Privacy Policy

About Us

NHS Lothian Charity aims to improve the physical and mental health of the people of Scotland, in particular in Edinburgh and the Lothians. We provide funding, deliver projects and make grants to support projects and initiatives not normally funded by the health service.

We are committed to ensuring that your privacy is protected. When we collect personal information about you, we promise to keep this information safe.

In accordance with the Data Protection Act 2018, our privacy statement sets out how we collect and use personal information and why this is important in enabling us to fulfil our charitable objectives.

If you are asked to provide personal information, you can be sure that it will only be used in accordance with this statement.

We have registered with the Scottish Adjucation Standards Panel and are proud to work to the Good Fundraising Guarantee.

NHS Lothian is the Corporate Trustee of NHS Lothian Charity and is the data controller for the personal information covered by this Privacy Policy.

NHS Lothian Charity operates within NHS Lothian’s governance framework and manages personal information in accordance with NHS Lothian’s information governance arrangements. We use NHS Lothian systems and, where appropriate, carefully selected third-party suppliers and systems to support our activities. Where third-party systems are used, appropriate contractual and governance arrangements are in place to ensure personal information is handled securely and in accordance with data protection law.

Access to personal information is restricted to those who need it to carry out their role. Staff working for the Charity are subject to NHS Lothian’s data protection, confidentiality and information security policies, together with any Charity-specific policies that support charitable activities.

You can read NHS Lothian’s data protection notice on their website.

WHERE WE COLLECT INFORMATION ABOUT YOU FROM

This section explains how we collect information about you. For further information on how we keep this information secure and how you can opt out of direct marketing, please see the sections entitled ‘Where we store information’ and ‘How to opt out’.

We collect information in the following ways:

When you give it to us DIRECTLY

You may give us your information when, for example, you make a donation, fundraise, sign up to or take part in an event, sign up to hear from us, apply for a grant, make an enquiry or communicate with us.

When you give it to us INDIRECTLY

Your information may be shared with us by independent event organisers, for example third party promoters or fundraising sites like JustGiving. These independent third parties will only do so when you have indicated that you wish to support NHS Lothian Charity. You should check the privacy policy of other organisations.

When you give permission to OTHER ORGANISATIONS to share or it is available publicly.

We may combine information you provide to us with information available from external sources in order to keep information up to date, gain a better understanding of our supporters and improve our engagement strategies. The information we get from other organisations may depend on your privacy settings or the responses you give, so you should check these settings regularly. This information comes from the following sources:

Third party organisations
You may have provided permission for a company or other organisation to share your data with third parties, including charities. This could be when you buy a product or service or enquire or register for an event.

These organisations act as data processors on our behalf or as independent data controllers, depending on the service provided.

Social Media
Depending on your settings or the privacy policies for social media and messaging services like Facebook, Instagram, X (Twitter), Bluesky, LinkedIn, Vimeo YouTube, WhatsApp, etc you might give us permission to access information from those accounts or services.

Information available publicly
This may include information found in places such as Companies House, information that has been published in articles, newspapers, journals, websites, social media, annual reports or other publicly available information. This information helps us organise our fundraising as efficiently as we can.

We may also use publicly available sources based on our legitimate interests to carry out due diligence on supporters or potential supporters in line with our Ethical Fundraising Policy and to meet money laundering and other regulations.

When we collect it as you use our Websites or Apps

We use cookies and tags (collectively “Cookies”) on our website in order to help improve our website, improve your online experience and provide you with a more personalised service.

A cookie is a small data file that certain websites write to your hard drive when you visit them. This site uses different types of cookies to carry out the functions described above and provide information about your visits for statistical purposes only. These cookies will be stored in your browser. You have the option to opt-out of cookies that are not essential for the basic functionality of the website although opting out of some of these cookies may affect your browsing experience. Usage information is typically pseudonymised and does not directly identify individuals. Cookies do not typically collect information that directly identifies you including email addresses, phone numbers, full names or usernames, but may include identifiers such as IP address or device information which are treated as personal data under data protection law.

