The purpose of this notice is to let you know how we handle your personal information, and your rights with regard to it.

The University of Exeter is the data controller with respect to the AccEPT Service and is committed to protecting your personal data and working in accordance with all relevant data protection legislation.

How we use your personal information

The health care professionals who provide you with care maintain records about your health. These records help to provide you with the best possible healthcare. Records which the AccEPT Service holds about you may include the following information:

  • Details about you, such as your address, contact details, gender and ethnicity.
  • Any contact the Service has had with you, such as appointments and letters sent and received.
  • Notes and reports about your health.
  • Details about your treatment and care.
  • Relevant information from other health professionals, relatives or those who care for you.

We collect information from you in order to allow us to provide effective and safe care to you. We also use this data to evaluate the care we are providing directly to you to make sure it is of a high standard and to compare it against national standards, and findings from research evaluations of similar therapies. The utmost care is taken to ensure no individually identifiable information is disclosed.

If you choose to, you may personally opt to take part in research studies that run through the Service, or consent for your data to be used in research studies. Where this is the case, these studies will have been approved by the National Research Ethics Service, during which the processes for protection of your data and your privacy are scrutinised.

When and how we share your data

We will communicate with other NHS professionals involved in your care as necessary to ensure you receive appropriate support. As a minimum this is to let your GP know that you have started seeing one of our clinicians, and then to let them know that you have been discharged from the service. It is our normal practice to involve you / copy you into these communications.

Personal information conveyed to us will not be disclosed to non-NHS external organisations or members of the public (for example, your family members) without your explicit consent. The exception to this is if we believe that you or someone else is at serious risk. In this instance we may have to share this information with others. As far as possible this would be done with your knowledge and agreement.

If you have given consent to be invited to take part in research projects, your name and contact details may be given to researchers working with our Service. This will be done only when we believe that a particular study might be an appropriate match for you. All research projects will have been approved by the National Research Ethics Service, during which the processes for protection of your data and your privacy are scrutinised.

If you have given consent for audio-recordings of your therapy sessions to be used for training or research purposes by trainers who are part of our team, we will carefully select the training and research that these would be used for. None of those listening to your recordings will be told any additional identifying information about you. When using audio-recordings for training of clinicians who are not members of the AccEPT service, identifying information will be removed from any sections of recording played wherever possible.

How we protect your data

The information you give us may be stored in electronic or paper form, or a mixture of both. It is accessible to all practitioners, managers and administrative staff working with the AccEPT Service. However, some members of staff within the service will have limited access to information, if it is deemed they do not require it for their job role. All staff who access the information have completed the data protection training.

Where data is analysed for audit or service evaluation purposes the resulting reports will not allow any individual to be identified.

We will retain your health records for 20 years after you are discharged from the service.

Contacting you during and after your time with the AccEPT Service

Communications from us to you may be sent to you by letter, telephone, text or email. All patients of the service are asked which types of communication they prefer on joining; you can change your mind about your preferred methods of communication at any point.

If you have attended Mindfulness Based Cognitive Therapy (MBCT) within the AccEPT Service and have told us that you would like to be invited to future “refresher” sessions we will contact you with respect to these. If you do not respond to five invitations in a row we will assume you no longer wish to be invited and will not contact you again about these unless you ask us to.

Where you have given consent to be contacted about future research, we will assume this to expire after four years following you being discharged, unless your consent is renewed.

Your rights and the legal basis for data processing

You have the right to see what data we hold on you, and to request that any inaccurate data is corrected. You also have the right to give or withdraw consent for your data to be used for research or training purposes, at any time.

In the first instance please contact the AccEPT Service Co-ordinator on 01392 723493 or

You can also contact the University of Exeter Data Protection Officer (DPO). The DPO is responsible for monitoring compliance with relevant legislation in relation to personal data and can be contacted at You can also contact the DPO if you have any queries or concerns about the University’s processing of your personal data. You have the right to lodge a complaint with the Information Commissioner’s Office.

The legal basis for processing data within the AccEPT Service under the General Data Protection Regulation 2018 includes provision of explicit consent, the provision of direct patient care (provision of health or social care or treatment or the management of health or social care systems and services) and the performance of a task in the public interest (research purposes).

Other information

This Privacy Notice will be kept under review. Any changes will be updated on our website and communicated to you as appropriate. This Privacy Notice was last updated in May 2018.