Privacy Policy

Effective date: October 7, 2026

Operated by: AthleteThread

Legal entity and address: To be completed before publication

Jurisdictions covered: This policy applies to individuals whose personal information is collected, used, disclosed, or otherwise processed through AthleteThread services, including individuals located in the United States, the European Economic Area, the United Kingdom, Switzerland, Canada, Australia, New Zealand, Brazil, and other jurisdictions where AthleteThread offers the service or processes personal information.

This policy is intended to provide general and jurisdiction-specific disclosures and rights notices. AthleteThread must complete the legal-entity name, principal business address, representative details, supervisory-authority details, and any jurisdiction-specific registration information before publication. This policy is not a substitute for customer-specific notices, contracts, data-processing agreements, consent forms, or legal advice. If applicable law requires a separate notice, consent, representative, contractual document, or other safeguard, that requirement controls.

1. About AthleteThread

AthleteThread provides tools that help coaches organize athlete information, lesson notes, coaching recaps, goals, and development plans.

Only coaches have accounts and access to the coaching application. Athletes do not receive AthleteThread accounts. Coaches may maintain records about minor and adult athletes. Authorized parents, guardians, and other recipients may receive individual recaps by email notification or through protected links without creating an account.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information and how individuals may exercise applicable privacy rights.

For purposes of applicable data-protection laws, AthleteThread may act as a controller, business, processor, service provider, or similar entity depending on the information, purpose, customer relationship, and jurisdiction. Coaches and organizations may independently control athlete records and may have their own notice and legal obligations.

2. Information We Collect

We collect information provided by coaches, authorized recipients, and people who contact us, including:

Coach account information: Name, email address, authentication information, and coaching organization information, if provided.

Athlete records: Name, age or age range, coaching goals, lesson notes, skill observations, progress, and development history.

Coaching content: Recaps, summaries, development plans, AI-generated drafts, and coach revisions.

Recipient information: Names, email addresses, and sharing permissions for parents, guardians, and other authorized recipients.

Authorization records: Information documenting permission, the scope of that permission, and later changes or withdrawals.

Communications: Support messages, privacy requests, and related correspondence.

We also collect technical information needed to operate and protect the service, including IP addresses, device and browser information, login and authentication events, security events, and recap-access logs.

Payment information, if applicable: AthleteThread does not currently process payments through the service and does not collect payment-card or bank-account information. If payment processing is introduced, we will update this policy or provide any additional notice required before collecting payment information.

Coaches primarily provide athlete information. We may receive additional information directly from athletes, parents, guardians, or authorized representatives when responding to requests.

3. How We Use Information

We use personal information to:

Create and administer coach accounts.

Maintain coaching records and athlete development histories.

Generate, edit, and store coaching recaps and plans.

Deliver approved recaps to authorized recipients.

Document and manage authorizations.

Provide support and respond to privacy requests.

Maintain, troubleshoot, and secure the service.

Prevent unauthorized access, fraud, and misuse.

Comply with legal obligations and address legal claims.

We limit collection and processing to information reasonably necessary for these purposes.

We do not sell personal information or share it for cross-context behavioral advertising. We do not use athlete records for targeted advertising. We do not use athlete records to train general-purpose AI models, and we do not authorize our AI providers to do so under the applicable service arrangements.

4. Legal Bases for Processing

Where applicable law requires a legal basis, AthleteThread relies on one or more of the following:

Performance of a contract: To create accounts, provide requested features, store and transmit content, deliver recaps, provide support, and administer the customer relationship.

Legitimate interests: To secure and improve the service, prevent fraud and misuse, maintain records, communicate with users, manage business operations, and establish or defend legal claims, provided those interests are not overridden by applicable rights.

Consent: Where consent is required, including certain processing involving minors, optional technologies, certain communications, or sensitive information.

Legal obligation: To comply with court orders, regulatory requirements, tax, accounting, security, reporting, and other legal obligations.

Vital interests: Only where necessary to protect someone’s life or physical safety and no other lawful basis is reasonably available.

Public interest or substantial public interest: Only where recognized and permitted by applicable law.

For customer-controlled athlete records, the relevant coach or organization is responsible for identifying and documenting the legal basis for its processing. AthleteThread processes those records on the customer’s documented instructions and does not replace the customer’s legal obligations.