We only set non-essential cookies (including analytics and advertising cookies) where you have given your explicit consent through our cookie banner. These cookies are not set by default.

Google Analytics
We use Google Analytics 4 (GA4), a web analytics service provided by Google LLC, to help us understand how visitors use our website and improve its performance and user experience.

GA4 uses cookies and similar technologies to collect information such as pages visited, time spent on the site, device type and general location (based on IP address). This information is typically pseudonymised and does not directly identify individuals.

Google may process this data on servers outside the UK, including in the United States. Where this occurs, appropriate safeguards are in place in accordance with UK data protection law.

We rely on your consent to set analytics cookies. You can manage or withdraw your consent at any time using our cookie settings.

Depending on your account settings, Google may associate your activity on the NHS Lothian Charity site and other sites and apps with your personal information in order to improve Google’s services and the ads delivered by Google. You have choices regarding the information that is collected and how it is used by Google and can update this in your Google account settings.

For more information, see: https://policies.google.com/privacy

Google Ads
We use Google Ads, including remarketing features, to deliver relevant advertising to users who have previously visited our website.

This means you may see our adverts on other websites or platforms after visiting our site. These technologies use cookies to provide more relevant advertising and to measure effectiveness.

Managing your preferences for Google Analytics and Ads
You can control how your data is used in several ways:

Please note that disabling cookies may affect website functionality.

Social Media Cookies
Our website includes features from third-party platforms such as Facebook, X (Twitter), Instagram, Bluesky, LinkedIn or WhatsApp that allow you to share what you have been doing on the website and social media. Please refer to the privacy policies for these sites for how their cookies work and how you can opt out.

More about Cookies
If you wish to restrict or block the cookies which are set by our website, or indeed any other website, you can do this through your browser settings. Search in your cookie folders for nhslothiancharity.org to find our cookie and the Google Analytics cookie if you wish to delete them. If you chose to restrict or block any cookies, this may result in certain features of the website not being provided and you may not be able to take full advantage of the websites features and functionality.

More information about cookies, including how to block them or delete them, can be found at AboutCookies.org

WHAT PERSONAL DATA WE COLLECT AND HOW WE USE IT

The type and quantity of information we collect and how we use it depends on why you are providing it. We want to get in touch in the way you’d prefer – be it by email, on the phone or in writing – and may ask you to let us know your preferred option.

For each use of your personal data, we rely on an appropriate lawful basis under UK data protection law. These include consent, contract, legal obligation and legitimate interests, depending on the activity.

If you support us, for example make a donation, leave a legacy, fundraise, sign up to or enquire about an event, take part in a raffle/lottery/prize draw, volunteer, apply for a grant, sign up to hear from us or enquire about how to support us, etc we will usually collect:

  • Your name
  • Your contact details
  • Your gender
  • Your date of birth to confirm if you are over 18
  • If you are under 18 we may collect the name and contact details of a parent or guardian and, where appropriate, the name and location of your school.

Where it is appropriate, we may also ask for:

  • Job title and employer
  • Reason for supporting us
  • Your bank or credit card details
  • Confirmation of whether or not you are a taxpayer – to allow us to claim gift aid
  • Next of kin, if taking part in events where this information is necessary
  • Information relating to your health, for example if you are taking part in a high-risk event
  • T-shirt or running vest sizes to allow us to send you branded merchandise
  • Information relating to your hardship grant application – i.e. financial situation, employment and benefit status

We will use your data to:

  • Provide you with information you asked for based on legitimate interest or contract
  • Process your grant application
  • Administer your donation, legacy or support your fundraising including processing gift aid based on contract and/or legal obligation
  • Keep a record of your relationship with us
  • Ensure we know how you prefer to be contacted
  • Send you correspondence and communicate with you
  • Process applications for funding and for administration of our role in the projects we fund
  • Monitor website use to identify visitor location, guard against disruptive use, monitor website traffic and/or personalise information which is presented to you based on your consent where cookies or similar technologies are used, or our legitimate interests in maintaining and improving our website
  • Meet our legal obligations, for instance to perform contracts between you and us, or our obligations to regulators, government and/or law enforcement bodies
  • Respond to or fulfil any requests, complaints or queries you make to us
  • Understand how we can improve our services, products or information by conducting analysis and market research
  • Check for updated contact details against third party sources so that we can stay in touch if you move based on our legitimate interests in keeping our records accurate and up to date
  • Further our charitable objectives

