Page content:
Table of Contents
...
Summary of Cookies used on TIS (Tbd - Devs to validate - Simon Meredith (Unlicensed))
Full details on the cookies set by Google Analytics are published on the Google website. Google also publishes a browser add-on to allow you to choose that information about your website visit is not sent to Google Analytics.
| Cookie name | Duration | Description | Purpose |
|---|---|---|---|
| Google analytics | |||
| _ _utma | 2 years from set/update | Used to distinguish users and sessions. The cookie is created when the javascript library executes and no existing _ _utma cookies exist. The cookie is updated every time data is sent to Google Analytics. | Tracks how many times (if any) you have visited the Trainee Information System (TIS) website. |
| _ _utmt | 10 minutes | Used to throttle request rate. | |
| _ _utmb | 30 minutes after your visit, or after 30 minutes of inactivity | Used to determine new sessions/visits. The cookie is created when the javascript library executes and no existing _ _utmb cookies exists. The cookie is updated every time data is sent to Google Analytics. | Tracks how long you have spent on the website. |
| _ _utmc | End of browser session | Not used in ga.js. Set for interoperability with urchin.js. Historically, this cookie operated in conjunction with the _ _utmb cookie to determine whether the user was in a new session/visit. | |
| _ _utmd | 6 months after it was last set | Gives us information on how the site was reached (e.g. directly or a link, organic search or paid search) | |
| _ _utmz | 6 months after it was last set | Stores the traffic source or campaign that explains how the user reached your site. The cookie is created when the javascript library executes and is updated every time data is sent to Google Analytics. | Identifies where you've come from e.g. from a search engine or from another website |
| _ _utmv | 2 years from set/update | Used to store visitor-level custom variable data. This cookie is created when a developer uses the_setCustomVar method with a visitor level custom variable. This cookie was also used for the deprecated _setVar method. The cookie is updated every time data is sent to Google Analytics. | |
| Content experiments - cookie usage | |||
_ _utmx | 18 months | used to determine a user's inclusion in an experiment | |
| _ _utmxx | 18 months | Used to determine the expiry of experiments a user has been included in | |
| Optimize 360 - cookie usage | |||
| _gaexp | Depends on the length of the experiment but typically 90 days. | Used to determine a user's inclusion in an experiment and the expiry of experiments a user has been included in. | |
| Keycloak and TIS application cookies | |||
| AUTH_SESSION_ID | session | Used for sticky connections to an individual node in the Keycloak cluster | https://github.com/keycloak/keycloak-documentation/blob/master/server_installation/topics/clustering/sticky-sessions.adoc |
| KEYCLOAK_IDENTITY | session | JWT representing the user identity. | |
| KEYCLOAK_SESSION | 12hr | Keycloak's session token | |
| KC_RESTART | session | JWT containing the redirect information to determine where a user should be returned to after logging in. | |
| mod_auth_openidc | |||
| mod_auth_openidc_state_ | session | Representation of the state of the current login | The "state" cookie is created when the user is redirected away to the OpenID Connect Provider for authentication. It is a cookie with a unique name (prefixed with a constant mod_auth_openidc_state_) that is tied to the state parameter that is sent in the authentication request. It is deleted when the user returns to the Apache server with an authentication response (indicating either success or failure) |
| mod_auth_openidc_session | session | mod_auth_openidc's session token | The "session" cookie is created after the user returns from the OpenID Connect provider with a successful authentication response (note that the state cookie is deleted at the same time) |
| TIS application <<Requires dev input>> | |||
| dashBoardState | session | User's current dashboard state for revalidation | Stores the user's preferences such as which columns to see, which sorting filters and page are active |
| defaultLocale | 1 month | User's current locale | |
| session | session | Unique session identifier | The Keycloak session token |
| user | session | Cached user representation | |
...
| No. | Question or Assumption | Comments |
|---|---|---|
| 1. | Do we need to include a separate Terms and Conditions for the TIS site? If so what should be the content of this? Can we use the one here https://www.hee.nhs.uk/about/terms-conditions? | To discuss with Andrew Todd/Chris Brady AD: No. |
| 2. | For HEE Admins/Trust Users/Programme role users who already have an account on TIS and actively using TIS, should they be consenting to the use of
Or just agree to the use of cookies on their first login? | To discuss with Andrew Todd/Chris Brady AD: No needed.Covered by the corporate one, and ESR mandatory training. We are all part of HEE/NHS trusted users. |
| 3. | Could you provide the content of the Privacy Policy for TIS? We believe it would be an adapted version of https://www.hee.nhs.uk/about/privacy-notice | To discuss with Andrew Todd/Chris Brady AD: High level for TIS. Refer to ICO website. Link to corporate website on HEE domain. |
| 4. | We are currently reviewing the list of cookies to include on the Cookie Policy page for TIS. We believe it would be an adapted version of https://www.hee.nhs.uk/about/cookies. Could you review and confirm the other contents/changes as applicable for TIS? | To discuss with Andrew Todd/Chris Brady 5.AD: Only include the ones we are clear about what they are doing and that not accepting them would affect usage of functionality on TIS. |
| 5. | The link on the cookie consent banner on HEE website takes you to the .../privacy-notice page rather than the .../about/cookies page. Is this correct? | To discuss with Andrew Todd/Chris Brady AD: This is an issue with the link. |
| 6. | PN3 - Trainee or any user consent to the Privacy Policy, Cookie Policy and Terms and Conditions when registering to use the trainees' application (draft)
| To discuss with Andrew Todd/Chris Brady AD: To trigger the ACCEPT and be able to fully register, they would need to accept. But they also need to decline. If they decline, they need to contact support. If a new cookie is introduced or content changes, they need to be able to read and accept them again, even if they are existing users. |
| 7. | HEE Records management policy - 5.6 Retention and disposal – there are consistent and documented retention and disposal procedures to include provision for permanent preservation of archival records - Is this up-to-date? We also have a piece of work on our roadmap/backlog to look at archiving and data retention on TIS. Should this work be a priority over Trainees being able to consent to Privacy and Cookie Policy or are we covered by the above records management policy? | To discuss with Andrew Todd/Chris Brady AD: Archiving can be treated separately and should not have a dependency on the trainees app. |