How we use your data
Data controller.
We are Lincolnshire Integrated Voluntary Emergency Service (LIVES), a charity in England registered with the Charity Commission under number 1098364 whose registered office is at LIVES Headquarters, Units 5-8 Birch Court, Boston Road Industrial Estate, Horncastle, Lincolnshire, LN9 6SB (in this privacy notice, we refer to ourselves as LIVES, or “we” or “us”).
LIVES is the controller of the personal data described in this notice. This means that we are responsible for deciding how and why your personal data is used, and for looking after it in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection laws.
Who this notice applies to.
This Privacy Notice applies to patients and their families, carers or representatives; donors and supporters; customers, prospective customers and training participants; website and social media users; visitors to our premises; members of the public who contact us or are involved in an incident concerning LIVES; and people whose images or vehicle details may be captured by our CCTV or vehicle dashcams.
Staff and volunteers are covered by a separate internal privacy notice.
Introduction.
The UK GDPR and the Data Protection Act 2018 govern the use of personal data. Personal data is information about an identified or identifiable living individual. Some kinds of personal data, such as health information, are treated as ‘special category data’ and are subject to additional protection.
The purpose of this notice is to explain what personal data LIVES collects, how we use it, who we may share it with, how long we keep it, and the rights you have in relation to it.
Please read this Privacy Notice carefully. It explains how we use personal data when you use our services, support our work, visit our website or otherwise interact with us.
Changes to this notice.
We may update this notice from time to time. When we do so, we will publish the updated version on our website and change the review date at the end of the notice.
Keeping us informed.
It is important that the personal data we hold about you is accurate and current. Please let us know if your personal data changes during your relationship with us.
Personal data we may collect about you.
Personal data means any information about you from which you can be identified. It does not include information where your identity has been removed so that you can no longer be identified from it.
As the controller of your personal data, we are responsible for how that data is managed. We will ensure that the personal data we hold about you is:
- used lawfully, fairly and in a transparent way.
- collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
- relevant to the purposes we have told you about and limited to what is necessary for those purposes.
- accurate and kept up to date.
- kept only as long as necessary for the purposes we have told you about.
- kept securely.
Information collected by us: We may collect, use, store and transfer different kinds of personal data about you depending on how you interact with us. Please take care when sending information to us and only provide information that is relevant to your enquiry or interaction with LIVES.
Contact and identification data: for example your name, address, email address, telephone number, date of birth, job title, organisation, NHS number where relevant, and information needed to identify or contact you.
Patient and clinical data: for example clinical observations, medical history, symptoms, medication, treatment, ECG or other assessment data, incident location, safeguarding concerns, patient report forms and information needed to provide or review care.
Complaint, feedback and incident data: for example details of complaints, feedback, investigations, witness statements, outcome letters, action plans and related correspondence.
Donation and fundraising data: for example donation history, Gift Aid status, fundraising activity, event registrations, legacy or in-memory giving information, supporter notes and communication preferences.
Payment and financial data: for example donation amounts, payment references, Direct Debit or bank account details where relevant, billing details, invoices, order information and Gift Aid declarations (we do not generally receive full card details where payment is handled by a secure payment provider).
Customer and training data: for example quotation and contract information, booking history, attendance records, assessment results, certification status, qualification registration numbers, reasonable adjustment information where you choose to provide it, and feedback you provide.
Marketing and communications data: for example your marketing preferences, consent and opt-out records, campaign engagement, communication history and basic segmentation information based on your interactions with us.
Technical and website data: for example IP address, device and browser information, cookie identifiers, website usage data, referral source, online form submissions and transaction references.
Social media data: for example social media usernames or profile identifiers, public profile information, comments, messages, likes, shares, reactions and campaign interaction data.
Image, vehicle and premises data: for example CCTV footage, dashcam footage, date and time stamps, location metadata, vehicle registration numbers, and visitor access records.
