Privacy Policy

1. Who we are

Health Education and Improvement Wales (HEIW), acting through the Welsh School of Anaesthesia, is the data controller for this application. The Welsh School of Anaesthesia operates the platform on behalf of HEIW to administer postgraduate medical education and training activities.

For questions about this Privacy Notice or your personal information, please contact:
Information Governance Team, Health Education and Improvement Wales
Email: HEIW.InformationGovernance@wales.nhs.uk
Operational queries relating to the platform may also be directed to: amrit.dhadda@wales.nhs.uk

2. What data we collect

• Account data: name, email address, and role (trainee, educator, or administrator).
• Booking data: courses you book, attendance records, and any feedback you provide.
• Reflective notes: optional reflective notes relating to educational activities.
• Device / technical data: IP address and browser type collected via standard server logs.
• Crash & diagnostic data: when the app or website crashes or hits an error we automatically collect a crash report — stack traces, in-app breadcrumbs, device model and OS version, and app version — together with a pseudonymous account identifier. Directly identifying details (such as your email) are scrubbed before the report is sent.

3. How we use your data

We use your data to:

• Provide course booking and management services.
• Send booking confirmations, reminders, and updates.
• Generate attendance reports and certificates.
• Improve our platform and training programmes.
• Detect, diagnose and fix crashes and errors, and monitor the stability of the app and website.

This platform is not intended to store patient-identifiable information or confidential clinical information. Users should not include patient-identifiable information within reflective notes or any other free-text fields.

4. Lawful basis

We process your personal information under Article 6(1)(e) UK GDPR because processing is necessary for the performance of a task carried out in the public interest and in the exercise of official authority vested in Health Education and Improvement Wales (HEIW) in relation to postgraduate medical education.

5. Data sharing

We do not sell your data. We may share it with:

• Course organisers and educators for operational purposes.
• Trusted third-party data processors acting on our behalf under strict confidentiality.

5a. Sub-processors

We use the following sub-processors to run the platform. Each is bound by a data processing agreement and processes personal data only on our instructions:

• Supabase — database, authentication and file storage for the platform.
• Cloudflare — application hosting, content delivery and DDoS protection.
• Lovable — application development platform used during development of the application.
• Sentry (EU region) — crash and diagnostic monitoring; personal identifiers are scrubbed before events are sent.
• Google and Apple — used only if you choose to sign in with those providers.
• Expo — push notification delivery to the iOS/Android app (if you have installed it).

5b. International data transfers

Our infrastructure is hosted in the United Kingdom / European Economic Area (EEA) wherever practicable. Some sub-processors (for example Cloudflare's global network, Google, Apple and Expo) may process limited data outside the UK/EEA. Where that happens we rely on the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an equivalent adequacy decision, so your data continues to receive an essentially equivalent level of protection.

6. Your rights

You have the right to access, correct, delete, or restrict the processing of your personal data. To exercise these rights, or to request account deletion, email our privacy lead at amrit.dhadda@wales.nhs.uk. You can also start a deletion request from our Delete Account page.

You can download a copy of the personal data we hold about you (data portability) at any time from the Settings page using the "Download my data" option.

6a. Data retention

Personal data is retained in accordance with HEIW Records Management and Information Governance policies.

6b. Who can access your information

Your personal information is accessible only to: you; authorised Welsh School of Anaesthesia administrators and STC members; authorised HEIW staff where required for postgraduate education administration.

6c. Complaints

If you have concerns about how your personal information has been handled, you should first contact HEIW's Information Governance Team. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): www.ico.org.uk.

6d. Personal data breaches

Any personal data breach involving this application will be managed in accordance with HEIW Information Governance policies.

7. Cookies

We use essential cookies to maintain your session and support core platform functionality. See our Cookie Policy for more details.

8. Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with a revised date.