We may use your email address and phone number to match to your account on Facebook or other social media sites to be able to show you content relating to NHS Lothian Charity while you are using these sites. We will only carry out this activity where you have provided consent to receive marketing communications and this processing is based on your consent. Your personal data is kept secure at all times. We may also use your email address and phone number to link to Facebook or other social media sites to help us reach people with similar interests to our supporters who might be interested in our work through targeted advertising. This activity is based on our legitimate interests in promoting our charitable work and reaching new supporters in a proportionate way.

We may also use your personal information to detect and reduce fraud.

Collecting Data from Children Under 18

We collect and manage information from children and aim to manage it in a way which is appropriate to the age of the child. Where possible and appropriate we will seek consent from a parent or guardian before collecting information about children. Information is usually collected when children attend our events or fundraise for us, but it can also be sensitive personal data.

If in certain circumstances children aged 13 and over may be able to give their consent to their data being and held and processed depending on the nature of the activity. Where this is the case, this information is managed separately from other data provided to the charity.

Some events have specific rules about whether children can participate, and we‘ll make sure advertising for those events is age appropriate and parental consent gathered where appropriate.

Using our forms, supporting your participation and contacting you

If you enter your details onto one of our online forms, and you don’t ‘send’ or ‘submit’ the form, we may contact you to see if we can help with any problems you may be experiencing with the form or our website.

Saving data from partially completed forms

When you begin completing a form on our website, we may automatically store the information you enter, even if you do not submit the form. This helps us to improve our website and services and understand where users may experience difficulties.

Where appropriate, we may use the contact details you have provided to follow up about your incomplete form, help you complete it, or provide further information about the activity you were signing up for. For example, we may send a reminder if you have started but not completed a donation, registration or application form.

We do this on the basis of our legitimate interests in improving our services, supporting engagement with our activities and helping users complete actions they have chosen to begin. We ensure that any follow-up is limited, proportionate and not intrusive, and you can object to this processing at any time.

We will not use information from a partially completed form to add you to our marketing mailing lists or send you broader fundraising or marketing communications unless you have separately consented to receive them or another lawful basis applies.

Saving your progress

Some of our forms include an option to save your progress and return later. If you choose to use this feature, we will store the information you have entered so that you can continue your form at a later time. Where you provide your email address to receive a link to return to your form, we will use it only for this purpose.

We will keep this information secure and only retain it for as long as necessary to provide these services. This processing is carried out to fulfil your request and is based on our legitimate interests or your consent, depending on how the feature is used.

Event participation and fundraising support

If you sign up to take part in one of our events or fundraising activities, we will use your personal information to support your participation. This may include sending you information, reminders, and guidance to help you prepare for your event and meet any fundraising targets or commitments you have agreed to.

This may include tips, ideas and suggestions on how to set up, manage and share your fundraising activity. We do this on the basis of our legitimate interests in supporting our fundraisers and ensuring a positive experience when taking part in our events and activities.

Email and messaging communications

If you have opted in to hear from us, depending on the preferences you have selected, we may contact you by email, telephone, text message (SMS), or messaging services such as WhatsApp to keep you up to date with our work and how you can support us. This may include newsletters, updates about our activities, fundraising appeals, and information about events, campaigns or areas of our work you have shown an interest in.

Where you take part in a fundraising event or activity, we may also use your contact details to send you relevant messages to support your participation, such as event updates, reminders, messages of support or hints and tips on ways to reach or exceed your fundraising targets. These messages are based on our legitimate interests.