Where consent is used, it may be withdrawn at any time, subject to applicable law. Withdrawal does not affect processing that occurred before withdrawal and does not prevent processing based on another lawful basis.

5. Coaches’ Responsibilities, Customer Control, and AthleteThread’s Role

Coaches and organizations are the customers that generally determine the coaching purposes and means for which athlete records are collected and used. To the extent applicable law treats the coach or organization as a controller, business, or similar responsible entity, that customer controls the relevant athlete records and is responsible for:

Determining which athlete information is collected and why.

Having appropriate authority to enter athlete information.

Providing required notices.

Obtaining any required parent, guardian, athlete, or other authorization.

Keeping customer-provided records accurate.

Selecting authorized recap recipients and determining what content is shared.

Responding to requests concerning records the customer controls when applicable law assigns those responsibilities to the customer.

Giving AthleteThread lawful, documented instructions for processing customer-controlled information.

AthleteThread generally acts as a service provider, processor, or similar limited-purpose provider when it processes customer-controlled athlete records on behalf of a coach or organization. AthleteThread does not independently determine the coaching purposes for which the customer collects or uses those records.

AthleteThread processes customer-controlled information only to:

Provide the requested application and related features.

Store, organize, transmit, and display customer content.

Generate requested AI-assisted drafts.

Deliver approved recaps to customer-selected recipients.

Provide support at the customer’s direction.

Maintain, troubleshoot, monitor, and secure the service.

Prevent unauthorized access, fraud, misuse, and security incidents.

Comply with documented customer instructions, applicable law, or legally binding requests.

AthleteThread will not sell customer-controlled athlete records, use them for cross-context behavioral advertising, or use them to train general-purpose AI models. AthleteThread will not use customer-controlled information for an unrelated purpose except as permitted by the applicable customer agreement, data-processing terms, or law.

Where required by applicable law or contract, AthleteThread will:

Process customer-controlled information only on documented instructions.

Require personnel with access to maintain confidentiality.

Maintain appropriate technical and organizational security measures.

Assist the customer with applicable privacy requests, security incidents, impact assessments, audits, and regulatory inquiries to the extent reasonably necessary.

Notify the customer of a confirmed security incident involving customer-controlled information as required by applicable law or contract.

Use subprocessors only under written terms requiring protections consistent with the applicable customer agreement and data-processing terms.

Delete or return customer-controlled information at the end of the applicable service relationship, subject to lawful retention requirements and the retention periods described in Section 12.

Make relevant information about subprocessors and processing locations available as required by applicable law or contract.

AthleteThread may process certain information for its own independent business purposes, including:

Administering coach accounts and customer relationships.

Billing, if introduced.

Maintaining service records.

Preventing fraud and misuse.

Securing systems.

Monitoring and improving service reliability.

Responding to support and privacy communications.

Complying with legal obligations.

Establishing or defending legal claims.

Managing a merger, acquisition, financing, or other business transaction.

When AthleteThread determines the purposes and means of this processing, it acts as an independent controller, business, or other entity responsible for that processing to the extent applicable law recognizes that role.

AthleteThread remains responsible for its own independent processing and cannot transfer those responsibilities to a customer by contract.

AthleteThread may receive and respond directly to privacy requests from athletes, parents, guardians, authorized representatives, coaches, and other individuals.

If a request concerns customer-controlled athlete records, AthleteThread may coordinate with the relevant customer, forward the request, or direct the requester to the responsible coach or organization.

AthleteThread will provide reasonable assistance where required, but the customer remains responsible for decisions about customer-controlled records when applicable law assigns that responsibility to the customer.

AthleteThread remains responsible for requests concerning information it independently controls and for its own legal obligations, including obligations that cannot be transferred by contract.

A coach’s or organization’s responsibilities do not replace AthleteThread’s own obligations under applicable law.

Similarly, AthleteThread’s role as a service provider or processor does not make it responsible for decisions independently made by a coach or organization about athlete records, recipients, coaching activities, authorization, or the accuracy of customer-provided information.

6. Minor Athletes, Age Thresholds, and Parent or Guardian Authorization

AthleteThread is designed for coaches, not for children to use directly. Athletes do not create AthleteThread accounts, regardless of age.

