The purpose of this notice is to let you know how we handle your personal information, and your rights with regard to it.
The University of Exeter is the data controller with respect to the AccEPT Service and is committed to protecting your personal data and working in accordance with all relevant data protection legislation.
The health care professionals who provide you with care maintain records about your health. These records help to provide you with the best possible healthcare. Records which the AccEPT Service holds about you may include the following information;
- Details about you, such as your address, contact details, gender and ethnicity.
- Any contact the Service has had with you, such as appointments and letters sent and received.
- Notes and reports about your health.
- Details about your treatment and care.
- Relevant information from other health professionals, relatives or those who care for you.
We collect information from you in order to allow us to provide effective and safe care to you. We also use these data to evaluate the care we are providing directly to you to make sure it is of a high standard and to compare it against national standards, and findings from research evaluations of similar therapies. The utmost care is taken to ensure no individually identifiable information is disclosed.
If you choose to, you may personally opt to take part in research studies that run through the Service, or consent for your data to be used in research studies. Where this is the case, these studies will have been approved by the National Research Ethics Service, during which the processes for protection of your data and your privacy are scrutinised.
We will communicate with other NHS professionals involved in your care as necessary to ensure you receive appropriate support. As a minimum this is to let your GP know that you have started seeing one of our clinicians, and then to let them know that you have been discharged from the service. It is our normal practice to involve you / copy you into these communications.
Personal information conveyed to us will not be disclosed to non-NHS external organisations or members of the public (for example, your family members) without your explicit consent. The exception this is if we believe that you or someone else is at serious risk. In this instance we may have to share this information with others. As far as possible this would be done with your knowledge and agreement.
If you have given consent to be invited to take part in research projects, your name and contact details may be given to researchers working with our Service. This will be done only when we believe that a particular study might be an appropriate match for you. All research projects will have been approved by the National Research Ethics Service, during which the processes for protection of your data and your privacy are scrutinised.
If you have given consent for audio-recordings of your therapy sessions to be used for training or research purposes by trainers who are part of our team, we will carefully select the training and research that these would be used for. None of those listening to your recordings will be told any additional identifying information about you. When using audio-recordings for training of clinicians who are not members of the AccEPT service, identifying information will be removed from any sections of recording played wherever possible.
The information you give us may be stored in electronic or paper form, or a mixture of both. It is accessible to all practitioners, managers and administrative staff working with the AccEPT Service. However, some members of staff within the service will have limited access to information, if it is deemed they do not require it for their job role. All staff who access the information have completed the data protection training.
Due to the need for remote working during the COVID-19 pandemic our staff may be working from home. As a Service we have procedures and protocols for maintaining the security of your information during home-working.
Where data are analysed for audit or service evaluation purposes the resulting reports will not allow any individual to be identified.
We will retain your health records for 20 years after you are discharged from the service.
As a Service we make every effort to protect the security of the data we process, however absolute protection cannot be guaranteed, as it is not possible for any healthcare provider to remove all threats to data security completely. We undertake to continually monitor and review our practices and to act rapidly should any issues be detected.
Communications from us to you may be sent to you by letter, telephone, text or email. All patients of the service are asked which types of communication they prefer on joining; you can change your mind about your preferred methods of communication at any point.
If you attend an online therapy course with us, you should be aware that the internet platform we use has been approved for this purpose by the University of Exeter, in line with the security standards expected by the NHS. For group-based therapies all attendees will be asked to agree to a code of conduct in order to protect one another’s personal information.
If you have attended Mindfulness Based Cognitive Therapy (MBCT) within the AccEPT Service and have told us that you would like to be invited to future “refresher” sessions we will contact you with respect to these. If you do not respond to five invitations in a row we will assume you no longer wish to be invited and will not contact you again about these unless you ask us to.
Where you have given consent to be contacted about future research, we will assume this to expire after four years following you being discharged, unless your consent is renewed.
You have the right to see what data we hold on you, and to request that any inaccurate data is corrected. You also have the right to give or withdraw consent for your data to be used for research or training purposes, at any time.
In the first instance please contact the AccEPT Service Co-ordinator on 01392 723493 or firstname.lastname@example.org
You can find out more about your data rights, and how to access your data, on the University of Exeter’s webpages at: http://www.exeter.ac.uk/dataprotection/rights/ and http://www.exeter.ac.uk/dataprotection/request/You can also contact the University of Exeter Data Protection Officer (DPO: http://www.exeter.ac.uk/dpo/). The DPO is responsible for monitoring compliance with relevant legislation in relation to personal data and can be contacted at email@example.com. You can also contact the DPO if you have any queries or concerns about the University’s processing of your personal data. You have the right to lodge a complaint with the Information Commissioner’s Office www.ico.org.uk/concerns.
The legal basis for processing data within the AccEPT Service under the General Data Protection Regulation 2018 includes the provision of direct patient care (provision of health or social care or treatment or the management of health or social care systems and services) and the performance of a task in the public interest (research purposes).
Whenever you use a health or care service important information about you is collected in a patient record for that service. Collecting this information helps to ensure you get the best possible care and treatment.
The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:
- improving the quality and standards of care provided
- research into the development of new treatments
- preventing illness and diseases
- monitoring safety
- planning services.
This may only take place when there is a clear legal basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law.
You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt-out your confidential patient information will still be used to support your individual care.
Most of the time in the AccEPT Service, and in other Services, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information isn’t needed.
To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters.
We are always keen to hear about what we can improve. Below are some examples of your feedback and our responses.
You can collect a feedback form from reception after your first visit to the Service. At the end of your treatment you will be invited to complete a survey on your experience of treatment here. In the meantime you can call or email us with any comments: 01392 723493 / firstname.lastname@example.org
As part of your care we may recommend NHS-approved online resources that offer mental health information, advice and support, and for some of these you may need to create a user account with your email address. The information that you give to these resources will be protected and processed in line with their privacy policies, and will not be stored or processed by the AccEPT Service. You are under no obligation to use these resources; we will endeavor to provide an alternative should you require it.
If you attend one of our Mindfulness groups you may be invited to make use of a “Smart messaging” text messaging system. This makes use of an external text messaging system (Florence) which is frequently used in the NHS to enhance patient care. The information you provide on this system is accessible only by the clinic team, with the exception of any required external audits of the text messaging system.
This Privacy Notice will be kept under review. Any changes will be updated on our website and communicated to you as appropriate. This Privacy Notice was last updated in October 2019.
If you have any questions regarding this privacy notice please do not hesitate to contact us on 01392 723493 or email@example.com.