Privacy Policy

• We never sell your data, and we never share it with governing bodies, insurers or advertisers.
• Your club or school decides how its sensor data is used. We provide the tool and follow their instructions.
• Nothing is recorded about a player until they, or a parent for younger players, agree. Saying no just means not wearing a sensor.
• Research is optional. If you opt in, we make your data anonymous before using it.
• Data is deleted on a clear schedule, for example 30 days after a player leaves a team.

Sports Impact Technologies Limited makes head impact sensors and the Apps that go with them. We are registered in Ireland.

This policy covers the Apps only. Our website is for information and does not collect personal data.

Your club or school also has its own privacy notice. It explains how they use the data they collect through the Apps.

Who is responsible for your data depends on who decides how it is used.

• When we decide why and how data is used, we are the controller. Questions and requests about that data come to us.
• When your club or school decides, they are the controller. We are their processor: we handle the data only on their instructions, under a contract with them.

When we act for your club, the club's own privacy notice applies. You can contact your club, or contact us and we will pass your request on and help them deal with it.

We do not collect your location or advertising identifiers, and we do not use analytics, tracking or advertising tools.

The GDPR requires a legal reason, or "legal basis", for each use. This table covers what we do as a controller.

Data we process for clubs. For team lists, sessions and impact data recorded for a club, the club chooses its own legal basis. Its privacy notice explains which. We help by collecting players' consent on the club's behalf (see section 5).

We do not send marketing emails. If we start, we will ask for your consent first.

No impact data is recorded about a player until they, or their parent, has agreed.

1. 1
   Your coach shares a sign-up link with parents and guardians, or with players aged 16 or over. Nothing is recorded about you or your child until you use it.
2. 2
   You open the link, tell us who you are and who your child is, and read the parent notice and this policy.
3. 3
   You make two separate choices:

   • Club tracking (required to wear a sensor). You agree to your club recording and using your child's impact data. The sensor measures how hard and how often their head is hit during training and matches. This is health information. This consent is given to your club; we collect it on their behalf.
   • Research and product development (optional). You agree to your child's impact data being made anonymous and used to study head impacts and improve SIT's products (see section 8).
4. 4
   The coach confirms your child on the team. Only then can they wear a sensor.
5. 5
   We email you a private link you can use at any time to see or change your choices.

None of the boxes are ticked in advance. Saying no to research does not affect anything else. If you say no to club tracking, your child simply does not wear a sensor and nothing is recorded about them. Saying no has no effect on whether your child is picked or plays.

Changing your mind. You can withdraw any consent at any time using your private link, by telling your club, or by emailing privacy@sportsimpact.tech.

• Club tracking: recording stops. Your child's identifiable data held for that club is deleted within 30 days.
• Research: no further data is anonymised. Data already made anonymous cannot be traced back to your child, so it cannot be removed.

Withdrawing does not make earlier use unlawful.

Players aged 16 or over use the same link and make the same choices for themselves.

For players under the age of digital consent in their country, a parent or guardian makes every choice. In Ireland that age is 16; elsewhere it varies.

• The consent form goes to the parent or guardian, not the child.
• The parent makes both consent choices and can change them at any time by contacting the club or us.
• When the player reaches the age of digital consent, they make their own choices from then on.

Players and parents do not have their own accounts. Your coach can show you your own data, or show a parent their child's data. Each club's data stays with that club only.

If you opt in, your impact data helps us understand head impacts in sport and build better, safer products.

• We make it anonymous before using it. On our own secure systems, we remove names, emails, sensor and device identifiers, and generalise dates and team details. No one, including us, can work out who the data belongs to.
• We use the anonymous data only ourselves, for research and development: to study head impacts and to develop and improve SIT's algorithms and products, including new products. We do not sell, license or share individual research records.
• We may use aggregated statistics, for example average impacts per session across all clubs, in our sales, marketing and investor materials. These never identify any player.
• For the anonymising step we are the controller, and we rely on your explicit consent. Once data is truly anonymous, it is no longer personal data.
• Your club also agrees to this in its contract with us.
• You can opt out at any time. Data already made anonymous cannot be traced back to you, so it cannot be removed.

Not opting in has no effect on your use of the Apps.

Within your club. Your club's coaches and medical staff can see impact data for their own team. Your coach can show you your own data, or show a parent their child's data. Players and parents are never shown anyone else's data.

Our service providers. These companies handle data for us under contracts (data processing agreements) that require them to protect it and use it only for us.

Apple distributes the iOS app through the App Store. Apple handles your App Store data under its own privacy policy.

When the law requires it. We may disclose data if required by law, a court order or a regulator.

If SIT is sold or merges. Your data may pass to the new owner, who must keep protecting it under this policy. We will tell you beforehand.

Our database is hosted by AWS in Dublin, Ireland, inside the European Economic Area (EEA). This applies to customers in every country, including outside Europe.

Cloudflare and HubSpot are US companies. We use their EU regions, but their US teams may still access data, for example for support. Both are certified under the EU-US Data Privacy Framework, which the European Commission recognises as giving adequate protection. Both also use the European Commission's standard contractual clauses where needed.

We keep data only as long as we need it, then delete it.

• Encryption: stored data is encrypted, and data travelling between the Apps and our servers is encrypted in transit (HTTPS).
• Secure logins: coaches log in with their own email and password. Passwords are stored scrambled, never in plain text.
• Limited access: only your club's coaches and medical staff see your team's data. Players and parents are only shown their own, or their child's, data. At SIT, only our Chief Executive Officer and Chief Technology Officer have access to the database.
• No routine access by SIT staff: we only see player data when a club asks us for help with setup or a problem. We view it to help; we do not copy or keep it.
• Research data: only from players who opt in, and made anonymous before use.

If something goes wrong. If a data breach puts people at risk, we report it to the Data Protection Commission within 72 hours. If the risk to you is high, we also tell you directly. Where we hold data for a club, we tell the club within 24 hours.

You have the following rights over your personal data. Parents can use them on behalf of younger players.

How to use them. Ask your club, or email privacy@sportsimpact.tech.

• We reply within one month. For complex requests, we can extend this by up to two more months, and we will tell you within the first month.
• We may ask you to confirm your identity first.
• For data we hold for a club, we pass your request to the club and help them answer it. You can also contact your club directly.

Device storage. The Apps store a sign-in token and your settings (such as language) on your device so they work properly. We do not use tracking or advertising cookies.

No automated decisions. The Apps do not make decisions about players on their own. Coaches set any alert levels, and your club's staff decide what to do about an impact.

We will update this policy when our practices change, and update the date at the top. For important changes, we will tell you by email or in the Apps beforehand. If a change needs new consent, we will ask for it.