Privacy Notice

0. Two facts you should know before reading any of thisNot in force#

1. The service is not open yet. Sign-ups and subscriptions have been closed since 3 August 2026, by deliberate configuration: you can read our public pages, but nobody can create an account or buy anything. That hold exists so legal advice can be obtained before any athlete's real data is processed.
2. No real athlete's data has ever been on this platform. Everything currently stored is synthetic test data generated by seed scripts. Nothing in this notice describes processing that has actually happened to a real person.

1. Who we areNot in force#

2. Who this notice is forNot in force#

• Athletes who hold their own account. Today, the only way an athlete record can be created is by that athlete signing up themselves. No coach-facing route creates an athlete.
• Coaches, managers and team staff who hold a coach account.
• Guardians of athletes under 16 — this group does not exist yet, and no guardian's data is held today. Under-16s cannot create an account (the signup route refuses it and an automated test fails the build if that refusal is removed). What exists today: a parent or guardian whom our staff have recorded for a child can, through a signed link we send them, give or withdraw two permissions for that child: use of the AI assistant, and inclusion in the live peer comparison (§5). The full guardian sign-up flow is not built yet, so a child under 16 cannot otherwise join (§9). No screen lets our staff record a guardian yet, so no guardian has used this link. Because the consent wording is still a draft, a guardian's permission is recorded as given against draft wording and will be asked again once the wording is final. The record type exists — tables for a guardian's contact details, their consents and a child's own assent, with the rules that govern them enforced in the database. It holds zero rows on both databases. No under-16 will be onboarded by any route until the flow is built and counsel has answered.

3. What we collect, and where it comes fromNot in force#

3.1 Information you give us#

3.2 Information from a device or a file you connect#

If you authorise it — a coach cannot do this on your behalf — we receive:

• Polar: training sessions. (Built and working.)
• Oura: sleep, heart-rate variability, resting heart rate, overnight temperature, blood oxygen, workouts. (Built, registered with the vendor on 12 September 2026 and configured on our server. Two things still stand between that and an athlete using it: sign-ups are closed (§0), and Oura caps a new application at ten connected users until it passes their own review, which has not happened. The connection has therefore never been made by anybody.)
• Withings: body mass, bio-impedance body composition, blood pressure, sleep. (Built, registered with the vendor on 12 September 2026 and configured on our server. Not usable while sign-ups are closed (§0), and the connection has never been made by anybody.)
• Bio-impedance body composition is held under its own measure names, separate from the skinfold measurements a practitioner takes by hand. The two methods are not interchangeable and we do not merge them into one figure.
• File imports you upload: GPX, TCX, FIT, Apple Health export files, and CSV results, match statistics and GPS files.

Imported files match an athlete who already exists. Nothing in an import can create a person.

Garmin. Garmin approved our developer account on 23 October 2026. The connection is being built and is not available yet. When it is, you choose whether to connect your Garmin account. If you do, we receive the data you allow in Garmin Connect: activities, training data and daily health summaries such as sleep, resting heart rate and stress. You can disconnect at any time, here or in Garmin Connect.

We do not have integrations with Strava (their terms forbid showing an athlete's data to anyone but that athlete, which a coach platform cannot honour) or Fitbit (their web API is being decommissioned).

3.3 Information generated by someone else about you#

• A coach with your written consent may record test results, parts of your pre-season screening, and match statistics onto your record. Anything a coach entered is labelled as coach-entered on your own page, so you can tell it apart from what you entered yourself.
• The platform itself computes derived values: ratings against reference tables, percentiles, readiness, weakness flags, and training prescriptions. See §8.

3.4 Information collected automatically#

• Technical and audit records. Every administrative action taken on our side is written to an append-only log, including any read of health data. Roughly half of those records carry an IP address and browser user-agent string, and some carry a before/after image of the record that can include a name.

4. Why we use it, and the lawful basis we think appliesNot in force#

What we do not do. We do not profile you for marketing. We do not sell your data. We do not run any research study on it — there is no research purpose and there never has been one on this platform. We do not show your data to anyone outside your own club. There is no route by which anyone outside it can see you, because the one route we intend to build does not exist yet, and it is described next.