Rights request and correspondence data: for example data subject access requests, requests for patient report forms, identity or authority documents, redaction notes and related correspondence.
Sources of personal data.
We may collect personal data:
- directly from you, for example when you receive care, make an enquiry, book training, donate, register for an event, complete a form, contact us or use our website;
- from a family member, carer, representative, witness or other person acting on your behalf or involved in an incident;
- from NHS bodies, emergency services, healthcare professionals, commissioners, safeguarding agencies or partner organisations where this is necessary for care, governance, complaints or other lawful purposes;
- from your employer or organisation where they book training for you or interact with us through a corporate relationship;
- from fundraising, donation, payment, booking or event platforms that you use to interact with us;
- from social media platforms where you interact with our pages or campaigns;
- from cookies, analytics tools, CCTV, dashcams and site access systems; and
- from public sources where relevant, for example in relation to corporate contacts, grants or trusts.
Reasons we collect and use your personal information
When we process your personal data, we must have a lawful basis under Article 6 of the UK GDPR. Depending on the reason for the processing, this may be:
- Consent (Art. 6(1)(a));
- Contract (Art. 6(1)(b));
- Legal obligation (Art. 6(1)(c));
- Vital interests (Art. 6(1)(d));
- Public task (Art. 6(1)(e)); or
- Legitimate interests (Art. 6(1)(f)).
Where we process special category data, such as health information, we must also meet a separate condition under Article 9 of the UK GDPR. The relevant condition will depend on the circumstances and may include the provision or management of health or social care, vital interests, explicit consent, legal claims or other conditions permitted by law. Where we process criminal offence information, we do so only where this is permitted by law, for example for safeguarding, legal claims or regulatory compliance.
| Reason for using data | Type of data | Legal basis |
| Patients and families | ||
| To provide urgent pre-hospital care, create and maintain patient clinical records, support handover and continuity of care, and share information for direct care where necessary. | Contact and identification data; patient and clinical data. | Public task for NHS-commissioned services; vital interests in emergencies; legitimate interests for non-commissioned charitable care. Where health data is used: Art. 9(2)(h) health or social care and, in emergencies, Art. 9(2)(c) vital interests. |
| To record, investigate and learn from clinical incidents, patient safety events, patient feedback and complaints, and to improve the quality and safety of care. | Contact and identification data; patient and clinical data; complaint, feedback and incident data. | Usually public task. Where health data is used: usually Art. 9(2)(h) health or social care; other conditions may apply where required by law or where there is an immediate safety risk. |
| To respond to service-to-service feedback from other healthcare organisations about clinical practice, handovers, documentation, communication or operational performance. | Contact and identification data; patient and clinical data; complaint, feedback and incident data. | Public task. Where health data is used: Art. 9(2)(h) health or social care. |
| Donors and supporters | ||
| To maintain donor and supporter records, manage our relationship with you and administer your support for LIVES. | Contact and identification data; donation and fundraising data; marketing and communications data. | Legitimate interests; contract where a transaction is involved; legal obligation where financial or Gift Aid records are required. |
| To process donations, Direct Debits, payment transactions and Gift Aid claims. | Contact and identification data; donation and fundraising data; payment and financial data. | Contract; legal obligation. |
| To administer fundraising campaigns, events, community fundraising and corporate fundraising relationships. | Contact and identification data; donation and fundraising data; payment and financial data; marketing and communications data; limited health or accessibility information where you choose to provide it for an event. | Contract, legitimate interests and, where applicable, legal obligation. Where you voluntarily provide special category information, usually Art. 9(2)(a) explicit consent; other conditions may apply where health and safety duties arise. |
| To administer legacy giving, in-memory giving, grants and trust relationships. | Contact and identification data; donation and fundraising data; correspondence; financial and audit records; limited sensitive information where it is relevant and volunteered. | Legitimate interests; contract where relevant; legal obligation. Where special category data is used, the applicable condition may include Art. 9(2)(a) explicit consent or Art. 9(2)(f) legal claims. |
| Customers and training participants | ||
