HEIW Logo
Back

Privacy Policy

1. Introduction

Health Education and Improvement Wales (HEIW) (“we”, “us”, or “our”) is committed to protecting your personal data and respects your right to privacy. HEIW is a data controller responsible for your personal data pursuant to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act (DPA 2018).

Personal Data means any information about an individual from which that person can be identified.

The UK GDPR requires that data controllers provide certain information to people whose personal data they collect and process. A privacy notice is one way of providing this information, including information on how we collect, store, use and share (“process”) your personal data.

As a data controller, we process personal data in accordance with our statutory obligations to fulfil our designated functions. For example, to support the commissioning and delivery of education and training, as well as for workforce planning and development within NHS Wales.

Contact details for us and our Data Protection Officer

Our office address is at:

Ty Dysgu, Cefn Coed, Nantgarw, Rhondda Cynon Taf, CF15 7QQ

Our opening hours are: 8am to 6pm Monday to Friday.

HEIW has an appointed Data Protection Officer (DPO). If you would like to know more about this privacy notice, exercising your rights, or have concerns in relation to how your personal data is processed, please contact our DPO:

Data Protection Officer

HEIW has notified the Information Commissioner’s Office (ICO) that it is a data controller and processes personal data. Our ICO registration number is: ZA472183

2. About Health Education and Improvement Wales (HEIW)

Health Education and Improvement Wales (HEIW) is the statutory education and workforce body for NHS Wales. Established in 2018, we bring together workforce planning, education, and training in a single national organisation to build the skilled, sustainable workforce needed today and for the future.

If you would like to know more about what we do, and our functions, please visit the “about us” page on our website.

3. Why do we need personal data?

We process personal data for purposes directly related to our functions and obligations. This processing includes, but is not limited to:

  • Commissioning, planning, and delivery of training and education.
  • Developing workforce plans and delivering analytical insights to inform both current and future staffing needs.
  • Supplying you with the information you requested.
  • Handling any concerns, complaints or enquiries you submit to us.
  • Submitting information to regulatory bodies.
  • Auditing and monitoring our IT systems and services.
  • Engaging with you and obtaining feedback from you using surveys.

4. What personal data do we collect and use?

To meet our statutory obligations and provide our products and services, we process a range of personal data. We ensure that only the personal data required for each specific purpose is collected and processed. If your personal data is not provided directly to us, we may receive it from other organisations that participate in delivering education, training, or health services within Wales. Such organisations may include other NHS Wales bodies, public sector organisations, regulatory bodies, and suppliers.

We obtain personal data from various sources, including but not limited to:

  • Information provided by other NHS Wales organisations (e.g., Health Boards, Trusts).
  • Information provided by non-NHS Wales organisations (e.g., universities, regulatory bodies).
  • Information you provide directly to us (for example, details of those who subscribe to our newsletters or request a publication from us).
  • Surveying activities authorised by us or other organisations.

As a data controller, we process the following kinds of personal data:

  • Contact data: email addresses, addresses, postcodes, telephone numbers.
  • Identity data: including names, dates of birth, professional registration number, student number, national insurance number, employee number.
  • Training management information: including contact details, educational history, placements and records of progress.
  • Educational information: including contact details, records of attainment, records of attendance.
  • Health information: information about health and wellbeing (where necessary).
  • Equality and diversity information: information such as age, gender, ethnicity (where necessary).
  • Financial information: information about funding and bursaries.
  • Technical information: account registration details of users of our digital services and online identifiers, including IP addresses and cookie identifiers (collected when you visit websites HEIW are responsible for).

5. The lawful basis for what we do

Where HEIW is the data controller, we are required to have a lawful basis for processing personal data. The lawful bases we use are as follows:

  • Article 6(1)(a) - Consent: the data subject has given consent to the processing of his or her personal data for one or more specific purposes. Where consent is utilised, we will adhere to the high standards for consent as specified in data protection legislation, and particularly the conditions for consent as outlined in Article 7 of the UK GDPR. This ensures that your personal data is collected and managed appropriately. You have the right to withdraw your consent at any time, unless we are legally obligated to retain your personal data.
  • Article 6(1)(c) - Legal obligation: processing is necessary for compliance with a legal obligation to which the data controller is subject. We will identify the relevant legal obligation when we rely on this lawful basis.
  • Article 6(1)(e) - Public task: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
  • Article 6(1)(f) - Legitimate interests: processing is necessary for the purposes of legitimate interests pursued by the controller. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

Where we process special categories of personal data (special category data) such as information relating to health, racial or ethnic origin, or sexual life or sexual orientation, we need to meet an additional condition set out in Article 9 of the UK GDPR. Where we process special categories of personal data (as mentioned above), we will make sure that we only do so in accordance with one of the additional lawful grounds for processing. For example: where we have your explicit consent or for the performance of a task in the public interest.