4.1 Scouting discovery — what we are building, and the rules it will ship under#

There will be one place where you can choose to be seen outside your own club: scouting discovery. It will be off by default for every account, including every account that already exists; you turn it on, and you can turn it off again in one click. (The wording signed on 3 September 2026 said "in one click from your privacy screen". There is no privacy screen — see §6.1 — so we do not point you at one.) While it is off you do not appear in any scout's search at all — not as a hidden row, not as a count, not as a greyed-out card. You are simply not there.

If you do turn it on, a scout will first see only a card with no name on it — your sport, position, sex, age band, level and region, and your rating bands. Never your raw scores. A scout will only see your name if you accept that individual scout, for a limited time, and you can withdraw it instantly. We will never show a scout your health information at any stage: not your injuries or return-to-play record, not your screening, not your daily monitoring or readiness. There is no setting that turns that on and no amount of money buys it. You will be able to see every scout who has looked at you — and that screen does not exist today (§6.1). It will be built before scouting discovery is switched on for anybody.

Scouting discovery will not be available to anyone under 18. Under-16s cannot hold an account on this platform at all (§9). We intend 16- and 17-year-olds to be included eventually, with every scout approach routed to a parent or guardian and never to the athlete — but there is no screen on which a guardian can be recorded (§9: the record type exists and holds no rows, and the one guardian link that exists covers only two permissions, not scout approaches), we have no concept of an approach window, and the rules that govern approaches to a minor differ by sport and by country, so no single platform-wide rule could be right everywhere. Until that machinery is built and counsel has answered it, under-18s are out.

5. Norms — how your results are rated, stated honestlyNot in force#

Your results are rated against published reference tables (research and governing-body norm tables held in our catalogue). No norm table on this platform is computed from users' results.

This section is written with more care than a privacy notice usually needs, because our own copy has got it wrong three times. Two earlier statements — in the public FAQ, in the athlete's own privacy screen, and inside the data export itself — told athletes their results "may have contributed to" anonymous aggregate norms. That described something that has never happened. They were corrected on 11 August 2026 — and the correction went too far the other way, asserting flatly that results were not pooled with any other athlete's. That was also wrong, and it is corrected here on 28 August 2026.

What was actually running. About four in five rating requests compared the value against the latest result of every athlete on the platform for that measure — split by sex, country and level of play — and returned how many of them it beat. (A measure with no better-or-worse direction was never ranked: 145 of our 742 measures are of that kind.) Counts only: never a name, never anyone else's value, never an identity. But it spanned every account, it was gated on no consent at all, the endpoint was public and unauthenticated so anyone at all could ask it, and it had no minimum size, so a group of one could be answered. Member accounts have been closed since 3 August 2026 and the platform holds demo data only, so no real athlete was described by it.

• Today: zero norm sets on either database were computed from platform users' own results. There is still no pooling engine, and building one is blocked pending counsel (C1–C6).
• The live peer comparison is gated on the norms_inclusion consent, and since 6 September 2026 you can give and take back that consent yourself, on the shared-norms card at Profile → Who can see my data. (Until 13 September 2026 this line sent you to a control called "Shared norms pool". No control has ever carried that name — the same defect as the "privacy screen" footnoted in §4.1, so the path is now named without inventing a label.) Nothing is ticked for you; leaving the box empty records nothing. Your results are counted in that comparison only while you hold a live grant, and taking it back stops you being counted from the very next rating anybody asks for — there is no stored copy of you to purge.
• Even with consent, a comparison is refused unless the group holds at least 30 different athletes, from at least 3 different accounts, with no single account holding more than half of them. Below that no number is produced — and below five people we do not disclose the group's size either, because the size is itself identifying.
• A pooled norm capability is planned. If it is ever built, we will tell you before anything of yours enters it, and it must clear the questions we have put to counsel first (C1–C6).
• Health data, wellness data, injury data, screening answers and wearable data would never enter a shared norm pool, by construction. Norms are computed only from performance test results.

6. Who your data is shared withNot in force#

6.1 People#

6.2 Companies that handle your data#

Data-processing agreements. On 23 October 2026 we accepted the standard data-processing agreements of Hetzner, Cloudflare, Stripe, Hosting Ireland, Brevo and Anthropic. Those with Polar, Oura and Withings are not yet in place. Garmin acts as a separate controller under its developer agreement, accepted on 23 October 2026, which includes the EU standard contractual clauses. Which of these companies process data for us and which act as separate controllers is with counsel (G4).

7. Sending data outside the EU/EEANot in force#

There is one transfer to a third country today, and we would rather point at it than bury it. A second one is coming, and we are naming it here before it does.

