Health Education and Improvement Wales (HEIW) Privacy Notice - Y Ty Dysgu

Introduction

NHS Wales is made up of several health organisations that include Health Education and Improvement Wales (HEIW) who have a leading role in the education, training, development, and shaping of the healthcare workforce in Wales, in order to ensure high-quality care for the people of Wales.

Established on 1st October 2018, Health Education and Improvement Wales (HEIW) brings together three key organisations for health: the Wales Deanery; NHS Wales’s Workforce Education and Development Services (WEDS); and the Wales Centre for Pharmacy Professional Education (WCPPE).

What is the Y Ty Dysgu system?

Y Ty Dysgu, hosted by CDSM on behalf of HEIW, is a learning and event management system with associated virtual learning environment. The system facilitates the delivery, monitoring and evaluation of educational resources and events developed by HEIW. Limited and specific access is also available for Health Boards in Wales. The system holds information relating to HEIW and Health Board staff users and their associated learners and event delegates.

Your personal data is collected to support HEIW’s management of the courses and events run via the system. Personal data is collected from the point of creating an account to access the system and during relevant course assessments.

Your rights

This privacy notice is intended to provide transparency and accountability regarding what personal data via Y Ty Dysgu on behalf of Health Education and Improvement Wales (HEIW) will be collected about you, how it will be processed and stored, how long it will be retained, who will have access to your data and your rights.

The information we give you about our use of your information will be:

• Brief, easy to read and easily accessible;
• Written in clear, plain language; and
• Free of charge.

Where information collected on you is identifiable and relevant, HEIW will make sure that you are able to have access to this. This is so that you know what we hold.

You have the right:

• to know about details of how your information is used; and
• have copies of your information.

If you wish to know more, please contact the person listed below for further information about your rights of access.

What about rights to correct or delete inaccurate information?

If any personal data has been provided by yourself and you feel that this is incorrect, you are entitled to request that HEIW correct any mistakes in this information, regardless of the context of the use.HEIW must ensure that proven inaccurate or incomplete information is either erased or corrected.

What laws do we use?

The law determines how we can use information. In those areas where we use identifiable information, the laws we follow that allow this to happen are listed below:

• Data Protection Act 2018
• Freedom of Information Act
• Human Rights Act
• Common Law Duty of Confidentiality
• Computer Misuse Act
• Audit Commission Act
• Regulation of Investigatory Powers Act

Health Education and Improvement Wales (HEIW) is the organisation that administrates the processes that involves the collection of specific data through the work of many areas including Y Ty Dysgu. For these purposes, HEIW is the data controller. HEIW processes information in line with Article 6 1 (e) Public, and the HEIW Establishment Order (2017).

Why and how your personal data is collected via Y Ty Dysgu

Your personal data is collected to support HEIW’s management of the courses and events run via the system. Personal data is collected from the point of creating an account to access the system and during relevant course assessments.

What information do we collect?

• Email address
• First name and last name
• Organisation
• Job Title
• Course assessment data
• Cookies and usage data
• Address
• Telephone number
• Details of professional registration

We may also collect information on how the Service is accessed and used ("Usage Data"). This Usage Data may include information such as your computer's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

We use cookies and similar tracking technologies to track the activity on our Service and hold certain information.

Cookies are files with small amount of data which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your device. Tracking technologies also used are beacons, tags, and scripts to collect and track information and to improve and analyse our Service. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service.

Examples of Cookies we use:

• Session Cookies: We use Session Cookies to operate our Service.
• Analytics Cookies: We use analytics to measure how you use our website so we can improve it based on our needs.
• Preference Cookies: We use Preference Cookies to remember your preferences and various settings.
• Security Cookies: We use Security Cookies for security purposes.

Security of your Information

HEIW takes responsibility to look after all information very seriously. This is regardless of whether it is electronic or in paper form and whether it is identifiable or not.

All staff are required to undertake training on a regular basis. The training makes sure that all staff working in HEIW (including the wider NHS), are aware of their responsibilities about the handling of your information regardless of the department that they work in.

HEIW Information Governance pages can be found here https://heiw.nhs.wales/about-us1/information-governance/

Keeping your information

We will only store information for as long as necessary dependant on the type and use.