We will only send you marketing messages by email, text/SMS or messaging services where you have given us your prior opt-in consent to do so. You can choose how you hear from us and can change your preferences or opt out at any time. Please see our how to opt out section below.

If you choose to receive messages via WhatsApp or similar messaging services, your phone number and message data will be shared with these providers to enable us to send you messages. These services are operated by third parties and may process your data in line with their own privacy policies. We will only contact you via these channels where you have provided your consent.

Direct marketing

If you have provided us with your postal address we may contact you to let you know about progress towards our charitable objectives and/or to ask for donations or other support. We will always seek your consent to contact you via email or text/SMS for marketing or fundraising purposes. You can change your contact preferences at any time. Our forms also have clear emarketing preference questions and we will always include information on how to opt out when we send you marketing by email or text.

How to opt out

If you have previously given us your permission to contact you and have now changed your mind, you can let us know by emailing [email protected] or by calling 0131 465 5850.

If you request that we do not contact you again for marketing or fundraising purposes, we will respect your wishes. It may take up to 28 days for us to update our records and for you to stop receiving marketing communications from us. After this time, we may still send you administrative communications, for example in relation to payments you have made or events you have signed up to take part in.

If you ask not to receive any marketing or fundraising communications from us, please be aware that your personal information may still be retained and marked to prevent you from receiving any communications and to allow us to have our work independently audited. You have a right to ask us to remove your personal information, and if it’s not necessary for the purpose you provided it to us for, we will do so. If you request full deletion of your data, we may no longer be able to retain a record of your communication preferences. This means there is a small risk you could be contacted again in the future.

If you want to guarantee that you will not receive communications from us, it is in your best interests for your data to be retained on our system so that your contact preference is recorded and adhered to.

We do not have any access to your medical records. We will not sell or lease your personal information to third parties. We will not share your information with a third party for their own purposes unless required by law to do so. In certain circumstances, such as to process offers of free tickets, we may share details you have provided with third parties in order for them to administer this service, however, you will be advised of this before you submit your details and you can choose not to enter your details on the form and submit. You may request details of personal information which we hold about you under Data Protection Law. If you would like a copy of the information held on you, please request this by submitting a Subject Access Request as outlined in the ‘Amending Your Records’ section. If you believe that any of the information we are holding on you is incorrect or incomplete, please contact us as soon as possible, so that we can correct the information.

We appreciate your support and aim to ensure that your privacy is treated with respect at all times, in compliance with the current Data Protection Laws.


Building profiles of supporters and targeting communications

We use profiling and screening techniques for communication, fundraising and marketing purposes. We do this to ensure communications are relevant and timely, and to provide an improved experience for our supporters. This helps us understand the interests and preferences of our supporters and enables us to make appropriate requests for support.

When building supporter profiles, we may analyse geographic, demographic and other information relating to you to better understand your interests and preferences and send you the most relevant communications. In doing this, we may use additional information from third party sources when it is available. This helps us understand the interests and preferences of our supporters and enables us to make appropriate requests for support. This may include information compiled from publicly available sources. See Information available publicly above.

This processing is based on our legitimate interests in engaging supporters effectively and appropriately.

This activity may involve analysing information such as your engagement history, donation patterns, location or publicly available information to help us understand our supporter base and tailor our communications.

We may also use information about our supporters to identify trends, develop audience insights and create supporter profiles or personas that help us better understand the characteristics and interests of our supporter base.

You have the right to object at any time to the use of your personal data for direct marketing purposes, including profiling and segmentation used to support our fundraising and marketing activities. If you object, we will stop using your personal data for these purposes, including contacting you with fundraising or marketing communications, targeting you, segmenting you or including you in advertising audiences.

We may continue to use information in aggregated and statistical analysis to help us understand our supporter base and improve our activities, where this is permitted by applicable data protection law.

Use of artificial intelligence (AI)

We may use AI tools to help support our work and improve our efficiency. For example, AI may be used to help draft or review content, improve communications, summarise information, identify trends or patterns in data, and support administrative tasks.
Where AI tools are used, we ensure that appropriate safeguards are in place, including limiting the use of personal data, applying data minimisation principles (only using the personal information necessary for a specific purpose) and maintaining appropriate human oversight.