The AI assistant sends data to Anthropic in the United States (our contract is with Anthropic Ireland, Limited; the model runs in the US). When you or a coach asks the assistant a question, we send:

• the training plan's name, dates and version, its phases, training windows and sessions;
• fixture dates and titles; the sport; the codes and names of drills and templates in our live library;
• nothing from our rules engine's receipt — when a question is about training dose, that receipt (a test name, a percentile and a norm-set label) is added to the answer you see after the model replies, not sent to the model;
• and your question exactly as you typed it.

We did not find athlete names, dates of birth, health data, injury data, screening answers or wellness data in the code that assembles that context. But the typed question is passed through unchanged and is not filtered. If a coach types an athlete's name or describes an injury into the assistant, that text goes to the United States. There is no inbound filter today.

The assistant now checks age. Anyone we know to be under 16 is refused unless a parent or guardian has given permission. The guardian can withdraw that permission through the signed link we send them (valid for 30 days; we will send a new one on request), and it ends if that person stops being recorded as the child's guardian. At 16 the decision passes to the athlete. Athletes aged 16 and 17 decide for themselves, as everywhere else on the platform (§9). The typed question is still sent unfiltered (above).

Backups sit in a Cloudflare R2 bucket configured to EU jurisdiction, encrypted before they leave our server. Whether that is enough to avoid a Chapter V transfer given Cloudflare's US parentage is also with counsel (G5).

The second transfer — scouting discovery (§4.1), not built. The scouts and agencies that surface is intended for are not all inside the EU/EEA. A scout outside the EEA reading your card would be a Chapter V transfer, needing standard contractual clauses and a transfer risk assessment. We hold neither, no scout account exists, and no such transfer has ever happened. It will not be switched on until those instruments are in place and counsel has approved the arrangement.

7.1 AI and your wearable data — AI transparency statement#

Today, the AI assistant receives no wearable data and no health data from your record — not from Garmin, Polar, Oura, Withings, imported files, injuries, screening or wellness. We checked the code that builds what is sent to it. What you type is sent exactly as typed, so if you type health details into a question, they go with it (see above).

Planned, not built: a separate opt-in. We intend to let athletes choose to let the assistant use summaries of their wearable data, for example weekly training load, average sleep and resting-heart-rate trends. The assistant would use them to suggest that athlete's own training and season plan. The rules for this:

• Off unless you switch it on. It is a separate choice from connecting a device and from every other consent. Under 16, a parent or guardian decides.
• Summaries only. Raw data streams are never sent to the assistant.
• Only your own plan. Your wearable data is never used to advise anyone else.
• Withdraw at any time from your "who can see me" panel at /me/privacy. From that moment nothing more is sent.
• Where it goes: Anthropic (see §6.2 and the transfer above). Anthropic does not use it to train its models. Under its commercial terms it deletes what we send within 30 days, unless it is flagged for a safety review.
• Never used to train, evaluate or improve any AI model, by us or by anyone else. Garmin data and anything derived from it is also never sold, never used for advertising, and never shared with anyone for their own use.

We will update this notice, and ask for your permission, before this switches on.

8. Automated processing, ratings and what a score is notNot in force#

The platform computes things about you automatically. You should know exactly what and how far it goes.

• Ratings and percentiles. A result is compared to a published reference table and given a band.
• Weakness detection. Results are scanned against reference data, weaknesses are flagged, and a training prescription can be generated automatically.
• Readiness. Computed from your own rolling 28-day baseline — not by ranking you against team-mates.
• Screening outcome. Computed by rule from the answers given, not decided by a person.
• The AI assistant proposes; it never writes a plan; it never states a training dose (those figures are inserted verbatim by the rules engine); it cannot name a drill or template that is not in the live library; every answer is filtered for claim language before you see it; and it has no access to team selection.

None of this is a medical opinion and none of it is an authorisation to play or not play. A screening outcome and a return-to-play stage are information for a qualified person to act on. A human makes every decision that affects you.