Records are stored in line with Records Management Code of Practice for Health & Social Care’s retention and disposal schedule. This determines the minimum length of time records should be kept.

HEIW will retain data in order to comply with legal requirements.

Sharing your information

Staff members employed by HEIW and by the Health Boards with specific authorised roles will have access to data entered into Y Ty Dysgu as appropriate.

Your personal data may be shared with HEIW, Health Board staff and Professional bodies including individual contractors for lawful purposes only, in line with our public task. This may include information about your training completion.

HALI AI-enabled chatbot

HALI is an AI-enabled chatbot, embedded in Y Ty Dysgu and powered by Amazon Bedrock (Claude LLM). It offers conversational explanations of how AI can be applied in different healthcare roles and includes reflective prompts to reinforce safe, critical engagement, giving users a safe place to learn AI. HALI is strictly educational; it gives no clinical instructions and is not intended to support diagnostic or therapeutic decisions. Chatbot conversations will not be subject to audit.

Outputs generated by all AI tools should be treated with caution and should not be relied upon as fully accurate, this includes Welsh language translation generated by HALI. An introductory safe use statement and disclaimer, which uses trusted HEIW sources and reminds users of its limitations, is presented to users before they engage with HALI. Users are warned not to paste confidential information such as personal or patient data or commercially / business sensitive information into queries or prompts, doing so could lead to unintended exposure or data breaches. Claude’s native guardrails are in place to protect against malicious prompts that try to bypass safety rules.

An evaluation mechanism is in place for users to provide feedback.

Additional guidance developed by HEIW is available on prompt engineering and safe AI use:

Prompt Engineering - how to get the best answers from Generative AI - GPTs HEIW User Guide

Safeguard AI Practices - Guardrails for Safe AI User Guide

Reporting

Reports may be produced on the completion of learning materials and grades awarded which identify individuals.

Aggregated, anonymised reports may also be produced within HEIW to provide comparative analysis, at no point will any individuals be identified in these reports. Some reports to third parties (i.e. Health Boards, NWSSP or national bodies such as Welsh Government) do identify individuals but these are reported and sent in a secure way by only nominated, authorised staff in both HEIW and the receiving organisation. Health Boards in Wales will also produce reports identifying individuals for local reporting requirements. In this instance, it is the health board and not HEIW who is responsible for any data sharing with a third party.

HEIW will not transfer your data to a third party unless it is for the following:

1. That there is a fair and lawful basis to share your personal data with the third party (this is accessed for fair and legal purposes at every eventuality).

2. The data will be handled by the third party in accordance with their own arrangements on Data Protection legislation and will only be shared if they demonstrate their own compliance with the law.Where the data is used for analysis and publication by a recipient or third party, any publication will be on an anonymous and aggregated basis and will not make it possible to identify any individual. This will mean that the data ceases to become personal data.

Third parties may include the following:

• UK health departments,
• Colleges/Faculties,
• other deaneries,
• Professional bodies such as GMC, GDC, GPhC
• NHS Trusts/Health Boards/Health and Social Care Trusts and approved academic researchers
• NWSSP

Making a complaint

We try to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We are happy to provide any additional information or explanation needed. Any requests for this should be sent to the address below.

If you wish to make a complaint about any issues you have experienced regarding your information, then please contact:

Data Protection Officer/ Swyddog Diogelu Gwybodaeth
Addysg a Gwella Iechyd Cymru/Health Education and Improvement Wales,
Tŷ Dysgu,
Cefn Coed,
Nantgarw,
CF15 7QQ

Email: HEIW.informationgovernance@wales.nhs.uk

If you are still unsatisfied following your complaint and this remains unresolved, you have the right to make a complaint to the:

Information Commissioner’s Office,
2nd Floor, Churchill House,
17 Churchill Way,
Cardiff,
CF10 2HH

Email: wales@ico.gsi.gov.uk
Website: www.ico.org.uk

Further information

For more information relating to this privacy notice or questions on the content, please contact:

Health Education and Improvement Wales (HEIW)

email: heiw.digital@wales.nhs.uk