We do not use AI to make solely automated decisions about individuals that have legal or similarly significant effects.

Our use of AI is kept under review to ensure it remains compliant with data protection law, our policies and good practice.

Third Parties

We may share information with third parties for the purposes of events; event providers (for example, Kiltwalk, Edinburgh Marathon), fundraising platforms (for example, JustGiving, etc), or event management (for example Eventbrite).

We may use third party organisations to carry out work on our behalf such as fundraising, processing donations, marketing, market research, processing or analysing data, or to support the delivery of our programmes. We will always have a contract or agreement in place with any third party agency that includes how they manage your data on our behalf and will only provide these companies with the information they need to deliver the service.

As the main beneficiary of our charitable objectives, we may share your information with NHS Lothian for example if you have donated or raised money, left or are planning to leave a legacy or have applied for a grant.

We may share your information with Local Authorities or other partners to enable us to process your grant application.

We may share your information with HMRC to process gift aid claims.

If you are a legator we may share information with co-beneficiaries and/or professional advisors.

We may need to disclose your details if required to the police, regulatory bodies or legal advisors.

We will never sell personal details to third parties for the purposes of marketing.

Where any of our suppliers process data outside the UK, we ensure that appropriate safeguards are in place in accordance with UK data protection law.

Payment process

NHS Lothian Charity does not collect payments directly and at no time collects or stores any card details.

Our website payment processes are completed on secure sites provided by a third parties. Our payment service providers include Stripe and Access PaySuite. This may include payment methods such as card payments, digital wallets, or other services supported by these providers.

We respect the privacy of every individual who visits our site. Any personal information submitted through the website, excluding payment card or bank details, is securely stored on our systems.

By using the online payment facility, you accept and consent to your personal data being provided to the Service Provider for sole purpose of offering and administering the online payment.

When accessing or concluding transactions through third party payment providers, their own terms and privacy policies will apply. We encourage you to take every precaution to ensure you are on the intended payment site and review their privacy policies before providing payment details.

NHS Lothian Charity will never ask individuals for their usernames or passwords for any third party sites. Always check the legitimacy of any emails received from NHS Lothian Charity or third party payment providers, particularly in relation to clicking links to update details, providing details etc.

Accessibility

We use a tool called Recite Me to make our website more accessible which gives you control over how you view our content in a way that best suits you. You can access the toolbar at the top of any page on our website by clicking the ‘accessibility’ button which will show you a toolbar with different options to customise your experience.

Recite Me will process and store IP addresses for the purposes of security and reporting. These IP addresses are encrypted in transit and converted to a one-way hash value (irreversible) and encrypted in storage on UK-based data centres with ISO27001 certification.

Users can choose not to launch the Recite Me toolbar.

This processing is necessary for the provision of accessibility features and is based on our legitimate interests.

Sharing your story

Some grant recipients, donors, fundraisers or legators choose to tell us about their activities or interest in NHS Lothian Charity and are happy for us to use their stories and photographs for publicity. We will always seek your prior explicit consent for any publicity of this kind.

LEGITIMATE INTEREST

Purpose of Data Processing

We process personal data to support our objectives as NHS Lothian Charity. Processing takes place in our fundraising and marketing activities, and our donor management and stewardship. Specifically, we use legitimate interest to send postal marketing mailings to our previous donors and legacy pledgers.

Specific Benefits and Outcomes

Our legitimate interest lies in delivering our charitable objective which is to support NHS Lothian’s work, its staff and the patients and families it cares for, to make healthcare better for everyone.

By sending postal mailings, we appropriately thank donors, keep our donors informed about our work and the impact of their support, we share success stories, inform our previous donors of further ways they can be involved, and encourage continued support. Those donors in receipt of our postal mail are always provided with multiple ways to let us know they wish to opt-out of receiving mail from NHS Lothian Charity. We will only add those donors who give to the Charity regularly to postal mailings if they opt out of hearing from us electronically.

