Skip to main content

Privacy policy


Our National Health Stories (ONHS) is a cultural project, part of NHS 75 that has been developed by the 19 participating NHS trusts with an independent team, hosted by NHS Charities Together.

ONHS takes the privacy of its audience and users very seriously. This Privacy Policy outlines how your personal information is collected, used and treated as part of the terms and conditions of this site. It is a summary of the full NHS Charities Together Privacy policy, tailored to suit ONHS. Click here to view the full NHS Charities Together Privacy Policy

For all personal information we hold we undertake to:

This policy is effective from 3 July 2023.

Who is NHS Charities Together?

NHS Charities Together is an organisation which represents, supports and champions NHS Charities in all four nations of the United Kingdom. Our legal name is The Association of NHS Charities. We are a charitable company limited by guarantee with registration number 12325259. We are registered with the Charity Commission for England & Wales registration number 1186569 and SC050716 (Scotland).  Our notification number with the Information Commissioner is ZA437958.

In 2020 we became one of the primary national focusses for receiving gifts from the public and from companies and charitable trusts to support the work of the NHS Charities through the Covid-19 pandemic.

Why do we process your personal information?

We process your data in order to fulfil our purpose in supporting NHS charities and, where required, in order to fulfil legal or other obligations such as regulatory, audit, gift aid and anti-money laundering requirements.

Whose personal information do we process?

If you give to us, directly or via a partner, or if you are associated with an organisation which gives to us, or if we think that you or your organisation might give to us then we will process your data in accordance with this notice.

We will process personal information about you in the following circumstances:

From where do we get your personal information?

In some circumstances we receive personal information directly from you, while in other cases we receive it from you via a third party, or from other information that is publicly available.

Directly from you

We obtain information from you if you make an enquiry on our website or by some other means, if you give directly to NHS Charities Together, or if you contact us directly in some other way.

From other publicly available information

We sometimes add extra data to the information you have already given us. We do this for purposes which are described in the section “What we do with your data”. Such data may be obtained or derived from public records (e.g. Companies’ House) or from organisations such as the Royal Mail which maintains the National Change of Address database, or from information such as that published in newspapers.

Where we use such data we are careful to check the integrity of the data source and the accuracy of information provided.

What we do with your data. And how do we make sure it is lawful?

Data Protection Laws require us to identify which legally defined “ground for processing” we will use for anything we do with your personal information. We have grouped the things we do with your information into sections for each “ground for processing”. We have done this because you have different rights depending on which of these “grounds” is being used.


Explanation: Where we use “consent” to process your information, we can only do this with your permission, and you have the right to withdraw your permission, without detriment to you, at any time. Please bear in mind that if you like receiving news about us by one of the methods listed below, and you withdraw your consent, we will no longer be able to send it to you.

If, and only if, you have consented, we may use your personal information to:

If you are asked by a partner website or other giving platform whether you agree to receive further fundraising contact from us by any specific method which, in law, requires consent (e.g. email, text message etc.) and you do agree to such contact, then we will receive that information from our partner and record your consent to be contacted by that method. In these circumstances our partner will always pass your contact and giving information to us.

Legal Obligation

Explanation: Sometimes we are legally required to process your data because of our nation’s laws or some other regulatory obligation. In most cases we have no choice about this, and although you can object, we may not be able to stop using any or all of your information for any of these purposes.

The following circumstances create a legal obligation for us to process your data:

Legitimate Interests

Explanation: Some aspects of our work cannot be done without using your personal data, but do not fall into the group of activities where consent is required by law, nor will they be subject to a contract or a legal obligation. In most of these cases we use the “Legitimate Interests” ground for processing. This means that we must balance the benefit we get from using your data to pursue our own lawful interests against any negative impact on your rights and freedoms which might happen as a result. (If we think that there is too much negative impact then we would ask for your consent instead.) You have a right to ask us to stop using your data if we are using “Legitimate Interests” as our ground for processing.

We will use the Legitimate Interests ground for processing in circumstances such as the following:

What data do we use?

We are likely to hold the following information if you have supported us, signed up to receive marketing communications from us and / or been in touch with us:

Who we share your data with

When considering how we share your data with another organisation, we ask ourselves whether or not we would lose control of your data by doing so. Losing control would mean that the new organisation could decide what to do with your data. We only share your data in this way if we have your consent, or if we are legally obliged to do so.

In practice this means we pass your data to others in the following limited circumstances:

We may also pass your data, but not control of your data, to organisations which help us to manage our own work. These are known as Data Processors and are bound by a contract with us. They are not allowed to do anything with your data that we have not authorised, and they may not use your data for their own purposes, nor can they keep it. Examples of data processors include a mailing house which prints letters for us and our database supplier which hosts our donor database in a secure encrypted “cloud” environment.

How long do we keep your data?

Our National Health Stories concludes in December 2023, and generally speaking, your data will be kept until then.  At the end of the project we will contact you to ask you whether you would like your data deleted, or transferred to NHS Charities Together marketing list.

For more information about NHS Charities Together data retention policy please see their full privacy policy.

Your rights

The law covering privacy, which are the European General Data Protection Regulation until the end of the Brexit Transition period, and the Data Protection Act 2018 give you certain rights which you can exercise by contacting us. These are:

Contact details

You can contact Our National Health Stories via

You can contact NHS Charities Together via

Suite 68, Lake View House Wilton Drive Warwick CV34 6RG

E: T: 0300 303 5748  

You can complain to the Information Commissioner via information at or by telephoning 0303 123 1113.