QTIWorks privacy, security and cookies

IMPORTANT: The information here has been written for the instance of QTIWorks hosted at the University of Edinburgh and accessed via the URL https://webapps.ph.ed.ac.uk/qtiworks. Instances of QTIWorks hosted elsewhere may have modified QTIWorks to suit their own needs, so should have published and linked to their own version of this page.

Information for candidates being assessed using QTIWorks

QTIWorks can be used to deliver assessments on behalf of a Virtual Learning Environment (VLE) such as Blackboard Learn or Moodle. If you are a candidate on an assessment being delivered by QTIWorks in this way, then QTIWorks will store the following pieces of information about you:

• Your name and email address (if the administrator of your VLE has chosen to send this information to QTIWorks). This allows your instructor(s) to easily match results to candidates.
• Your progress through your assessment(s). This is necessary to allow us to deliver your assessment.
• The result(s) of your assessment(s). This allows your instructor(s) to perform in-depth analysis of your performance on the assessment.

This data is held securely by the University of Edinburgh and only made visible to the instructor(s) who set up your assessment(s), and the QTIWorks system administrators. More details about this data:

• Your resulting score for each assessment you take will be passed back to your VLE, if the VLE had requested for this to happen.
• QTIWorks does not make your data available to any other system.
• All data passing in and out of the QTIWorks systems uses the secure HTTPS protocol so is encrypted while in transit through the internet.
• Instructors are expected to use your data purely for recording, educational and analytical purposes, and are expected and encouraged to export and delete this data from QTIWorks once it is no longer required. Any remaining personal data that has not been manually deleted by your instructor(s) will be automatically deleted from QTIWorks 180 days after the last assessment you run.
• QTIWorks uses a browser "cookie" to help restrict access to the tests you launch. This cookie is called JSESSIONID and is deleted after you close your browser.
• QTIWorks system administrators may temporarily use the data sent by your VLE to help identify and diagnose issues with the link between QTIWorks and your VLE. Any data used or copied to support these activities will be deleted immediately after use.

Information for instructors using QTIWorks for assessment

If you are using QTIWorks to manage and run assessments, either via an explicit login or via a so-called "LTI link" from a Virtual Learning Environment (VLE), then QTIWorks will record the following pieces of information about (and for) you:

• Your name and email address (unless you are accessing QTIWorks via an LTI link from a VLE that does not send this information)
• A salted SHA1 hash of your QTIWorks password (if you are logging into QTIWorks by an explicit login, rather than an LTI link). Your unencrypted password is never stored by QTIWorks, but is passed to QTIWorks during the login process.
• All assessments you have uploaded.
• All additional data you have created to support your assessments, such as deliveries and delivery settings.
• Information about all candidate sessions that have been launched on your assessments.
• Any LTI consumer keys and shared secrets created to support your LTI connections.

You can delete any of your assessments and candidate session data at any time. Deletion of this data is permanent within the system, though old data may be temporarily stored in system backups held at the University of Edinburgh for several weeks.

You may also request the deletion of your account(s) and all data you have stored. To do this, please email the administrator of this QTIWorks instance. Contact details.

Please also read the 'Information for candidates being assessed using QTIWorks' section (above) to find out what data is stored about your candidates (students) when they take your assessments. You are recommended to download and then then delete candidate data from QTIWorks once you have delivered an assessment. Any candidate session data left in the system will be deleted 180 days after the candidate launches the session.

Further information about your data in QTIWorks:

• QTIWorks does not pass your data to any other system.
• All data passing in and out of the QTIWorks systems uses the secure HTTPS protocol so is encrypted while in transit through the internet.
• QTIWorks uses a browser "cookie" to remember who you are once you have logged in. This cookie is called JSESSIONID and does not contain any information about you, and it will be deleted a few hours after you leave the site.
• QTIWorks system administrators may temporarily use some of your data sent to help identify and diagnose any software problems or support queries from you. Any data used or copied to support these activities will be deleted immediately after use.

Information for people using the QTIWorks public demos

If you use any of the public demo features offered by QTIWorks, such as the sample assessments, the QTI validator or the quick upload and run feature, then QTIWorks will have to temporarily store some data to make all of this work for you. This data comprises:

• Any assessments you upload to run or validate.
• Your progress through any assessments you run.

This data is deleted from the system approximately 24 hours after its last access. QTIWorks does not store (or indeed know about or ask for) any of your personal details, and it simply uses a randomly-generated string of letters and numbers to match you to your data. This string is passed around in a browser cookie called JSESSIONID, which expires a few hours after you leave the site.