| To deal with sales enquiries, quotations, contracts, bookings and customer relationship management. | Contact and identification data; customer and training data; correspondence. | Contract for individual customers and pre-contract steps; legitimate interests for corporate contacts and business relationship management. |
| To process invoices, payments, orders and financial transactions for training and equipment sales. | Contact and identification data; payment and financial data; customer and training data. | Contract and, where applicable, legal obligation. |
| To administer training courses, assessments, certification, awarding body reporting, corporate client dashboards and feedback. | Contact and identification data; customer and training data; limited health or accessibility information where you choose to provide it for reasonable adjustments. | Contract for direct customers; legitimate interests for corporate delegates; legal obligation where accreditation or awarding-body requirements apply; consent for identifiable voluntary feedback. Where special category data is provided for adjustments: Art. 9(2)(a) explicit consent. |
| Website, social media and marketing | ||
| To operate and secure our website, deal with online forms and enquiries, manage newsletter sign-ups, and analyse website performance and user behaviour. | Technical and website data; contact and identification data; marketing and communications data. | Legitimate interests for essential website operation and security; consent for analytics and other non-essential cookies. |
| To develop marketing strategies, carry out basic audience segmentation and measure campaign effectiveness. | Marketing and communications data; technical and website data; donation and fundraising data; customer and training data. | Legitimate interests. Segmentation is limited to basic marketing analysis and is not used to make decisions producing legal or similarly significant effects. |
| To send fundraising, supporter and customer communications by email, post or other channels where the law allows us to do so, and to manage marketing preferences, consent records, opt-outs and suppression lists. | Contact and identification data; marketing and communications data; donation and fundraising data; customer and training data. | Consent where required; legitimate interests where marketing is permitted without consent; legal obligation for preference and suppression records. |
| To manage our social media pages, respond to messages and comments, run proportionate social media campaigns and measure their performance. | Social media data; marketing and communications data; technical and website data. | Legitimate interests for page management and organic engagement; consent where required for tracking technologies or targeted advertising. |
| Other public-facing processing | ||
| To manage health and safety matters, accident reports, incident investigations, complaints, safeguarding concerns and organisational learning. | Contact and identification data; complaint, feedback and incident data; patient and clinical data where relevant; limited health information where an incident involves injury. | Legal obligation and/or legitimate interests. Where special category data is used: usually Art. 9(2)(f) legal claims; where patient care is involved, Art. 9(2)(h) health or social care; Art. 9(2)(c) vital interests may apply where there is an immediate risk. |
| To manage insurance policies, claims, insurer liaison, legal advice and the establishment, exercise or defence of legal claims. | Contact and identification data; complaint, feedback and incident data; patient and clinical data where relevant; image, vehicle and premises data; financial and correspondence data. | Legitimate interests, legal obligation and, where relevant, contract. Where special category data is used: usually Art. 9(2)(f) legal claims, and other conditions where relevant. |
| To operate fixed CCTV, vehicle dashcams, visitor access systems and other security measures for the protection of people, property and evidence. | Image, vehicle and premises data; contact and identification data where relevant. | Legitimate interests; legal obligation where records are needed for health and safety or emergency evacuation. |
| To manage data protection rights requests, patient report form requests, identity checks and related correspondence. | Contact and identification data; rights request and correspondence data; patient and clinical data where requested. | Legal obligation. Where health data is involved: Art. 9(2)(h) health or social care. |
Marketing and opting out.
Supporter updates and charity communications: If you have given us your contact details directly, and your dealings with us show that you are interested in or supportive of our charitable work, we may contact you about related matters without asking you to complete a separate marketing consent form. This is sometimes called the “charity soft opt-in”. We may use this to send you updates about our work, fundraising appeals, volunteering opportunities, events, campaigns, training, courses or other activities connected with our charitable purposes, but we will not use this route to send you unrelated marketing. You can opt out at any time by using the unsubscribe link in our messages or by contacting us using the details in the ‘your rights’ section below.