For purposes of this policy, an athlete is a minor until reaching the age of majority in the athlete’s applicable jurisdiction. The age of majority may vary by jurisdiction and may be different from the age at which a person may independently consent to particular types of data processing.

Where applicable law establishes a different age threshold, parental-consent standard, notice requirement, or verification requirement, that legal requirement controls.

The coach or organization must determine, before collecting or submitting information about a minor, what notice, consent, authorization, or other legal basis is required. AthleteThread does not treat a general statement in this policy as a substitute for a legally required, verifiable parental consent process.

Where applicable law requires verifiable parental consent, the coach or organization must obtain that consent before the relevant collection, use, disclosure, or AI processing begins.

The consent process must identify the information and purposes covered and must use a method reasonably calculated to verify that the consenting person is the child’s parent or legal guardian, consistent with applicable law.

Depending on the circumstances and applicable law, verification may include confirming the person’s identity, relationship to the athlete, contact information, or other reasonably necessary documentation.

AthleteThread may provide or require a consent workflow, request additional information, or suspend processing when needed to confirm authority or satisfy legal requirements.

We do not require more information than reasonably necessary for verification and handle verification information in accordance with this policy.

Verification information will be retained only as long as reasonably necessary to document consent, comply with law, resolve disputes, or protect the service, subject to Section 12.

Where applicable law requires a particular notice, consent, age threshold, parental-consent method, or other safeguard, that requirement must be satisfied before the relevant processing or disclosure begins.

If required authorization cannot be verified, AthleteThread may suspend activation, sharing, or other processing until the issue is resolved.

Parents and guardians may contact us to review or change authorization, request corrections, request deletion, or exercise other applicable privacy rights, subject to identity verification, proof of legal authority, and applicable law.

A parent or guardian’s authority may be limited by applicable law, a court order, a custody arrangement, or the athlete’s own rights under applicable law.

When an athlete reaches the age of majority, or otherwise becomes legally able to control the relevant privacy decisions under applicable law, the athlete becomes the primary person authorized to make decisions about the athlete’s records and future sharing, subject to applicable law.

AthleteThread may request reasonable verification of the athlete’s age and identity before changing permissions or responding to a request.

The athlete may confirm, modify, or withdraw prior authorization and may designate whether a parent, guardian, or other recipient may continue receiving recaps.

A parent’s or guardian’s prior authorization does not automatically provide continuing access to an adult athlete’s records, and existing recipient permissions may be suspended or reassessed until the athlete provides current authorization where required.

Reaching the age of majority does not automatically delete the athlete’s records or invalidate every prior processing activity.

Processing that occurred lawfully before majority may remain documented as required for service operation, legal compliance, security, dispute resolution, or other lawful purposes.

However, future processing or sharing that depends on parent or guardian authorization will not continue after majority unless the athlete provides authorization or another lawful basis applies.

Withdrawal of authorization stops future processing and sharing that depend on the withdrawn authorization, subject to applicable law and any other lawful basis for retention or processing.

We will take reasonable steps to disable future access, revoke active recap links, and stop future delivery of affected recaps after receiving and verifying the withdrawal.

Withdrawal does not necessarily undo processing that occurred before withdrawal, delete records that must be retained for legal, security, accounting, dispute-resolution, or other lawful purposes, or require deletion where another lawful basis applies.

Withdrawal also does not automatically recall, delete, or control copies of recaps that were already delivered, viewed, downloaded, printed, photographed, forwarded, or otherwise retained by coaches, parents, guardians, athletes, or other recipients.

AthleteThread will not knowingly continue distributing an affected recap through the service after a verified withdrawal, but it cannot guarantee deletion of copies held outside AthleteThread or control what recipients have already shared with others.

Where reasonably practicable and legally permitted, we may notify relevant recipients that authorization has been withdrawn and request deletion of external copies, but external recipients remain responsible for copies in their possession.

7. Sensitive and Medical Information

AthleteThread is intended for coaching observations, skills, goals, and progress—not medical records.

Coaches must not enter:

Diagnoses, injury histories, treatment details, medications, mental-health information, or medical documents.

Social Security numbers or government identification documents.

Financial account information.

Precise location information or other sensitive information unnecessary for coaching.

If prohibited information is identified, we restrict further processing and arrange appropriate removal, subject to legal requirements.