Should you wish to learn more about legislation relating to privacy, please visit the Information Commissioner’s Office (ICO) website. The ICO deals with complaints about how data controllers have dealt with information matters and provides useful guidance.

6. Who personal data is shared with

In order to carry out our functions, we work with universities, regulators, local health boards, trusts, special health authorities, NHS Wales Shared Services Partnership (NWSSP), Welsh Government (WG) and our equivalent organisations in England, Scotland and Northern Ireland. This may involve the sharing of personal data from time to time. Where this is the case, Data Protection Impact Assessments (DPIAs) are carried out, and Data Sharing or Data Processing Agreements are used as appropriate.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes; and only permit them to process your personal data for specified purposes in accordance with our instructions.

It is important to note that anyone receiving information about you is under a legal duty to keep it confidential and to also comply with their respective obligations under the UK GDPR and DPA 2018. We only request, use and share the minimum information necessary for the purposes it is required.

We will never sell your personal data, and we will not share it without the appropriate legal authority and requirements.

7. How long we keep personal data

We keep personal data for as long as we need to fulfil the purpose(s) for which it was collected and to comply with our legal, regulatory, tax, accounting or reporting obligations. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

Our records are stored in line with the Records Management Code of Practice for Health and Social Care 2022 retention and disposal schedule. This schedule determines the minimum length of time records should be retained: Key documents - HEIW.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you. In some circumstances you can ask us to delete your data: see the paragraph below on Your Rights.

8. How we protect personal data

We acknowledge the significant value of your personal data and prioritise its security. We have implemented appropriate organisational and technical security measures to prevent your personal data from being lost, accessed, misused and used or disclosed in an unauthorised manner.

HEIW also employs a team who are responsible for managing information security and privacy to ensure:

  • Your personal data is protected; and
  • You are informed how it will be used.

Access to information is provided only to those who require it for their duties and is permitted on a “need-to-know” basis.

All staff are required to undertake information governance training every two years. This training has been defined to make sure that all staff working in HEIW (including the wider NHS) are aware of the importance of the confidentiality and security of personal data, regardless of the department they work in.

The UK GDPR introduced a duty on all organisations to report certain personal data breaches to the relevant supervisory authority within 72 hours of becoming aware of the breach, where this is feasible. We have put in place robust procedures to manage and respond to breaches. This facilitates an appropriate impact assessment and decision-making about notifying you and/or the Information Commissioner’s Office (ICO) where we are legally required to do so.

We have in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

9. Your rights

Data Protection legislation grants various rights concerning the processing of your personal data. These rights include the:

  • Right to be informed.
  • Right of access.
  • Right to rectification.
  • Right to erasure.
  • Right to restricted processing.
  • Right to data portability.
  • Right to object.
  • Rights relating to automated decision-making, including profiling.

HEIW ensures that appropriate arrangements are in place to manage your rights and to respond within the relevant statutory period of time. Some of these rights are explained below:

Each request to exercise one of the above rights will be assessed on its merits. Some rights such as the “right to erasure” might not apply where we are legally obligated to retain data to fulfil our statutory functions. Where we cannot comply with a request or part of a request, we will notify you, including the reasons why, at the time of your request.

The “right of access” gives you the right to access and receive a copy of your personal data. Exercising your right of access is commonly known as a subject access request (SAR). We try to answer all requests for access as quickly as possible, and we are obliged to provide a response to your request within one calendar month of receiving it. This can be extended if we have received repeated requests, or the request is considered complex and extensive.

You have the “right to rectification” to correct inaccurate personal data. If any personal data has been provided to HEIW and you feel that this is incorrect, you are entitled to request that we correct any mistakes, regardless of the context of the use. We must ensure that proven inaccurate or incomplete data is either corrected or erased. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.

In certain limited circumstances, you have the “right to restricted processing”. You can ask us to do this, for example, where you contest the accuracy of your data. You have the “right to object” to the processing of your personal data. This right is not absolute and we may continue to process the data if we can demonstrate compelling legitimate grounds. You also have the right to object to any decisions made by automated means that significantly affect you.

