularly where someone may be vulnerable; and
  • produce anonymised statistics (for example, the number of grants made each year) which do not identify anyone.

We will never sell your information or share it with anyone for marketing purposes.

Our lawful bases for using your information

Data protection law requires us to have a valid reason (a “lawful basis”) for every use of your personal information. We rely on the following:

  • Processing your application (contract / steps before a contract): to assess your application and, if successful, to provide the grant.
  • Legal obligation: where we must use or keep information to comply with the law, for example charity, tax and accounting rules.
  • Legitimate interests: to run the Charity properly and efficiently, including record-keeping, governance, audit and handling enquiries. We only rely on this where our interests are not outweighed by your rights and interests.
  • Recognised legitimate interests: in limited situations set out in law, such as safeguarding a vulnerable person, responding to an emergency, preventing or detecting crime, or responding to a lawful request from a public body, we may use or share information where this is necessary, without needing to carry out a separate balancing test.
  • Vital interests: in the rare event that we need to share information to protect someone’s life.

Health information (special category data): we will only use your health information, and obtain information from your GP, consultant or hospital, with your explicit consent, which we ask for on our application form. We use it solely to assess and process your application and to arrange your treatment. In an emergency, or where there is a safeguarding concern, we may also rely on the conditions that allow sensitive information to be used to protect someone’s vital interests or to safeguard individuals at risk.

You can withdraw your consent at any time by contacting us. This will not affect anything we have already done with your information, but without it we may not be able to continue processing your application.

Please note: the information we ask for is needed to assess your application. If you do not provide it, we may not be able to consider your application.

Automated decision-making

We do not make decisions about you using solely automated means. Every application is considered by people – our staff and Trustees.

Who we share your information with

We only share your information where necessary, and only with:

  • Our Trustees – a nominated Trustee will hold your information while your application is being processed, including for any home visit. Once their visit is complete, they will securely delete it and your information will be held only at the Charity office.
  • Healthcare professionals involved in your treatment – such as your GP, consultant or hospital.
  • Service providers who support us – such as our IT, email and website hosting providers, who act on our instructions and are required to keep your information secure and confidential.
  • Our professional advisers and auditors – where necessary for the proper running of the Charity.
  • Regulators, government bodies and law enforcement – such as HMRC, the Charity Commission or the police, where we are required or permitted by law to do so.

We will never share your information with anyone for their own marketing.

Transfers outside the UK

We aim to keep your information within the UK. Some of our service providers (for example, email or website services) may store or process information outside the UK. Where this happens, we make sure the transfer is lawful and that your information receives a level of protection that is not materially lower than it would receive in the UK – for example, by transferring only to countries the UK government has approved, or by using approved contractual safeguards.

How we keep your information secure

We take appropriate technical and organisational measures to protect your information from loss, misuse and unauthorised access. Access is limited to the staff and Trustees who need it. Paper records are kept securely at the Charity office and electronic records are protected by passwords and other security controls.

How long we keep your information

We only keep your information for as long as we need it:

  • Unsuccessful applications: deleted three months after our decision.
  • Successful applications: normally kept for five years after the grant is completed, to meet our financial, audit and legal obligations.

We will only keep information for longer where there is a clear, lawful reason to do so. When it is no longer needed, we securely delete or destroy it.

Your rights

You have the following rights over your personal information:

  • Right to be informed – about how we use your information (which is what this policy is for).
  • Right of access – to ask for a copy of the information we hold about you.
  • Right to rectification – to ask us to correct information that is inaccurate or incomplete.
  • Right to erasure – to ask us to delete your information where we no longer need it, where you withdraw consent, or where you object and there is no overriding reason for us to keep it.
  • Right to restrict processing – to ask us to limit how we use your information, for example while we check its accuracy.
  • Right to object – to our use of your information where we rely on legitimate interests.
  • Right to data portability – to receive information you have given us in a structured, commonly used, machine-readable format, or ask us to send it to another organisation.
  • Right to withdraw consent – at any time, where we rely on your consent.

You can make a request by email, by phone or in writing using the contact details above. You do not need to use a particular form of words.

How we respond: we will respond without undue delay and within one month. If your request is complex, or you make several requests, we may extend this by up to two further months and will tell you why. If we need to confirm your identity, or need more information to find what you are asking for, the time limit will begin once we receive it. When responding to a request for a copy of your information, we will carry out a reasonable and proportionate search for it.

There is normally no charge. We may charge a reasonable fee, or refuse to act, if a request is clearly unfounded or excessive.

Making a complaint

If you are unhappy with how we have used your personal information, or how we have handled a request, please tell us first so that we can put things right. You can complain to us:

We will acknowledge your complaint within 30 days of receiving it. We will then look into it without undue delay, keep you informed of our progress, and tell you the outcome.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator:

  • Website: ico.org.uk/make-a-complaint
  • Telephone: 0303 123 1113
  • Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Our website and cookies

Our website is used to provide information about the Charity and our application form. We do not use our website to sell or share your information.

Cookies are small text files placed on your device when you visit a website. We use essential cookies, which are needed for the site to work properly and securely, and Google Analytics cookies, which help us understand how visitors use our website so that we can improve it.

Google Analytics collects information such as the pages you visit, how long you spend on the site, how you arrived at it, and the type of device and browser you use. We use this information only in summary form. We do not use it to identify you and we never combine it with information from grant applications. Google may process this information outside the UK.

Full details of the cookies we use, what they do, how long they last and how to manage your choices are set out in our Cookie Policy.

Our website uses Google Fonts, which are loaded from Google’s servers. When you visit our website, your browser connects to Google, and your IP address is sent to Google so that the fonts can be displayed. Google may process this information outside the UK. For more information, see Google’s privacy policy.

Our website may contain links to other websites, including our Facebook page. We are not responsible for the privacy practices of other websites, so please read their privacy policies. If you contact us through Facebook, Meta will also process your information in line with its own privacy policy.

You can change your cookie choices at any time, as explained in our Cookie Policy. You can also set your browser to block or delete cookies. If you block essential cookies, some parts of our website may not work properly.

Children and people acting on someone’s behalf

If an application is made for a child, or for an adult who needs help managing their affairs, we will deal with a parent, guardian, carer or other appropriate representative. We will only share information with a representative where we are satisfied they are entitled to act on the applicant’s behalf.

Changes to this policy

We review this policy regularly and will update it when the law or our practices change. The date at the top shows when it was last updated. If we make significant changes that affect how we use your information, we will let current applicants know.

Contact us

If you have any questions about this policy or how we handle your personal information, please contact:

St. Saviour’s Medical Charity
49 High Street, Hythe, Kent, CT21 5AD
Email: grants@stsavioursmedicalcharity.org.uk
Telephone: 01303 263833

Last updated: 29 September 2026