Privacy Notice

Introduction

Health Education and Improvement Wales ('HEIW’) (“we”, “us”, or “our”) are committed to protecting your personal data and respects your right to privacy. This privacy notice is intended to provide you with information about the Codi application and to provide transparency regarding what personal data we collect about you, why we need it and how we use it, the lawful basis we have for processing it, who we share your personal data with, how long we keep your personal data, how we secure personal data, your privacy rights, and how to contact us including how to make a complaint to the supervisory authority.

('Personal Data') means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

HEIW is the organisation that manages the collection of specific data through various processes, including the Codi application. For these purposes, HEIW is the Data Controller.

Who are we?

HEIW is the strategic workforce body for NHS Wales. We have a leading role in the education, training, development, and shaping of the healthcare workforce in Wales, in order to ensure high-quality care for the people of Wales.

As a Special Health Authority ('SHA'), we have a unique contribution to make in addressing strategic and specialist workforce issues, making Wales a great place to train and work for our health and care staff and maximising the contribution of all professions and occupations through our statutory functions.

Our Statutory Functions

Our strategic work is underpinned by our eight statutory functions. These include:

  • Education and training: HEIW plan, commission, deliver, and quality manage undergraduate and postgraduate healthcare education and training. It also develops healthcare apprenticeship frameworks in partnership with the Welsh Government.
  • Leadership development: HEIW provides leadership guidance which focuses on compassionate and collective leadership. It also identified and nurtures talent among those who aspire to become Directors and Chief Executives.
  • Workforce strategy, planning, and intelligence: HEIW helps others in NHS Wales develop workforce plans and provide analytical insight. This helps to support the current and future workforce.
  • Workforce development and transformation: HEIW supports change that responds to significant service challenges, including skills development, role design, and improving career pathways.
  • Professional support: HEIW supports organisational and workforce development within Wales.
  • Quality: HEIW improves education and training by collaboratively developing standards for guidance and strategies.
  • Careers and widening access: HEIW promotes careers in healthcare and ensure these opportunities are available to everyone. It also supports people with valuable skills and experience who are under-represented in the NHS workforce pursue a healthcare career.
  • Retention: HEIW works with partners to embed health and wellbeing into NHS Wales. This helps encourage professional to stay in NHS Wales.

What is the Codi application?

Codi is an innovative application, developed by HEIW which unifies legacy applications into a seamless and accessible digital solution for NHS Wales resident doctors, dentists, pharmacists and optometrists in training ('resident professionals'), trainers and other non-training grade medical professionals. The database holds information about postgraduate training, educational supervision and the management of leave applications for resident professionals, non-training grade medical professionals and trainers in Wales.

What laws do we use?

The law determines how we can use information. In those areas where we use personal data and identifiable information, the laws we follow that allow this to happen are listed below:

  • Data Protection Act 2018
  • UK General Data Protection Regulation
  • Freedom of Information Act 2000
  • Human Rights Act
  • Common Law Duty of Confidentiality
  • Computer Misuse Act 1990
  • Audit Commission Act
  • Regulation of Investigatory Powers Act

What personal data do we collect?

To fulfil our functions and to provide the Codi application, we collect, store, and use a range of personal data ('processing').

The categories of data processed include:

  • Personal details including name, address, email address, date of birth.
  • Other identifying details such as professional registration number, national training number, national insurance number.
  • Information relating to education, qualifications, training and specialties.
  • Placement, training programme, leave, and workplace information.
  • Optional equality and diversity information.
  • Online identifiers including IP addresses and cookie identifiers when you visit or use the Codi application.

How we use your personal data

We process personal data necessary for the task that we are carrying out. Personal data will therefore be processed for the following reasons:

  • Providing authorised users access to the Codi application and its features.
  • Supporting the management of training programmes, resident professionals’ placements and Annual Review of Competence Progression ('ARCP').
  • Managing study and annual leave for resident professionals during periods of training.
  • Managing annual leave for non-training grade medical professionals.
  • Providing details of educational and clinical supervisors in relation to their supervision of resident professionals’ progress.
  • Supporting national General Medical Council ('GMC') reporting requirements.
  • Workforce intelligence and modelling using a Data Warehouse (‘DW’).