Your choice: You can opt out of marketing at any time. We will give you a clear opportunity to opt out when we collect your details and in every marketing email, text or similar message we send. The easiest way is to use the unsubscribe link in an email or to contact us using the details in the ‘your rights’ section below. We will keep a suppression record where necessary so that we do not contact you again against your wishes.
Making communications relevant: We may use basic segmentation, for example based on your past interactions, interests, location, donations, purchases, course history or the type of relationship you have with us, to make our communications more relevant. We do not use this profiling to make decisions that have legal or similarly significant effects on you.
Who has access to your personal information?
We will not sell or rent your personal data to third parties, and we will not share it with third parties for their own marketing purposes.
We may need to share your personal data with the following categories of recipient where this is necessary and lawful:
- NHS bodies, emergency departments, GPs, other healthcare professionals, emergency services and safeguarding partners where this is necessary for direct care, clinical governance, safeguarding or related lawful purposes;
- commissioners, partner organisations and other healthcare bodies where necessary to manage commissioned services, feedback, complaints or clinical governance;
- third-party service providers acting on our behalf, such as CRM, donation, fundraising, email, website, booking, payment, finance, training, IT, analytics and storage providers;
- awarding bodies and corporate customers where this is necessary to administer training, assessment, certification or delegate records;
- fundraising, donation and in-memory giving platforms where you choose to use those services;
- insurers, insurance brokers, loss adjusters, professional advisers, auditors and legal representatives where necessary;
- regulators, public authorities, courts, the police or other bodies where we are required or permitted by law to do so; and
- social media platforms and advertising providers where you interact with our social media pages or campaigns.
Where we use a processor to act on our behalf, we only provide the data needed for that service and we put appropriate contractual safeguards in place. Some third-party platforms, such as fundraising or social media platforms, may also act as controllers in their own right and will use your data in accordance with their own privacy notices.
Third party websites and services.
Our website may include links to third-party websites, plug-ins, platforms and applications. If you use those links or services, the third party may collect or use personal data about you under its own privacy notice. We do not control third-party websites or services and encourage you to read their privacy information.
Keeping your data secure.
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or disclosure. These measures include, where appropriate:
- role-based access controls and user-specific login credentials;
- secure electronic systems and servers;
- locked storage for paper records where paper is used;
- encryption and secure payment handling where appropriate;
- limiting access to those who need the information for their role;
- supplier due diligence and data processing or data sharing agreements where required;
- staff training, policies and procedures on data protection and information security; and
- procedures for identifying, reporting and managing data incidents.
No system can be guaranteed to be completely secure. You should also take care when sending personal data to us, particularly by email or through online forms.
Transferring your information outside the UK.
Some of the service providers we use may process personal data outside the UK. This may include, for example, certain CRM, marketing, fundraising, analytics and support platforms. Where this happens, we take steps to ensure that the transfer is lawful and that appropriate safeguards are in place, such as UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or other lawful transfer mechanisms.
Our main patient clinical systems are currently hosted in the UK.
How long do we keep your data for?