Balancing Test

We ensure that our legitimate interest does not override the rights and freedoms of individuals.

We consider the impact on privacy and take necessary measures to protect data subjects.

Transparency and Fairness

We are transparent about our data processing activities through this Privacy Policy and in all communications with stakeholders, informing individuals about their rights and how their data is used.

Lawfulness

Our data processing is lawful under Article 6(1)(f) of the General Data Protection Regulation (GDPR), and Privacy and Electronic Communications Regulations (PECR).

We rely on legitimate interest to process data, as it is necessary for our charitable activities, including marketing as described in the ‘examples of legitimate interest’ section below to our previous donors.

Examples of Legitimate Interest

  • Donor Engagement: Sending postal mailings to express gratitude, provide updates, and encourage continued support.
  • Marketing Campaigns: Promoting our brand, fundraising activities and initiatives, and events to increase donations.
  • Beneficiary Impact: Demonstrating the impact of donations on patient care and experience, and staff wellbeing.

HOW WE KEEP YOUR DATA SAFE

We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online.

We secure the Personal Information you provide to us in our CRM and finance systems on computer servers in a controlled, secure environment, protected from unauthorised access, use or disclosure.

Our online forms are always encrypted and our website is securely hosted, protected and routinely monitored.

We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff, volunteers and contractors.

NHS Lothian Charity has no control over third party sites linked to from our website or linking to our website. These sites will have separate terms of service, privacy and data collection practices and legal policies independent of NHS Lothian Charity. Accessing, using or concluding transactions through these third party sites is entirely at your own risk.

NHS Lothian Charity will not be responsible for devices used to conclude transactions on our site.

International transfers

Most of the personal information we process is stored and processed within the UK. However, some of the organisations that provide services to us may process personal information in countries outside the UK.

Where personal information is transferred outside the UK, we will ensure that appropriate safeguards are in place in accordance with UK data protection law. These safeguards may include adequacy regulations, the UK International Data Transfer Agreement (IDTA), or other approved transfer mechanisms.

We will only transfer personal information internationally where we are satisfied that appropriate protections are in place.

How long do we keep your data on record?

We will keep and delete your information according to our Records Management policy and will keep it no longer than reasonably necessary for the purposes for which we hold it, taking into account relevant legal and regulatory retention requirements (e.g. tax or health and safety requirements) and operational considerations.

As a guide:

  • Correspondence on donations: 6 years from the end of the fiscal year
  • Wills and/or deeds of covenant (done): 6 years after final payment due
  • Gift Aid claims: up to 6 years after the relevant fiscal year
  • Lottery returns: 3 years after the draw
  • Partially completed online forms: held on website for up to 30 days
  • Completed online forms: held on website for up to 365 days from submission date

These periods may vary depending on legal, regulatory or operational requirements.

Amending your records

You can amend your records or preferences with us at any time. For example, if you have moved house, or you have changed your mind on how you would like us to contact you.

Please call 0131 465 5850 or email [email protected]

If you want to access any information we hold about you please make a NHS Lothian Charity Subject Access Request Form.

WHAT DO I DO IF I HAVE A COMPLAINT?

We aim to resolve any complaints as swiftly as possible. Please have a look at our Complaints Policy for more information.

If your complaint is in regards to data protection issues, you should send it in the first instance to NHS Lothian Charity using the following details:

By email: [email protected]

By telephone: 0131 465 5850

By post:
NHS Lothian Charity,
Waverley Court
4 East Market Street
Edinburgh EH8 8BG

Please clearly mark your complaint as a complaint.

The data controller for NHS Lothian Charity is:

Data Protection Officer
Information Governance
Woodlands House
74 Canaan Lane
Edinburgh
EH9 2TB
Phone – 0131 465 5444

Email: [email protected]

CHANGES TO OUR PRIVACY POLICY

We reserve the right to change this statement and will update the information on this page accordingly. Any significant changes will be highlighted on our website or we may contact you directly.

This policy was last updated in July 2026.