Privacy policy

Last updated: 5 October 2026

We, Science for Life GmbH, are pleased that you are visiting our website www.prehab-m.com. In this privacy policy we inform you, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), which personal data we process when you visit our website, for which purposes, on which legal basis, and what rights you have.

This privacy policy applies to all pages under the domain www.prehab-m.com and its subdomains, including the surgery preparation page. Use of the PrehabM app is governed by the app’s separate privacy policy, which you can find in the app and in the App Store or on Google Play.

This English version is provided for convenience. In case of any discrepancy, the German version prevails.

1.Definitions

Terms such as “personal data”, “processing”, “controller”, “processor” and “consent” have the meaning given to them in Art. 4 GDPR.

2. Controller

Science for Life GmbH
Luegallee 22
40545 Düsseldorf
Germany
Phone: +49 211 33687337
Email: support@prehab-m.com
Represented by the Managing Director: Nico Helling

3. Your rights

You have the following rights with regard to your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation.
To exercise your rights, simply send a message to support@prehab-m.com or to the postal address above.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
(State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Postfach 20 04 44, 40102 Düsseldorf, Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Providing your data is neither a legal nor a contractual requirement. Without certain information, however, you cannot use some functions, such as the contact form.

4. Hosting and server log files

Our website is hosted by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. The servers are located in Germany. We have concluded a data processing agreement with the provider in accordance with Art. 28 GDPR.
When you access our website, your browser automatically sends the following data to our server, which is stored in server log files:

• IP address
• date and time of the request and time zone difference to GMT
• page accessed and content of the request
• access status/HTTP status code and amount of data transferred
• previously visited page (referrer)
• browser type and version, language, operating system

The purpose is to provide the website and ensure its stability and security. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. Log files are deleted after 7 days unless they are needed longer to investigate a security incident.

5. Cookies and consent management

We use cookies and similar technologies. These are small files or pieces of information that are stored on or read from your device.
Strictly necessary cookies are used without consent where they are essential to provide the website, for example to store your cookie choice (Section 25(2) No. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act; Art. 6(1)(f) GDPR).
All other cookies and technologies, in particular for statistics (Google Analytics) and marketing (Google Ads), are only used with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). We obtain your consent through our cookie banner on your first visit. For this we use the WordPress plugin Borlabs Cookie by Borlabs GmbH, Hamburger Str. 11, 22083 Hamburg, Germany. The plugin runs on our own web server; your data is not transmitted to Borlabs.
Borlabs Cookie stores your choice in a cookie (“borlabs-cookie”) on your device. To be able to prove that you have given consent, we also log a pseudonymous identifier, the time and your choice (Art. 7(1) GDPR). The legal basis is our legal obligation to demonstrate consent (Art. 6(1)(c) GDPR). The cookie and the log entry are deleted after 12 months; we then ask for your consent again.
You can withdraw or change your consent at any time with effect for the future by reopening the banner via the “Cookie settings” link at the bottom of every page. You can also delete or block cookies in your browser.

6. Contact form and enquiries by email

If you contact us via the contact form on the surgery preparation page or by email, we process the following information:

mandatory: first name, email address
optional: planned procedure, date of surgery
time of the enquiry and your consents

We use this information solely to answer your enquiry and to provide you with information about preparing with PrehabM. The legal basis is your consent to be contacted (Art. 6(1)(a) GDPR) and, where your enquiry is aimed at concluding a contract, Art. 6(1)(b) GDPR.

Information about your procedure (health data)
Information about a planned procedure and the date of surgery is health data and belongs to the special categories of personal data (Art. 9 GDPR). Providing this information is voluntary. We only process it if you have explicitly consented to this in the form (Art. 9(2)(a) GDPR), and solely to answer your enquiry.
You can withdraw this consent at any time with effect for the future, for example by email to support@prehab-m.com. We will then delete the information without delay.
We do not pass on information from the contact form to advertising partners. In particular, we do not transmit any information about your procedure to Google or other providers of analytics or advertising services.

Recipients and retention period
The contact form is provided through a WordPress form on our web server at Amazon Web Services (see Section 4). From there, your information is sent by encrypted email to our mailbox support@prehab-m.com.
The mailbox is operated via Google Workspace, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We have concluded a data processing agreement with Google in accordance with Art. 28 GDPR (Cloud Data Processing Addendum). Google processes the emails solely on our behalf and not for advertising purposes. For possible transfers to the USA, see Section 10.
Only the staff members handling the enquiries have access to them.
We delete your enquiry, including any health data, once it has been dealt with, but no later than 6 months after the last message, unless statutory retention obligations apply.

7. Google Analytics

With your consent, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics helps us understand how visitors use our website so that we can improve it.
For this purpose, Google sets cookies and records, among other things, the pages viewed, time spent, approximate location (based on the shortened IP address), device type and browser. IP addresses are not stored in Google Analytics 4. Google processes the data on our behalf; we have concluded a data processing agreement with Google.
The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time via the cookie settings. The data is deleted after 14 months.
Further information: https://policies.google.com/privacy?hl=en

8. Google Ads and conversion tracking

We advertise via Google Ads, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. To measure the success of our ads, we use Google Ads conversion tracking with your consent.
If you reach our website via a Google ad, Google sets a cookie. If you then visit certain pages or carry out certain actions (for example clicking the link to the App Store or submitting the contact form), we and Google learn that a user clicked the ad and carried out the action. We only receive aggregated statistics that do not identify you personally. The content of the contact form is not transmitted to Google.
We do not use remarketing functions and do not create audiences based on your visit to our website.
We use Google’s “Consent Mode”: without your consent, no Google Ads cookies are set. Google then only receives technical signals without cookies, from which Google can create statistical models.
The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time via the cookie settings. For processing within Google Ads, Google is partly an independent controller and may also use the data for its own purposes, such as improving its advertising services. Further information: https://policies.google.com/technologies/ads?hl=en

9. Links to the App Store and Google Play

Our website contains links to the Apple App Store and Google Play. Only when you click a link are you redirected to the respective provider, whose privacy terms then apply. Purchase and use of the PrehabM app are subject to the terms of Apple or Google and to the app’s privacy policy.

10. Transfers to third countries

When we use Google services (Google Analytics, Google Ads and Google Workspace for our email mailbox), personal data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). In addition, Google has concluded EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
With our hosting provider Amazon Web Services, the data is stored on servers in Germany. However, access by the US parent company Amazon.com, Inc. cannot be completely ruled out. Amazon.com, Inc. is also certified under the EU-US Data Privacy Framework.

11. Retention periods at a glance

12. Data security

Our website is secured by TLS encryption, recognisable by the padlock symbol and “https://” in the address bar. In addition, we protect your data against loss, manipulation and unauthorised access through technical and organisational measures in accordance with Art. 32 GDPR and regularly adapt these measures to the state of the art. Only staff members who have been trained in data protection and are bound to confidentiality have access to personal data.

13. Disclosure to recipients

We only disclose your personal data to the recipients named in this privacy policy or where you have consented. Beyond that, only where we are legally obliged to do so, for example to law enforcement authorities, courts or tax authorities, or where this is necessary to establish, exercise or defend legal claims.

14. Links to external websites

Our website contains links to websites of other providers. The respective provider is responsible for the processing of personal data on those websites. Please refer to their information on how they handle your data.

15. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art.

16. Changes to this privacy policy

We update this privacy policy when the legal situation, our website or our services change. The version published here applies.