How we handle your data

Athletic Advantage is a wellness and development platform used by school athletic programs. This policy applies to school administrators, coaches, and athletes who use our website consoles or mobile app, and to parents/guardians who interact with us on an athlete's behalf (for example, to grant consent).

Your school is the primary point of contact for how your data is used at that school — we act as the school's data processor. Nothing here overrides a data processing agreement your school has separately signed with us.

Account information: name, email, role (admin, coach, or athlete), and school affiliation. For athletes, also date of birth, and the name, email and relationship of the parent or guardian asked for consent. When the parent or guardian answers, their answer is stored with the time and the IP address it came from.

Wellness data (sensitive health information): daily check-in responses — how well and how long they slept, muscle soreness and where they are sore, energy, how fresh their legs feel, stiffness, pain, hydration, mood, stress, motivation, whether they feel sick (with follow-up questions about cough, fever and stomach symptoms), and any specific problems they select — pain and injury reports (where it hurts and how badly), training load and session logs, recovery and gym program assignments, and automated ACWR workload and Recovery Score figures calculated from the above.

Development data: scores across the six development domains, entered by coaches and, as self-assessments, by athletes — Fitness, Tactical, Technical, Culture, Mental, and Wellness — used to track an athlete's individual development plan. A plan can also hold goals, priorities and comments, background such as age, position, clubs and representative level, and injury history and medical conditions, where a coach or athlete records them. Coaches can also record fitness test results.

Notes, comments and cases: a coach can keep private notes about an athlete, each with a category such as wellness, behaviour or injury context, and can add comments about an athlete. When a concern about an athlete needs the school's attention, such as a safeguarding concern, a case is recorded with its category, its severity, notes on what was done, and its outcome.

AI daily insights: the short daily insight the app's AI writes for an athlete is stored with their account.

Communications: team messages, direct messages between coaches and athletes, and department announcements. Messages are checked automatically for safeguarding keywords, and a message that matches is flagged to the school's administrators. Messages will be deleted 12 months after they are sent, once automatic deletion is running; until then, they are deleted on request (see §8).

Technical data: when you sign in, the sign-in time, your IP address and your browser are recorded to keep your account secure. Basic usage analytics are collected only after you accept our cookie notice. Neither is combined with wellness data.

Wellness and development data exists for one purpose: to help coaches and school staff support athlete wellbeing and make more informed training decisions. We do not use it for advertising, we do not sell it, and we do not repurpose it beyond what your school has engaged us to do.

Every athlete under 18 needs a parent or guardian's recorded consent before the app takes any check-in from them. See our About parental consent page for how that works, and our Wellness Data Policy for exactly what "wellness data" means in this product.

Access is scoped by role and enforced at the database level, not just in the app's screens:

• An athlete can see only their own data.
• A coach can see only athletes on teams they're assigned to — never another coach's team, and never another school.
• A school admin can see only their own school — never another school's data. Within their own school, an admin can also read and search team and direct messages.

Notes, comments and cases have their own readers. A coach's private note is read only by the coach who wrote it, and also by the school's admins when the coach marks it for them. A comment is read by the coach who wrote it and the athlete it is about. A case is read by the school's admins and the coach of the athlete's team. An athlete's AI daily insight is read by the athlete alone.

We do not share individual wellness data with any third party outside your school, except the infrastructure providers listed below, each bound to only process it on our instructions.

Your school's records — accounts, check-ins, wellness and development data, and messages — are stored in Australia (AWS Sydney, ap-southeast-2) by our database provider, Supabase. We chose an Australian region specifically because this product handles children's health data and many government schools require in-country residency.

Some services process data for us outside Australia. Sub-processors we currently use, and where each one processes data:

• Supabase — database and authentication. Hosted in Sydney.
• Resend — account emails (confirmations, password resets and consent requests), never wellness content. Processed outside Australia.
• Stripe — subscription payments. Card details go directly to Stripe and never reach our servers. Processed outside Australia.
• Google Analytics — website usage statistics, loaded only after you accept our cookie notice (see §10). Processed outside Australia.
• Cloudflare — hosts this website and serves its pages; like any web host it receives your IP address and the pages you ask for. Its global network may process a request outside Australia.
• Lovable hosts the web version of the athlete app, and the pages its sign-in emails open; like any web host it receives your IP address and the pages you ask for. Its network may process a request outside Australia.
• jsDelivr — serves the Supabase code library that the sign-in, enrolment, plan and consent pages and the web consoles load; it receives your IP address when the library loads. Processed outside Australia.
• Google Fonts — serves the typeface used by the web consoles; it receives your IP address when the font loads. Processed outside Australia.
• Lovable (AI gateway) and Google (Gemini models) — some app features use AI: an athlete's daily insight, team summaries for coaches, recovery session and program suggestions, reading a photo of a written gym program, and finding exercise demo videos (which also searches YouTube, run by Google). Each feature sends only the information it works from, such as check-in answers and recent recovery scores, soreness areas, training load, development scores, team counts and averages, sport, recovery goals and schedules, and program or exercise names. The app never adds names. Two items are sent as written: a photo a coach takes of a written gym program, and a short note an athlete can type when choosing "Other" as an issue. Processed outside Australia.

If you connect your own AI assistant to your account, it can read some of what your account can see, including names and email addresses: your email, role and teams, your own check-ins and training, and, for a coach, the name and email address of each athlete on their teams. Where that assistant processes it depends on the assistant you choose.

• Encrypted in transit (TLS) and at rest.
• Passwords are hashed — we never see or store them in plain text.
• Row-level security enforced per school and per role on every table that holds personal or health data.
• The credentials that could bypass these protections never ship to your browser or the app.

We keep wellness and account data for as long as your school's subscription is active and your account exists. Team and direct messages will be deleted 12 months after they are sent, once automatic deletion is running. Until then, a school or a user can ask us to delete them, as set out in §9. When an athlete leaves a school or a school ends its subscription, we delete or de-identify their data on request.

You (or, for a minor, their parent/guardian) can ask us to: give you a copy of the data we hold, correct anything inaccurate, or delete your account and associated data. Contact your school first, or email us directly — see below.

We only load analytics tools after you actively accept our cookie banner. Analytics never receives wellness data, health information, or anything that identifies an individual athlete.

If we make a material change to how we handle your data, we'll update the date at the top of this page and, where required, ask for your consent again.

Questions about this policy or your data: hello@athleticadvantageschool.com