Privacy Policy Privacy policy

This site is designed for modern web browsers and does not support your version of Internet Explorer.

Please use a different device e.g. smartphone or contact your IT department to upgrade your device to the latest versions of one of the browsers below:

GIG Cymru: Addysg a Gwella Iechyd Cymru (AaGIC) | NHS Wales: Health Education and Improvement Wales (HEIW)

Health Education and Improvement Wales (HEIW) Privacy Notice

Trainer Agreement Gateway (TAG)

NHS Wales is made up of several health organisations that include Health Education and Improvement Wales (HEIW) who have a leading role in the education, training, development, and shaping of the healthcare workforce in Wales, in order to ensure high-quality care for the people of Wales.

HEIW key functions include:

  • Working closely with partners and key stakeholders, and planning ahead to ensure the health and care workforce meets the needs of the NHS and people of Wales, now and in the future;
  • Being a reputable source of information and intelligence on the Welsh health and care workforce;
  • Commissioning, designing, and delivering high quality, value for money education and training, in line with standards;
  • Using education, training, and development to encourage and facilitate career progression;
  • Supporting education, training, and service regulation by playing a key role in representing Wales, and working closely with regulators;
  • Developing the healthcare leaders of today and the future;
  • Providing opportunities for the health and care workforce to develop new skills;
  • Promoting health and care careers in Wales, and Wales as a place to live;
  • Supporting the professional workforce and organisation development profession with Wales; and
  • Continuously improving what we do and how we do it.

If you have any questions regarding how your information is used you must contact the person shown at the bottom of this notice.

What is TAG?

The Trainer Agreement Gateway (TAG) is a system for administering and managing the All Wales Medical Trainer Agreement (Secondary Care and Undergraduate Education). The system also holds a record of all recognised trainers and is used to inform the GMC of the individuals whose trainer status needs to be reflected on the List of Registered Medical Practitioners. 

Your rights

This privacy notice is intended to provide transparency and accountability regarding what personal data, via TAG, Health Education and Improvement Wales (HEIW) will collect about you, how it will be processed and stored, how long it will be retained, who will have access to your data and your rights.

The information we give you about our use of your information will be:

  • Brief, easy to read and easily accessible;
  • Written in clear, plain language; and
  • Free of charge.

What personal data is collected?

Personal data is information from which an individual can be identified either directly or indirectly when the information is read in conjunction with other data that a data controller holds.

Users of TAG should be aware that this privacy notice applies to all the processing of your personal data by HEIW in relation to any information provided to us regarding your Trainer role. By using, registering or submitting any information on TAG you consent to the collection, use, storage and transfer of your information under the terms of this Privacy Notice.

Data items collected are as follows:

  • Last name         
  • First name
  • Employing Health Board/Trust/Medical School
  • Site
  • Specialty
  • Trainer Type
  • GMC number    
  • Email address     
  • Any other information pertinent to the effective management of a trainer’s role

What laws do we use?

The law determines how we can use information. The laws we follow that allow us to use identifiable information are listed below:

  • General Data Protection Regulation
  • UK Data Protection Bill
  • Human Rights Act
  • Freedom of Information Act
  • Common Law Duty of Confidence - Confidentiality
  • Computer Misuse Act
  • Audit Commission Act
  • Regulation of Investigatory Powers Act

Health Education and Improvement Wales (HEIW) is the organisation that administrates the processes that involves the collection of specific data through the work of many areas including TAG. HEIW is the holder and user of your information for these processes.

Why your personal data is collected

Your personal data is collected and held for the purposes of implementing formal recognition of Trainers as required of the Education Organisers by the General Medical Council  (GMC)[1].  Those purposes include -

1. To manage your recognition as a Trainer.

2. To support local and national quality systems ensuring that standards are maintained including, but not confined to, the GMC National Trainer Survey.

3. To support management of training programmes – Your data will be used to determine outputs from programmes and to inform the number of Trainers required for specialties in the future.

4. To maintain patient safety through the management of performance concerns – Your personal data may be shared with the GMC should there be significant concerns regarding your fitness to practise.

5. To comply with legal and regulatory responsibilities including revalidation.

6. To contact you about development opportunities, events, surveys and information that may be of interest to you in your Trainer role.

The functions of the Education Organisers are carried out in the public interest. The processing of Trainers’ personal data is necessary for the purposes of those functions.  

How your personal data is collected 

Personal data is collected when you submit a signed Medical Trainer Agreement and set up an account in TAG.  Personal data may also be obtained from Local Education Providers or employing organisations and other relevant organisations to fulfil the functions of the Education Organisers in relation to delivery of Trainer roles.

