How QuestPrehab uses your information
Last updated: 19 October 2026
Who we are
QuestPrehab is digital prehabilitation, run by C Digital Healthcare Ltd (QuestPrehab), 168 Shoreditch High Street, 2nd Floor, London E1 6RA. Registered in England and Wales, company number 13178024. We are registered with the Information Commissioner’s Office, registration ZB072441.
Our Data Protection Officer can be contacted at dpo@questprehab.com.
This notice explains how we use the information of patients referred to us by an NHS hospital. It sits alongside the leaflet your hospital team gives you, How QuestPrehab Uses Your Information.
What information we hold, and where it comes from
From your hospital. When your hospital team refers you, with your agreement, they send us your name and contact details, nothing else. We do not ask for your NHS Number, your date of birth, or information about your diagnosis or treatment.
From you. Once you are referred, a QuestPrehab Coach will speak with you about your health and wellbeing so that your programme can be tailored to you. You also enter information in the app as you go: how you are getting on, your assessment responses, and how you are using the programme. Coaches enter what you tell them directly in your QuestPrehab profile. We do not record or transcribe calls.
Your account. Your email address, your password (stored in a form we cannot read), and your notification preferences.
Technical information. If the app crashes, diagnostic information is sent to us so we can fix the problem. This contains no information about you or your health.
Google services in the app. Our app uses certain Google services in order to work. Where we obtain information through Google APIs, we handle it in accordance with the Google API Services User Data Policy, including its Limited Use requirements. We do not use information obtained through Google APIs for advertising, and we never sell it.
Why we use it, and our legal basis
We use your information to contact you, set up your account, design and deliver your prehabilitation programme, support you through it, and send progress and assessment reports to your hospital team.
Under UK data protection law our legal bases are:
- Article 6(1)(b) — contract. Before you register, we contact you because you asked your hospital team to refer you. From registration onwards, we process your information to deliver prehabilitation you have signed up to.
- Article 6(1)(f) — legitimate interests. For limited supporting activities: administering prehabilitation, communicating with your clinical team, reviewing quality and safety, keeping our systems secure, and handling complaints or legal claims.
- Article 9(2)(h) — provision of health care. Health information is handled by, or under the responsibility of, registered healthcare professionals who are bound by a duty of confidentiality (Data Protection Act 2018, Schedule 1, Part 1, paragraph 2).
Your hospital asks for your explicit consent before referring you. That consent satisfies the duty of confidentiality that health professionals owe you. It is not our legal basis under Article 6 — which means that if you withdraw, we stop providing prehabilitation, but the records already created remain subject to NHS record-keeping rules.
Who is responsible for your information
Your hospital and QuestPrehab are independent data controllers. Your hospital is responsible for the decision to refer you and for its own records, including the reports we send back. QuestPrehab is responsible for the information from the moment we receive it, and for everything you give us afterwards. A written data sharing agreement between us sets out how your information is protected. QuestPrehab is not a processor acting on your hospital’s instructions.
Who we share it with
- Your hospital team. We send progress updates and your initial and final assessment reports, which become part of your hospital record. These are sent by secure, encrypted electronic communication.
- Our suppliers. Google Cloud Platform hosts our platform. Microsoft 365 provides our email and office systems and may hold your contact details, but never your health information. Google Firebase Crashlytics receives app diagnostic data only. Each works under a written contract that allows them to act only on our instructions.
- Google Analytics receives website usage information from visitors to questprehab.com, where cookies have been accepted. It receives nothing from your QuestPrehab record.
We never sell your information and never use it for advertising.
Where your information is kept
Your QuestPrehab record is processed and stored in the United Kingdom, in Google Cloud Platform’s London region. Website analytics are handled separately and are covered in “Cookies and website analytics” below.
Your information is encrypted using AES-256 while stored and TLS 1.3 while being sent. Access is limited to those who need it and every access is recorded. We meet the NHS Data Security and Protection Toolkit standards and hold Cyber Essentials certification.
How long we keep it
- Your prehabilitation record: 8 years after your care concludes, following the NHS Records Management Code of Practice, then securely deleted.
- If you are referred but never register: 12 months from referral, then securely deleted, and we tell your hospital you did not take up the offer.
- Backups: 35 days of rolling backups, plus monthly archive copies kept for 12 months.
- Anonymous information: we may keep information that cannot identify you, to understand how well the platform works and improve it.
Automated decisions
We do not make decisions about you by automated means alone. Your programme is designed and adjusted by QuestPrehab Coaches, who are registered healthcare professionals.
The national data opt-out
The national data opt-out lets you stop your confidential patient information being used for research and planning. QuestPrehab uses your information to provide your care, and anything we use to evaluate the platform is anonymised first, so the opt-out does not change how this works.
Your rights
You can ask us to:
- give you a copy of the information we hold about you
- correct anything that is wrong or incomplete
- delete your information, where we are not required to keep it
- restrict what we do with it while a question is resolved
- provide it in a portable format, or object to how we use it
- stop using your information where you have given consent
Taking part is always your choice. Saying no, or stopping later, will not affect your NHS care. You can withdraw at any time by telling your hospital team or emailing dpo@questprehab.com.
Contact dpo@questprehab.com to exercise any of these rights. We will respond within one month, and we will carry out a reasonable and proportionate search. There is no fee. If you are unhappy with how we have handled your information, please tell us first — we acknowledge complaints within 30 days — and you can also complain to your hospital’s Patient Advice and Liaison Service (PALS), or to the Information Commissioner’s Office at ico.org.uk or 0303 123 1113.
Cookies and website analytics
Our website, questprehab.com, uses Google Analytics cookies to understand how people find and use the site — which pages are visited, for how long, and whether anything is not working. This tells us about website visitors in general; it is not linked to your QuestPrehab record, and it is not used to track your care.
The QuestPrehab app you log into do not use analytics cookies.
Analytics cookies are not essential, so we only set them if you agree. You can accept or decline them when you first visit the site, and change your mind at any time through the cookie settings on our website. Declining them does not affect your use of the app.
Google processes this analytics information on our behalf and may process it outside the UK, under the transfer safeguards in Google’s terms. You can find out more at policies.google.com/technologies/partner-sites.
Changes to this notice
We review this notice at least once a year and whenever there is an update. The date at the top shows when it was last updated.