Privacy policy for the NHS Quit Smoking app

The NHS Quit Smoking app is designed to help you improve your health by supporting you in your journey to quit smoking.

The app provides a structured, step-by-step approach, offering daily support and tailored advice to help you stay on track.

With features like craving management tips, motivational tools, and progress tracking, the app empowers you to achieve your goal of quitting smoking.

The NHS Quit Smoking app does not require you to create an account. All your progress and data are stored locally on your device, ensuring ease of use and privacy.

The Department of Health and Social Care is the data controller.

Technical information:

• Type of mobile device you use, and your mobile operating system (device information)
• Internet Protocol (IP) address used to connect to your device to the internet
• Analytics data used to understand how the app is used and monitor overall progress of our user base

Profile information:

The App can be used without creation of a user account. When using the App without an account, collection of the following data is optional:

• Sex
• Age

When using the App you are given the option to share the following information to personalise your experience:

• Your health motivation, for example, "I want to improve my health" or "I'm recovering from a health scare"
• Your current smoking habits, for example, number of cigarettes smoked a day, cost per pack information

• Age: to show age-group-specific content
• Sex: to show sex-specific content

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:

• Your consent (for any information that is voluntarily provided by you)
• For the performance of a task in the public interest or for our official functions (for all other data)

As we are also processing special category data (such as information related to your health), we are also required to identify at least one additional condition under which to process this information. These are:

• Your consent (for any information that is voluntarily provided by you)
• For reasons of public interest in the area of public health (for all other data)

Data processors and other recipients of personal data

Data collected by the app is not passed on to any third parties.

International data transfers and storage location(s)

Collected data is stored and processed in the United Kingdom.

No data is stored in identifiable format. Your activity data is stored anonymously and indefinitely in order to monitor performance of the application and provide population level insights into the effectiveness of the service.

Age and sex data will be used alongside smoking habit data to produce insights on the usage of the product at a population level, but this will not be attributable to individual users.

No personal identifiable data is stored. Anonymised app activity data is encrypted at rest and in transit and is used to produce insights on the usage of the product at a population level.

By law, data subjects have a number of rights and this processing does not take away or reduce these rights under the EU General Data Protection Regulation (2016/679) and the UK Data Protection Act 2018 applies.

These rights are:

1. The right to get copies of information – you have the right to ask for a copy of any information about you that is used.
2. The right to get information corrected – you have the right to ask for any information held about you that you think is inaccurate, to be corrected.
3. The right to limit how the information is used – you have the right to ask for any of the information held about you to be restricted, for example, if you think inaccurate information is being used.
4. The right to object to the information being used – you can ask for any information held about you to not be used. However, this is not an absolute right, and continued use of the information may be necessary, with you being advised if this is the case.
5. The right to get information deleted – this is not an absolute right, and continued use of the information may be necessary, with you being advised if this is the case.

If you are unhappy or wish to complain about how personal data is used as part of this programme, you should email data_protection@dhsc.gov.uk in the first instance or write to:

Data Protection Officer
1st Floor North
39 Victoria Street
London
SW1H 0EU

If you are not satisfied with the response, you can complain to the Information Commissioner's Office. Their website address is www.ico.org.uk and their postal address is:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

No decision will be made about you solely based on automated decision making (where a decision is taken about you using an electronic system without human involvement) which has a significant impact on you.

This privacy notice is kept under regular review, and new versions will be available on our privacy notice page on our website. This privacy notice was last updated on 12/11/2024.

© Crown copyright 2022

Information Risk Management & Assurance/Office of the Data Protection Officer www.gov.uk/dhsc

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3

Where we have identified any third-party copyright information you will need to obtain permission from the copyright holders concerned.