9. ChildrenNot in force#

• Under 16: cannot create an account. The signup route refuses it, the profile route refuses a date of birth edited downward to get around it, age is computed on our server in UTC and a client- supplied age is never trusted, and an automated test fails the build if that gate is removed.
• 16 and 17: hold their own account and give their own consent. Ireland's digital age of consent is 16. (Whether that is the right line for special-category health data specifically is with counsel — Solicitor Pack §2, item 1.)
• The full guardian consent flow does not exist yet. The guardian record type does exist in the software — tables for a guardian's contact details, their consents and a child's assent, a server-side write path that derives the party and the wording version rather than accepting them from a caller, and database rules that refuse a coach consenting for an athlete. It holds zero rows (measured on 23 October 2026). What exists today: a parent or guardian whom our staff have recorded for a child can, through a signed link we send them, give or withdraw two permissions for that child: use of the AI assistant, and inclusion in the live peer comparison (§5). The full guardian sign-up flow is not built yet, so a child under 16 cannot otherwise join. No screen lets our staff record a guardian yet, so no guardian has used this link. Because the consent wording is still a draft, a guardian's permission is recorded as given against draft wording and will be asked again once the wording is final. Until the flow is built and counsel has answered B1, no under-16 will be placed on this platform by any route.
• A child-facing version of this notice does not exist yet. The Data Protection Commission's Fundamentals for a Child-Oriented Approach to Data Processing expects material aimed at children to be understandable by the child. Writing one is on the list; it is not done.

10. How long we keep thingsNot in force#

11. Your rights, and how you actually exercise each one hereNot in force#

This is written as a build checklist as much as a legal section, because some of these you cannot currently do in the product and we are not going to pretend otherwise.

12. ComplaintsNot in force#

You can complain to the Data Protection Commission.

You can also contact us first at privacy@sportsbiometrix.com and we would rather you did, but you are not obliged to.

13. Security, in plain termsNot in force#

EU-only hosting. Encrypted connections. Nightly encrypted off-site backups with a restore test that runs automatically every Sunday and alerts only when it fails. Passwords stored only as scrypt hashes. Signed session cookies and rate limiting. Wearable access tokens encrypted at rest. Row-level security on tenant tables, with the application's tenant role holding no privileges at all on health tables — those are reached only through checked routes. A written breach procedure with the 72-hour notification clock.

14. Changes to this noticeNot in force#

When this document leaves draft, it will carry a version and a date, and material changes will be notified rather than silently published. A consent you have already signed is snapshotted at the moment you sign it and every later render reads that snapshot, so a consent signed today cannot quietly re-render tomorrow naming a different party or a different version.

Appendix — the open items behind this draftNot in force#

Recorded so that nobody mistakes a placeholder for a decision.

1. Controller — named (Leon Raath, trading as Sports Biometrix; ruling R-FJ). Whether it should be a limited company before real athlete data is processed is with counsel (H6).
2. DPO — not appointed. The Article 37 assessment is written but unsigned and counsel has not reviewed it (H1).
3. Processor agreements: six accepted on 23 October 2026 (Hetzner, Cloudflare, Stripe, Hosting Ireland, Brevo, Anthropic). Polar, Oura and Withings are open. Garmin is a separate controller under its developer agreement.
4. US transfer for the AI assistant — Anthropic's standard data-processing agreement accepted on 23 October 2026; whether it is enough for the transfer is with counsel (G3, G6).
5. Lawful basis for coach and club access under selection pressure — unresolved (E1–E3).
6. Whether pooled norms need consent, and whether children may ever be in the pool — unresolved (C1–C6). The pooling engine must not be built before that answer.
7. Retention of results and what happens when an athlete moves club — no rule exists (H2).
8. Withdrawal control: built, team by team (see §11).
9. "Who viewed me" — not built (H7).
10. Objection and restriction controls — not built.
11. Rectification of third-party-entered clinical data — no in-product control.
12. Child-facing version of this notice — not drafted.
13. Medical-device classification — unresolved (F1, F2). It could change what may be built.
14. Scouting discovery (§4.1) — not built, and nothing about it is settled. Its lawful basis is undetermined; it depends on the "who viewed me" screen (item 9), which is not built; the transfer instruments for scouts outside the EEA (§7) do not exist; and the machinery needed before anyone under 18 could take part — routing a scout approach to a recorded guardian, an approach-window rule, and rules that differ by sport and country — has not been built or specified. Under-18s are excluded until it is.

Draft 0.4, revised 2026-10-23, factual corrections 2026-09-13, revised 2026-09-03 (first drafted 2026-08-11). Prepared in-house from the DPIA, the Solicitor Pack and the application source. Not legal advice. Not in force. Do not publish.