How your personal data is collected?

Personal data is collected from the point of recruitment to a training programme in Wales or the confirmation of supervisor status for trainers. HEIW records data for non-training grade medical professionals under a supervisory or approval role by staff in Local Health Boards. HEIW may be requested to report on this data, but we do not use it for our own reporting purposes.

The lawful basis for what we do

Data protection legislation requires us to tell you about the lawful basis for processing personal data in the way we do. We rely on the following lawful basis to process your personal data:

  • Public task: where processing is necessary for us to perform a task in the public interest or in the exercise of our official functions.

Where we process special categories of personal data, we will make sure that we only do so in accordance with one of the additional lawful grounds for processing. For example: the performance of a task in the public interest.

If you have any concerns in relation to how your personal data is processed, please notify the Data Protection Officer (please refer to the Contact us section of this privacy notice).

Who personal data is shared with

Access to the Codi application and data as appropriate is restricted to authorised teams in HEIW and Local Health Boards responsible for managing the Codi application and your training.

Aggregated, anonymised reports may be produced within HEIW to provide comparative analysis. At no point will any individuals be identified in these reports.

Some reports prepared for third parties including Local Health Boards, NHS Wales Shared Services Partnership ('NWSSP'), Welsh Government (‘WG’) or other national bodies such as the General Medical Council ('GMC') may identify individuals. These reports are reported using a secure portal and are only made available to authorised staff in HEIW and the recipient organisation. Local Health Boards in Wales also produce reports which may identify individuals to satisfy local reporting requirements. In this instance, it is the Local Health Board who is responsible for any data sharing with a third party.

We will not share your data with a third party unless it is for the following reasons:

  • There is a fair and legal basis to share your personal data with the third party (this is accessed for fair and legal purposes at every eventuality).
  • The data will be handled by the third party in accordance with their own arrangements on Data Protection legislation and will only be shared if they demonstrate their own compliance with the law.

Where data is used for analysis and publication by a recipient or third party, any publication will be on an anonymous and aggregated basis and will not make it possible to identify any individual. This will mean that the data ceases to become personal data.

Third parties may include the following bodies or organisations:

  • NHS Wales Local Health Boards and Trusts
  • Welsh Government
  • UK Health Departments
  • Equivalent Health Organisations in England, Scotland, and Northern Ireland
  • Universities, Colleges, and Faculties
  • Other relevant Deaneries
  • General Medical Council ('GMC')
  • Approved Academic Researchers
  • NHS Wales Shared Services Partnership ('NWSSP')

How long we keep personal data

We keep personal data for as long as we need to fulfil the purpose(s) for which it was collected and to comply with our legal and regulatory obligations. Records are stored in line with the Records Management Code of Practice for Health and Social Care 2022 retention and disposal schedule. This schedule determines the minimum length of time records should be retained.

How do we secure personal data

We acknowledge the significant value of your personal data and prioritise its security. We have implemented appropriate organisational and technical security measures to prevent your personal data from being lost, accessed, misused and used or disclosed in an unauthorised manner.

HEIW also employs a team who are responsible for managing information security and privacy to ensure:

  • your personal data is protected; and
  • inform you how it will be used.

Access to information is provided only to those who require it for their duties and is permitted on a 'need-to-know' basis.

All staff are required to undertake information governance training every two years. This training has been defined to make sure that all staff working in HEIW (including the wider NHS), are aware of the importance of the confidentiality and security of personal data, regardless of the department they work in.

Your rights

This privacy notice covers the rights of data use under the UK General Data Protection Regulation ('UK GDPR'). It emphasises HEIW’s need to make sure that we explain how we process your personal data.

The information we provide you about our use of personal data will be:

  • Brief, easy to read and easily accessible;
  • Written in clear, plain language; and
  • Free of charge.

Data Protection legislation grants various rights concerning the processing of your personal data, these rights include the:

  • Right to be informed.
  • Right of access.
  • Right to rectification.
  • Right to erasure.
  • Right to restricted processing.
  • Right to data portability.
  • Right to object.
  • Rights relating to automated decision-making including profiling.

