Page content:
...
- Decide on the content of the Privacy Policy, Cookie Policy and Terms and Conditions.
- Review outstanding questions with Andrew Todd and Chris Brady.
- Include List all cookies in use by TIS application on Cookie Policy.
- To be discussed: Solution design with devs and UX/UI: Some level of design work may be required with regards to where and how it needs to be displayed with options to accept/decline for
- users who are logging in for the first time, .e.g. HEE admins, Trust users, Programme role users, TPD's
- trainees completing registration. We need to consider mobile design for trainees as well as desktop design for both trainees and non-trainees.
- Raise tickets and walk through with POs & Dev team.
...
Summary of Cookies used on TIS (Tbd - Devs to validate - Simon Meredith (Unlicensed))
Full details on the cookies set by Google Analytics are published on the Google website. Google also publishes a browser add-on to allow you to choose that information about your website visit is not sent to Google Analytics.
| Cookie name | Duration | Description | Purpose |
|---|---|---|---|
| Google analytics | |||
| _ _utma | 2 years from set/update | Used to distinguish users and sessions. The cookie is created when the javascript library executes and no existing _ _utma cookies exist. The cookie is updated every time data is sent to Google Analytics. | Tracks how many times (if any) you have visited the Trainee Information System (TIS) website. |
| _ _utmt | 10 minutes | Used to throttle request rate. | |
| _ _utmb | 30 minutes after your visit, or after 30 minutes of inactivity | Used to determine new sessions/visits. The cookie is created when the javascript library executes and no existing _ _utmb cookies exists. The cookie is updated every time data is sent to Google Analytics. | Tracks how long you have spent on the website. |
| _ _utmc | End of browser session | Not used in ga.js. Set for interoperability with urchin.js. Historically, this cookie operated in conjunction with the _ _utmb cookie to determine whether the user was in a new session/visit. | |
| _ _utmd | 6 months after it was last set | Gives us information on how the site was reached (e.g. directly or a link, organic search or paid search) | |
| _ _utmz | 6 months after it was last set | Stores the traffic source or campaign that explains how the user reached your site. The cookie is created when the javascript library executes and is updated every time data is sent to Google Analytics. | Identifies where you've come from e.g. from a search engine or from another website |
| _ _utmv | 2 years from set/update | Used to store visitor-level custom variable data. This cookie is created when a developer uses the_setCustomVar method with a visitor level custom variable. This cookie was also used for the deprecated _setVar method. The cookie is updated every time data is sent to Google Analytics. | |
| Content experiments - cookie usage | |||
_ _utmx | 18 months | used to determine a user's inclusion in an experiment | |
| _ _utmxx | 18 months | Used to determine the expiry of experiments a user has been included in | |
| Optimize 360 - cookie usage | |||
| _gaexp | Depends on the length of the experiment but typically 90 days. | Used to determine a user's inclusion in an experiment and the expiry of experiments a user has been included in. | |
| Keycloak and TIS application cookies | |||
| AUTH_SESSION_ID | session | Used for sticky connections to an individual node in the Keycloak cluster | https://github.com/keycloak/keycloak-documentation/blob/master/server_installation/topics/clustering/sticky-sessions.adoc |
| KEYCLOAK_IDENTITY | session | JWT representing the user identity. | |
| KEYCLOAK_SESSION | 12hr | Keycloak's session token | |
| KC_RESTART | session | JWT containing the redirect information to determine where a user should be returned to after logging in. | |
| mod_auth_openidc | |||
| mod_auth_openidc_state_ | session | Representation of the state of the current login | The "state" cookie is created when the user is redirected away to the OpenID Connect Provider for authentication. It is a cookie with a unique name (prefixed with a constant mod_auth_openidc_state_) that is tied to the state parameter that is sent in the authentication request. It is deleted when the user returns to the Apache server with an authentication response (indicating either success or failure) |
| mod_auth_openidc_session | session | mod_auth_openidc's session token | The "session" cookie is created after the user returns from the OpenID Connect provider with a successful authentication response (note that the state cookie is deleted at the same time) |
| TIS application <<Requires dev input>> | |||
| dashBoardState | session | User's current dashboard state for revalidation | Stores the user's preferences such as which columns to see, which sorting filters and page are active |
| defaultLocale | 1 month | User's current locale | |
| session | session | Unique session identifier | The Keycloak session token |
| user | session | Cached user representation | |
...
Process Name | PN2 - Users should be able to access and read the Privacy and Cookie Policy via a hyperlink all the time, either when logged in or not logged in | Comments | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Description | Users should be able to access and read the Privacy & Cookie Policy all the times | Note: This could be via a hyperlink on the header/footer of TIS site visible all the times. This link should not provide the options to accept/decline but just the content. | ||||||||
| Actors | Trainers, Educational Supervisors, Clinical Supervisors, TPD's, any users visiting or logged in to the site. | |||||||||
| Pre-Conditions | User is logged in or not logged in | |||||||||
| Post-Conditions | Privacy and Cookie Policy can be accessed and read | e.g HEE Domain has links for each in the footer always visible and accessible:
| ||||||||
| Process Steps |
| |||||||||
| Alternative Process | N/A | |||||||||
| Rules |
| |||||||||
| JIRA Reference |
| |||||||||
| Audit Log | N/A |
Process Name | PN3 - Trainee or any user consent to the Privacy Policy, Cookie Policy and Terms and Conditions when registering to use the trainees' application (draft) | Comments | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Description | Any user registering to use TIS should be able to consent/decline the Privacy Policy and Cookie Policy either on a mobile device or desktop for successful registration. | Mobile design consideration especially for the Trainees application. | ||||||||
| Actors | Trainees or any users registering to use TIS. | |||||||||
| Pre-Conditions | User is not logged and has not got an account on TIS with the username being supplied | |||||||||
| Post-Conditions | System alert the user of the use of cookies by the site with a link to view the full content of the cookies usage policy on the landing page. In order to complete registration, user presented with:
| c.f. HEE Domain: This site uses cookies. By continuing to use this site or closing this message you agree to our use of cookies.
| ||||||||
| Process Steps |
| This could be a unique link sent to a trainee as an invitation to complete their registration or alternative process to be discussed ahead of trainee app solution design. (To discuss with Matt Leech (Unlicensed) and devs) Do we need a separate Terms & Conditions page? | ||||||||
| Alternative Process | N/A | |||||||||
| Rules |
| |||||||||
| JIRA Reference |
| |||||||||
| Audit Log | 1. Do we need to audit the accept/decline of the Privacy Policy, Cookie Policy and Terms and conditions for users that have an account/incomplete account on TIS? 2. Do we need to audit the accept/decline of the Privacy Policy for users that do not have an account on TIS? If so, what do we need to record in this scenario? | To discuss the approach/solution design for trainees registration (Matt Leech (Unlicensed) and devs). |
UX/UI Designs (Tbd - Matt Leech (Unlicensed))
The designs below will need to be adjusted based on the scenarios and answers in the 'Questions and Assumptions' section.
TIS Trainee UI - Mobile - Legal Policy: Privacy and Cookies
https://hee-tis.atlassian.net/wiki/spaces/TISDEV/pages/232718339/TIS+Trainee+UI+-+Mobile+-+Legal+Policy+Privacy+and+Cookies
TIS Admin UI - Desktop - Legal Policy: Privacy & Cookies
https://hee-tis.atlassian.net/wiki/spaces/TISDEV/pages/239730689/TIS+Admin+UI+-+Desktop+-+Legal+Policy+Privacy+Cookies
...