We keep personal data only for as long as is necessary for the purpose for which it was collected, unless we need to keep it longer to comply with law, NHS requirements, safeguarding duties, insurance requirements, legal claims or ongoing investigations. The main retention periods for public-facing records are summarised below:
- patient clinical records: generally 8 years for adults; for children, until age 25 (or 26 if the young person was 17 at last contact); safeguarding records are typically retained for 25 years;
- clinical incidents, patient feedback, patient complaints and clinical governance records: generally 8 years, with longer retention where required for safeguarding, serious incidents, litigation or regulatory matters;
- donation and Gift Aid records: generally 6 years after the end of the relevant financial year;
- supporter records: for the duration of the supporter relationship and then in accordance with our retention rules; suppression records may be retained for longer so that we can respect opt-outs;
- event and community fundraising records: generally up to 3 years after the event, with financial records retained for 7 years;
- legacy records: generally 7 years after estate administration is complete, or 12.5 years for contested legacies;
- customer contracts and financial records: generally 6.5 years after completion or the end of the relevant financial year;
- training records: generally 6 years after course completion, subject to qualification validity periods and awarding-body requirements;
- website enquiry forms: generally up to 3 months unless the enquiry becomes part of another record; website analytics are retained according to platform settings;
- marketing analytics reports: generally up to 3 years; marketing preference and suppression records are retained as needed to honour choices and demonstrate compliance;
- CCTV and dashcam footage: up to 6 months unless needed for an investigation, claim or other legal matter;
- visitor sign-in records: generally up to 1 month; and
- data subject rights and patient record request files: generally 6.5 years after closure.
Cookies.
A cookie is a small text file placed on your device when you visit a website. Some cookies are essential because they are needed for the website to work properly. Other cookies, such as analytics or advertising cookies, are optional.
We use essential cookies where necessary to operate our website. We will only use non-essential cookies where you have given consent through our cookie management tool. You can change your cookie choices at any time through the cookie settings on our website.
Your rights.
Under the UK GDPR, you have a number of rights in relation to your personal data. The rights that apply will depend on the circumstances and on the reason why we are processing your data.
- Right of access: you can ask us for a copy of the personal data we hold about you.
- Right to rectification: you can ask us to correct inaccurate or incomplete personal data.
- Right to erasure: in some circumstances, you can ask us to delete your personal data.
- Right to restriction: in some circumstances, you can ask us to restrict how we use your personal data.
- Right to object: where we rely on legitimate interests, you can object to the processing; you can always object to direct marketing.
- Right to withdraw consent: where we rely on your consent, you can withdraw it at any time.
- Right to data portability: in some circumstances, you can ask us to provide data you have given us in a commonly used machine-readable format or transfer it to another controller.
- Right to complain: if you are unhappy with how we have processed your personal data, you have the right to complain to us. Please see the “Data Protection Complaints” section below.
If you would like a copy of your Patient Report Form, please contact us. Depending on the request, we may be able to deal with this through a shorter patient-record request process rather than a full subject access request.
To exercise any of your rights, please email info@lives.org.uk or write to us at Units 5-8 Birch Court, Boston Road Industrial Estate, Horncastle, Lincolnshire, LN9 6SB. We may need to ask you for information to confirm your identity or authority before we can deal with your request.
Data protection complaints.
We are committed to protecting personal data and take all complaints regarding the handling of personal data seriously. A data protection complaint is any expression of dissatisfaction regarding how we have handled personal data, including:
- concerns about insecure data handling;
- failure to respond appropriately to a data protection rights request; or
- concerns that personal data has been processed unfairly or unlawfully.
If you wish to make a complaint, please use the contact details set out in the “Your Rights” section above. Please provide sufficient information to enable us to identify you and investigate your complaint, including:
- your name;
- your contact details; and
- full details of your complaint.
When we receive a data protection complaint, we will:
- acknowledge receipt of the complaint within 30 days;
- investigate the matters raised;
- provide a substantive response without undue delay; and
- keep records of the complaint and any action taken to help monitor compliance and improve our services.
If you remain dissatisfied after receiving our response, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection matters. Details of how to contact the ICO are provided below.
Review.
This Privacy Notice was last reviewed in June 2026.
The information commissioner’s office.
More information about privacy laws can be found at www.ico.org.uk.
Details of the UK supervisory authority: The Information Commissioner’s Office. You can contact them in the following ways:
- Phone: 0303 123 1113
- Email: casework@ico.org.uk
- Live chat, via the ICO website
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF