Privacy Policy

1. Overview

Apex Athlete Tracker ("we", "us", "the Service") is a subscription-based software platform built for rugby teams, clubs, academies, schools, and unions. This Privacy Policy explains what personal and athlete data we collect, how we use it, and the rights you have over it. We comply with the Protection of Personal Information Act (POPIA) of South Africa and the General Data Protection Regulation (GDPR) where applicable to our users.

2. Data We Collect

• Account data: Coach and staff name, email, phone number, role, organisation, and login credentials.
• Athlete profiles: Player name, email, phone, date of birth, position, jersey number, height, weight, and photo.
• Health and wellness data: Daily wellness scores (sleep, soreness, mood, stress, energy, hydration), HRV, resting heart rate, readiness scores, and coach notes.
• Training and load data: Session attendance, RPE, lift records, GPS load metrics, fitness test results, and Acute:Chronic Workload Ratio (ACWR) values.
• Medical data: Physiotherapy notes, injury descriptions, and return-to-play protocol entries and sign-offs.
• Usage data: Device, browser, and interaction logs used for security and service improvement.

3. How We Use Your Data

• To provide training load monitoring, wellness tracking, readiness scoring, and return-to-play management features.
• To generate performance reports, dashboards, and smart alerts for coaching staff.
• To send wellness reminders, portal links, and account-related communications to athletes and coaches.
• To process subscription payments and manage trial and billing lifecycle.
• To improve the Service, diagnose technical issues, and maintain security.

4. Legal Basis

We process personal information on the basis of consent, contract performance (delivering the Service you subscribed to), legitimate interests (security and service improvement), and legal obligation (POPIA and applicable tax law). Sensitive health and medical data is processed only with the explicit consent of the athlete or their guardian, captured when the athlete is onboarded to the platform.

5. Data Sharing

We do not sell your data. Data is shared only with:

• Coaching and medical staff within your own organisation, as configured by your account administrator.
• Trusted subprocessors (cloud hosting, email delivery, payment processing) bound by written data-processing agreements.
• Authorities where required by law.

Athletes access their own data through a unique, token-based portal link. Each link is single-use per athlete and not publicly listed.

6. Data Security

Data is stored on secure, access-controlled servers with encryption in transit and at rest. Access is restricted to authorised personnel and the customer's own configured users. Row-level security ensures coaches only see records belonging to their own teams unless granted administrative access.

7. Data Retention

Upon subscription cancellation, data may be exported for 30 days. After this window, data may be permanently deleted. Coaches may request earlier deletion by contacting support. We retain limited billing records as required by South African tax law.

8. Your Rights

• Access, correct, or update your personal information.
• Request deletion of athlete or account data.
• Withdraw consent for processing sensitive health data.
• Export your squad data in a portable format.
• Lodge a complaint with the Information Regulator (South Africa) if you believe your rights have been infringed.

9. Children's Privacy

The Service is used by schoolboy rugby programmes. Where athletes under 18 are onboarded, consent for data processing (including health and wellness data) is obtained from a parent or legal guardian. Coaches are responsible for confirming guardian consent before adding minors to the platform.

10. International Transfers

Data may be processed on cloud infrastructure located outside South Africa. Where this occurs, we rely on subprocessors that provide adequate safeguards, such as Standard Contractual Clauses, to protect personal information.

11. Cookies and Analytics

The Service uses essential cookies for authentication and optional analytics to understand usage and improve features. No data is sold to third-party advertisers.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to account administrators via email or in-app notice at least 30 days before they take effect.

13. Contact

For privacy questions, data requests, or to withdraw consent, contact our Information Officer: