Heart Children CHD support card ordering service
Privacy notice
1. Who is responsible for your information
Heart Children Ireland, of The Carmichael Centre, North Brunswick St., Dublin 7, is the controller of personal information collected through this CHD Support Card ordering service.
“Controller” means the organisation that decides why and how personal information is used.
If you have questions about this notice or how your information is used, contact:
- Email: info@heartchildren.ie
- Post: The Carmichael Centre, North Brunswick St., Dublin 7
Bool Technologies Limited provides and supports the ordering system for Heart Children as a processor. It acts only on Heart Children’s documented instructions.
2. What information we collect
When you request a CHD Support Card, we may collect:
- cardholder name and date of birth;
- whether the card is for an adult or a child;
- email address and telephone number;
- delivery recipient name and postal address;
- parent or guardian name, email address and telephone number for child orders;
- a cropped passport-style photograph, if supplied;
- order reference, status, order history, clarification messages and communications;
- consent and acknowledgement records, including the wording shown and the date and time accepted;
- staff notes, operational audit records and dispatch details; and
- limited technical and security information, such as IP address and security logs, where needed to protect the service.
Please do not include unnecessary medical information in free-text fields or emails.
3. Why we use your information
We use this information to:
- receive, assess and process your CHD Support Card request;
- create, print and post the card after Heart Children approval;
- contact you about your request, including requesting clarification;
- allow you to view or amend an unconfirmed order through a private status link;
- manage printing, dispatch, customer support and service records;
- prevent misuse, protect the system and investigate security incidents;
- meet legal, regulatory, accounting and safeguarding obligations where applicable; and
- manage complaints, corrections and data-protection requests.
4. Legal basis
We process ordinary personal data you have asked Heart Children to provide and administer a CHD Support Card. This processing is necessary to take steps at your request and to provide the service you have requested (Article 6(1)(b) GDPR).
We also process limited information to keep the service secure, prevent misuse, maintain audit records and deal with complaints. This is necessary for Heart Children’s legitimate interests in operating a safe, accountable card service (Article 6(1)(f) GDPR).
A request for a CHD Support Card may reveal information about a person’s health. Where the processing is special-category personal data, Heart Children relies on explicit consent from the adult cardholder or, for a child, their parent or guardian acting on their behalf (Article 9(2)(a) GDPR).
Consent is requested separately, in clear language, for the specific purpose of processing, producing and dispatching the CHD Support Card. It may be withdrawn at any time by contacting Heart Children. Withdrawal will not affect processing already carried out, but may mean that we cannot continue with the card order.
We will explain what explicit consent covers and how it can be withdrawn. It does not replace identifying the correct legal basis for each activity.
5. Who receives your information
Access is limited to people who need it for the service, including:
- authorised Heart Children staff;
- authorised Bool Technologies staff who support card production, system administration or dispatch;
- approved technology providers that host the system, store data or send emails; and
- regulators, insurers, professional advisers or public bodies where disclosure is legally required.
We do not sell personal information or use it for advertising.
6. International transfers
Heart Children intends to keep order data within the European Economic Area where possible.
If a provider processes personal information outside the EEA, Heart Children will ensure that an appropriate transfer safeguard is in place, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, with any required supplementary safeguards.
7. How long we keep information
We keep information only for as long as necessary for the purposes above and for approved legal, operational and audit requirements.
Heart Children’s approved retention schedule is:
| Record | Retention period |
|---|---|
| Unsubmitted draft order | Delete after 30 days. |
| Submitted but not completed, cancelled, or not approved order | Delete after 12 months from the last meaningful contact or action. |
| Completed cardholder or order record needed for replacements | Retain while the card scheme operates; review every two years; delete within 24 months after the scheme ends. |
| Cropped photo | Delete 24 months after the most recent card is produced or replaced. Require a new photo for any later replacement. |
| Dispatch records | Retain for two years after dispatch. |
| Audit records | Retain for six years from the event, provided they contain only necessary audit details—not copies of photos, addresses, or health information. |
| Routine security logs | Delete after 90 days. Keep only logs relevant to a security incident until the incident, investigation, or legal claim is closed. |
| Encrypted backups | Rolling deletion after 35 days. Backups are restored only for recovery, not normal use. |
At the end of the applicable period, information will be securely deleted or irreversibly anonymised, unless it must be retained by law or for an active legal claim.
8. How we protect information
We use organisational and technical safeguards appropriate to the risk, including role-based staff access, secure sign-in, encryption in transit, protected storage, audit logging, backups and private status links. Hosting controls govern encryption at rest and backup protection.
A status link is private. Anyone who has the link may be able to see the related order, so please do not forward it. Contact Heart Children if you believe a link has been shared, lost or used without permission.
9. Your rights
Subject to GDPR conditions and exemptions, you may ask us to:
- access your personal information;
- correct inaccurate or incomplete information;
- delete information;
- restrict or object to certain processing;
- receive information you provided in a portable format where applicable; and
- withdraw consent where consent is the legal basis.
To make a request, contact info@heartchildren.ie. We may need to verify your identity before acting.
You also have the right to complain to the Data Protection Commission:
- Website: dataprotection.ie
- Address: 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
10. Is providing information required?
Some details are necessary to process and deliver a card, including cardholder details, contact details, delivery address and the required acknowledgement. If these are not provided, we may be unable to process the request.
A photograph is optional at initial submission, but may be needed before a card can be produced.
11. Changes to this notice
We may update this notice where the service, law or our processing changes. The current version is published at heartchildren.ie/privacy.
Heart Children is the national support organisation for families affected by congenital heart disease in Ireland. Find out more at heartchildren.ie.