Health Data Handling
& Privacy Policy

We collect the following categories of health and performance information:

• Athlete Profiles: Name, contact details, date of birth, gender, bodyweight, and biometric markers.
• Clinical Records: Injury diagnoses, treatment notes, injury mechanisms, and severity assessments.
• Performance Data: VALD assessment results, gym workout logs, personal records, and running program data.
• Wellbeing Data: Daily check-in responses (sleep, stress, soreness), wellness questionnaires, and RPE (Rate of Perceived Exertion) scores.
• External Integration Data: Metrics ingested from third-party devices and services (e.g., GPS load, HRV, sleep scores) from providers such as VALD, Catapult, StatSports, Garmin, and Whoop.
• Availability & Scheduling: Training availability status, game-day availability, and session attendance records.

Your data is used solely for:

• Designing and delivering individualised training, rehabilitation, and return-to-play programs.
• Monitoring athlete health, wellbeing, and performance trends over time.
• Identifying injury risk and generating clinical alerts for coaching and medical staff.
• Facilitating communication between athletes, coaches, and medical personnel.
• Meeting team selection and competition availability requirements.

Access to your health data is governed by the principle of least privilege:

• Role-based access: Staff can only view data relevant to their role. Medical staff access is controlled through dedicated medical access permissions, scoped to specific athletes or teams.
• Coach visibility: Coaches can view data for athletes assigned to their teams only.
• Access reviews: The organisation administrator conducts regular audits of staff access permissions. Access is revoked immediately when a staff member’s employment ends or their role changes.
• Credential security: Staff must never share account credentials. All accounts are individually password-protected.

We protect your data through the following measures:

• All data is transmitted over encrypted connections (HTTPS/TLS).
• Access to the platform requires authenticated login with session management.
• Organisation-scoped data isolation ensures multi-tenant data separation.
• API keys and integration credentials are stored securely and never exposed in client-side code.
• Regular backups are conducted to prevent data loss.

Health and performance records are retained for 7 years following an athlete’s last active participation with Prospect Training Systems, in accordance with standard health record retention guidelines.

• After the retention period, athlete data is permanently and securely deleted using cascading removal protocols that purge all associated records (profiles, injuries, assessments, logs, and messages).
• Athletes may request earlier deletion of their data at any time, subject to legal and regulatory obligations.

Where data is ingested from third-party providers (VALD, Catapult, StatSports, Garmin, Whoop), it is handled with the same level of protection as all other health data within our system. Raw payloads are stored for auditing and re-parsing purposes only.

Under the Australian Privacy Principles, you have the right to:

• Access: Request a copy of the personal and health information we hold about you.
• Correction: Request that inaccurate or incomplete information be corrected.
• Deletion: Request deletion of your data, subject to retention obligations.
• Complaint: Lodge a complaint if you believe we have breached your privacy.

In the event of a suspected or confirmed data breach involving health information, Prospect Training Systems will follow mandatory reporting requirements under the APP Notifiable Data Breaches (NDB) scheme and, where applicable, HIPAA breach notification rules. Affected individuals will be notified as soon as practicable.

Clinical and coaching notes are limited to factual, objective observations. Staff are trained to record only information necessary for injury management or performance optimisation. Personal opinions or informal commentary are not permitted in athlete records.

This policy may be updated from time to time. Athletes and staff will be notified of material changes and may be required to re-acknowledge the updated policy. The current version is always accessible from the Settings page.