HEIW ensures that appropriate arrangements are in place to manage your rights and to respond within the relevant statutory time period. Some of these rights are explained below:

Each request to exercise one of the above rights will be assessed on its merits. Some rights such as the 'right to erasure' might not apply where we are legally obligated to retain data to fulfil our statutory functions. Where we are not able to comply with a request or part of a request, we will notify you including the reasons why at the time of your request.

The 'right of access' gives you the right to access and receive a copy of your personal data. Exercising your 'right of access' is commonly known as a subject access request (SAR). We try to answer all requests for access as quickly as possible and we are obliged to provide a response to your request within a month of receiving it. This can be extended if we have received repeated requests, or the request is considered complex and extensive.

Your personal data will be provided free of charge. However, we may request a small fee for large or repeated requests you make. This fee will reflect the operational cost of providing the information. For further details about these fees, please contact the Data Protection Officer.

You have the 'right to rectification' to correct inaccurate personal data. If any personal data has been provided to HEIW and you feel that this is incorrect, you are entitled to request that we correct any mistakes, regardless of the context of the use. We must ensure that proven inaccurate or incomplete data is either corrected or erased.

In certain limited circumstances, you have the 'right to restricted processing'. You can ask us to do this for example where you contest the accuracy of your data. You have the 'right to object' to the processing of your personal data. This right is not an absolute and we may continue to process the data if we can demonstrate compelling legitimate grounds. You have the right to object to any decisions made by automated means that significantly affect you.

For detailed information regarding your rights, please refer to the guidance provided by the supervisory authority. The Information Commissioner’s Office ('ICO') is the UK supervisory authority for data protection: For the public | ICO

If you would like to know more about your rights, exercising your rights or have any concerns in relation to how your personal data is processed, please contact the Data Protection Officer for further information.

Analytics and Cookies

Google Analytics

We monitor user activity to enhance content provided on this site. This application uses Google Analytics, a web analytics service provided by Google Inc. ('Google'). Google Analytics uses 'cookies' and JavaScript code to help analyse user activity on websites. The information generated about your use of the website (including your anonymised IP address) will be transmitted to and stored on Google servers in the United States.

Google will use this information to produce user activity reports for this website. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf.

Google will not associate your IP address with any other data previously held. You may refuse the use of cookies by selecting the appropriate settings on your browser. Please note that if cookies are disabled, you may not be able to use the full functionality of this website. By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.

If you would like to know more, please read Google's Privacy Policy and Google's Terms of Service for detailed information.

Use of cookies

Cookies are small text files sent to your computer or mobile device by the websites that you visit. They help make websites work better and provide information to the owners of the site.

When you visit or use the Codi application, we may collect data from you using cookies. How we use cookies is set out in our Cookies Policy.

Use of automated decision making and profiling

The Codi application is not used to undertake automated decision-making or profiling.

Links to other websites

This privacy notice does not cover links within the Codi application linking to other websites. We encourage you to read the privacy notices on the other websites you visit.

Changes to this privacy notice

This privacy notice was last updated 6 November 2025.

Contact Us

If you would like to know more about this privacy notice, exercising your rights or have concerns in relation to how your personal data is processed, please contact the Data Protection Officer:

Data Protection Officer / Swyddog Diogelu Gwybodaeth
Addysg a Gwella Iechyd Cymru / Health Education and Improvement Wales
Tŷ Dysgu
Cefn Coed
Nantgarw
CF15 7QQ

Tel: 03300 585 005
Email: HEIW.informationgovernance@wales.nhs.uk

Right to complain

We try to meet the highest standards when collecting and using personal data. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of personal data is unfair, misleading, or inappropriate. We would also welcome any suggestions for improving our procedures.

If you wish to make a complaint about any issues you have experienced regarding your personal data, then please contact the Data Protection Officer.

You also have the right to submit a complaint to the supervisory authority. The Information Commissioner’s Office ('ICO') is the UK supervisory authority for data protection issues. You can contact the ICO:

Information Commissioner’s Office
2nd Floor, Churchill House
17 Churchill Way
Cardiff
CF10 2HH

Telephone: 0303 123 1113
Email: wales@ico.org.uk

Website: Information Commissioner's Office
Make a complaint: Make a complaint | ICO