You will not have to pay a fee to access your personal data (or to exercise any of your rights). However, we may request a reasonable fee for large or repeated requests you make. This fee will reflect the operational cost of providing the information. For further details about these fees, please contact our Data Protection Officer.

10. Right to lodge a complaint

We try to meet the highest standards when collecting and using personal data. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of personal data is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.

If you wish to make a complaint about any issues you have experienced regarding your personal data, then please contact our Data Protection Officer.

You also have the right to submit a complaint to the supervisory authority. The Information Commissioner’s Office (ICO) is the UK supervisory authority for data protection issues. You can contact the ICO as follows:

Information Commissioner’s Office

Making a complaint: Make a complaint about how an organisation has used your personal information.

11. Use of automated decision making and profiling

HEIW also provides safeguards against risks that involve processes that include automated decision-making.

This applies when:

  • It is an automatic process; and
  • There is a legal effect on a decision made with the information.

Some areas of work within HEIW take a small number of automated decisions but there is mostly human involvement in this. For example, human involvement in the production of statistical data for reporting purposes or online questionnaire results will require a degree of automation to effectively specify, collate and download specific datasets to create reports and outcomes.

However, HEIW will take steps to identify how many automated decisions it makes and whether these are acceptable with each process. In turn, HEIW will ensure that any automated profiling is fair and lawful. HEIW will use correct procedures, to include reducing errors and correcting where data is not accurate.

12. Our websites

Visitors to our website

When visiting this website, we use a third-party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in an anonymous way, which does not identify anyone individually. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website. If we do want to collect personal data on our website, we will be open about this. We will make it clear when we collect personal data and will explain what we intend to do with it.

Google Analytics

Our websites may use Google Analytics, a web analytics service provided by Google Inc. (Google). Google Analytics uses “cookies” and JavaScript code to help analyse user activity on websites. The information generated about your use of the website (including your anonymised IP address) will be transmitted to and stored on Google servers in the United States.

Google will use this information to produce user activity reports for this website. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf.

Google will not associate your IP address with any other data previously held. You may refuse the use of cookies by selecting the appropriate settings on your browser. Please note that if cookies are disabled, you may not be able to use the full functionality of this website. By using HEIW’s websites, you consent to the processing of data about you by Google in the manner and for the purposes set out above.

Please read Google's Privacy notice and Google's Terms of Service for detailed information.

Use of Cookies

Cookies are small text files sent to your computer or mobile device by the websites that you visit. They help make websites work better and provide information to the owners of the site.

How we use cookies is set out in our cookie information page.

Why We Collect User Statistics

By understanding user behaviour and preferences, we are able to improve our website content to meet user expectations and needs.

13. People who contact us via social media

Links to HEIW Social Media channels are provided on our contact us page.

14. People who email us

We use Transport Layer Security (TLS) to encrypt and protect email traffic in line with the government. If your email service does not support TLS, you should be aware that any emails we send or receive may not be protected in transit.

We will also monitor any emails sent to us, including file attachments, for viruses or malicious software. Please be aware that you have a responsibility to ensure that any email you send is within the bounds of the law.

15. Virus Protection

We make every effort to check and test material for viruses. However, it is recommended that you run an anti-virus program on all materials downloaded from the internet. We cannot accept responsibility for any loss, disruption or damage to your data or computer system which may occur whilst using material derived from this website.

16. Disclaimer

Care is taken to ensure that the website content is accurate. Nevertheless, content is provided for general information only, and you use it at your own risk. We will not be held liable for damage or loss ensuing from any act or omission resulting from the use of information on this website.

17. External Websites

This privacy notice does not cover any linked websites. We encourage you to read the privacy notices on the other websites you visit. HEIW is not responsible for the content or reliability of any linked websites. We accept no liability in respect of the content or for the consequences of following any advice included on such websites. Listing should not be taken as an endorsement of any kind. We cannot guarantee that these links will work all of the time and have no control over the availability of the linked pages or change of website address. HEIW reserves the right to reject or remove links to any website.

18. Feedback

We welcome your feedback. If you contact us asking for information, we may need to contact other government departments to find that information. If your question is technical, we may need to pass it to our technology support (currently Digital Health and Care Wales (DHCW)).

We do not pass on any of your personal information when dealing with your enquiry unless you have given us permission to do so. Once we have replied to you, we keep a record of your message for audit and evaluation purposes.

19. Changes to this privacy notice

This privacy notice was last updated: 22/07/2026