How your personal data is kept secure

Access to your personal data is restricted to the authorised team within the Education Organisers that manage your recognition as a Trainer. Access is also granted on a limited basis to recipients such as Faculty Leads (Trainers), Training Programme Directors, Heads of Specialty Schools and Medical Education/Postgraduate Centre Managers but only where necessary for a specified and legitimate purpose.

Your personal data will be retained for six years after you have left a Trainer role, at which point your personal data will be confidentially and securely destroyed.

How and why your personal data may be shared

The Education Organisers process your personal data in order to manage your recognition as a Trainer. This information is kept in a database of Trainers in Wales.

Your personal data may be shared with –

  • The GMC for inclusion of your Trainer status on the LRMP
  • The GMC should there be concerns regarding an individual’s fitness to practise
  • Local Education Providers to support management of training programmes and to support local quality control
  • Third parties for reporting or research purposes

The Education Organisers will only transfer your personal data to third parties using secure channels and where it is needed to manage your Trainer role, for example when notifying the GMC of recognised Trainers for publication of Trainer status on the List of Registered Medical Practitioners (LRMP).

The Education Organisers will not transfer your data unless it is satisfied of the following matters:

  1. That there is a fair and lawful basis to share your personal data with the third party. 
  2. The data will be handled by the third party in accordance with the law on data protection.

Where the data is used for analysis and publication by a recipient or third party, any publication will be on an anonymous and aggregated basis and will not make it possible to identify any individual. This will mean that the data ceases to become personal data.

Third parties may include the following non-exhaustive list: the UK health departments, Colleges/Faculties, other deaneries, the GMC, NHS Trusts/Health Boards/Health and Social Care Trusts and approved academic researchers.

Security of your Information

HEIW takes responsibility to look after your personal information very seriously. This is regardless of whether it is electronic or in paper form.

We also employ someone who is responsible for managing information and its confidentiality to ensure:

  • your information is protected; and
  • inform you how it will be used.

All staff are required to undertake training on a regular basis. Comprehensive training is required to help protect the information that has been given, used, processed by HEIW.

The training makes sure that all staff working in HEIW (including the wider NHS), are aware of their responsibilities about the handling of your information regardless of the department that they work in.

Your rights and responsibilities

It is important that you work with us to ensure that the information we hold about you is accurate and up to date. Please inform us if any of your personal data needs to be updated or corrected.

All communications from HEIW will normally be by email. It is therefore essential for you to maintain an effective and secure email address or you may not receive information or other important news and information about your Trainer role.

Where identifiable and relevant, HEIW will make sure that you are able to have access to your information. This is so that you know what we hold.

You have the right:

  • To know about details of how your information is used; and
  • Have copies of your information.

Legitimate interest

HEIW and all of its services have a “legitimate interest” in continuing to process personal data where:

  1. there is a real business interest being pursued in continuing to process the personal data;
  2. the processing is absolutely necessary in order for the business to pursue that interest (i.e. the interest cannot be pursued in another way which is proportionate); and
  3. the processing is balanced against the impact such processing will have on the fundamental rights and freedoms of data subjects.

It is important that you understand who is responsible for keeping your data safe. We collect your personal data with your express consent for purposes set out in this Privacy Notice.

The lawful basis for processing is set out in the GDPR Article 6. In this case, the function of this system is to quality assure training for which the processing of personal data is necessary. As a result, you do not have the right to erasure.

For more information about Article 6, please refer to the following link:

If you have any concerns in relation to how your personal data is processed, please contact:

HEIW (for postgraduate trainers):

Cardiff University School of Medicine (for undergraduate trainers):

Swansea University Medical School (for undergraduate trainers):

Should you wish to learn further information about legislation relating to confidentiality, please visit the Information Commissioner's Office (ICO) website. The ICO deals with complaints about how data controllers have dealt with information matters and provides useful guidance.

Making a complaint

If you wish to make a complaint about any issues you have experienced regarding your information, then please contact:

Dafydd Bebb
Ysgrifennydd y Bwrdd/Board Secretary
Addysg a Gwella Iechyd Cymru/Health Education and Improvement Wales
Ffôn/Tel: 079 7130 0537

If you are still unsatisfied following your complaint and this remains unresolved, you have the right to make a complaint to the:

Information Commissioner’s Office,

2nd Floor,
Churchill House
17 Churchill Way
Cardiff, CF10 2HH



Further information

For more information relating to this privacy notice or questions on the content, please contact:

Addysg a Gwella Iechyd Cymru (AaGIC) / Health Education and Improvement Wales (HEIW)

Ffôn/Tel:  03300 584 219 e-bost/email:

[1] General Medical Council - ‘Recognising and approving trainers: the implementation plan’ (August 2012)