How we protect
athlete data.

We hold it for the school and the athlete, and never claim ownership.

See the data path

One path, two hard stops.

Where a check-in goes, and where it never goes.

  1. Athlete check-in

    Five quick steps on their phone.

  2. Parental consent

    For athletes under 18, the app takes no check-in until a parent or guardian consents.

    About parental consent

  3. Wellness record

    Stored in Sydney.

  4. Also goes to

    An AI service outside Australia, for the athlete’s daily insight, the coach’s team summary and recovery suggestions.

  5. Never reaches

    Medical or clinical records systems

  6. Never reaches

    Adver­tis­ers or data brokers

Who can read each record.

Access depends on a person’s role and is enforced in the database, not only in the app’s screens.

The athlete:
their own data
Their coach:
their team’s details
School administrators:
their whole school’s records
Other schools:
never
Sample data
The administrator’s Settings page, Roles tab: a table of access roles, head coach, coach and administrator, with each one’s team scope and sensitive data, 1 administrator and no role changes recorded yet

The specifics, in plain English.

What AI features receive

The app never adds names. The AI service is Lovable, running Google’s Gemini models. An AI assistant you connect to your account can read some of what it can see, including names.

An athlete’s daily insight:
check-in answers, the past week’s recovery scores, soreness areas, training load and workload ratio, the lowest development score and the gym program’s name.
A coach’s team summary:
the sport, team counts, average recovery scores and the most reported soreness areas.
Recovery suggestions:
the sport, a game’s date, goal, difficulty, exercises per day, soreness areas, tools and schedule, and a body area, issue and severity. A typed Other note is sent as written.
Exercise videos:
an exercise’s name and a line describing it.
Reading a gym program photo:
the photo a coach takes of a written program, sent as taken.
Encrypted in transit and in storage

Supabase stores the records on Amazon Web Services, in Sydney. Every connection to them is encrypted (TLS).

A copy, or deletion, in the app

Athletes and coaches download a copy of their data, or delete their account, in the app. Anyone can also ask us.

Consent, checked in the database

The database itself refuses a check-in from an athlete under 18 until a parent or guardian consents.

Withdrawing consent

A parent or guardian can withdraw consent at any time through the school.

Accounts and passwords

Everyone signs in with their own email address and password. Passwords are hashed: we never see or store them in plain text.

An audit trail

Role changes, suspensions and consent actions are recorded.

Where card details go

To Stripe’s checkout, never to our servers.

Not a medical record

A check-in is a wellness signal, not a diagnosis or a clinical assessment.

Services outside Australia

Named in the Privacy Policy. Four serve this website:

Cloudflare:
every page
jsDelivr:
the consoles, sign-in, enrolment, plan and consent pages
Google Fonts:
the consoles
Google Analytics:
the pages that ask about analytics cookies, once you accept

Need a compliance questionnaire answered or a privacy agreement signed? Email hello@athleticadvantageschool.com.

See pricing