This restriction does not mean our systems can automatically identify every instance of sensitive information.

AthleteThread does not provide medical diagnosis, treatment, or professional medical advice.

Where applicable law treats information as sensitive or special-category data, the coach or organization is responsible for ensuring that an additional lawful condition, consent, authorization, or safeguard exists before entering or processing that information.

AthleteThread does not intentionally request sensitive information for ordinary coaching functions.

8. Artificial Intelligence

AthleteThread uses OpenAI API services as a subprocessor or service provider to help turn coaching information into draft recaps, summaries, and development plans.

OpenAI processes information under the applicable API terms and contractual arrangements to provide the requested service and may process limited information for security, abuse prevention, or misuse monitoring as described in those terms.

OpenAI is not authorized by AthleteThread to use AthleteThread’s athlete information to train general-purpose models or for unrelated advertising purposes.

AI provider: OpenAI, L.L.C.

Current information is available at:

Information processed: Coaching notes, athlete goals, skill observations, progress information, recap content, development-plan content, and limited contextual information needed to generate the requested output.

AthleteThread does not intentionally transmit unnecessary direct identifiers, medical information, government identifiers, financial information, or precise location information.

Contractual safeguards: AthleteThread requires the AI provider to process submitted content only for the contracted API service and permitted security and abuse-prevention purposes, maintain confidentiality and security safeguards, restrict use for general-purpose model training, and apply applicable retention and deletion terms.

AthleteThread also limits the information sent to the provider and requires appropriate safeguards for subprocessors and international transfers where applicable.

These safeguards depend on the applicable provider terms, configuration, and customer agreement.

Provider retention: OpenAI API inputs and outputs are not used to train OpenAI’s general-purpose models by default under the applicable API terms.

OpenAI may retain API content for a limited period for abuse and misuse monitoring unless a qualifying zero-data-retention or modified-abuse-monitoring arrangement applies.

The applicable retention period, exceptions, and eligibility depend on the current provider terms and the configuration of AthleteThread’s account.

AthleteThread does not represent that a zero-data-retention or modified-abuse-monitoring arrangement applies unless separately confirmed in the applicable customer agreement or provider documentation.

We limit information transmitted to what is needed for the requested feature and remove direct identifiers where practical.

Information remains protected as personal information when removing identifiers does not make it anonymous.

AI-generated content may be inaccurate or incomplete. Coaches must review and approve content before sharing it.

AI output does not replace a coach’s professional judgment.

Where applicable law grants rights relating to automated decision-making, profiling, or meaningful information about AI processing, individuals may contact AthleteThread using the details in Section 23.

AthleteThread does not use AI-generated content to make decisions producing legal or similarly significant effects about individuals.

9. Disclosures, Service Providers, and Contractual Safeguards

AthleteThread discloses information according to the role and purpose described in Section 5. Customer-controlled athlete records are disclosed to service providers only as necessary to provide the requested service, follow documented customer instructions, maintain security and reliability, comply with law, or perform another purpose permitted by the applicable customer agreement or data-processing terms.

Information AthleteThread independently controls may also be disclosed for AthleteThread’s own lawful business purposes described in this policy.

Authorized users and recipients

Authorized coaches and customer personnel: Access customer-controlled records within permissions assigned by the coach or organization. The customer is responsible for assigning and reviewing those permissions.

Authorized recap recipients: Receive only the particular content approved for sharing by the coach or organization. Recipients are not service providers and may use or retain information outside AthleteThread’s control.

Parents, guardians, athletes, and representatives: May receive information when authorized by the customer, the relevant individual, applicable law, or a verified privacy request.

Service provider categories

AthleteThread may use the following categories of service providers and subprocessors:

Cloud hosting and infrastructure providers: Host application systems, databases, networks, and related infrastructure; provide availability, resilience, monitoring, and security services.

Storage and backup providers: Store application data, uploaded content, logs, and encrypted backups; support recovery and business continuity.

Authentication and identity providers: Support coach login, authentication, account recovery, session management, and access controls.

AI processing providers: Process limited coaching content to generate requested drafts, summaries, or plans.

Email and communications providers: Deliver account messages, recap notifications, privacy communications, and security notices.

Customer support and service-management providers: Help AthleteThread respond to support requests, privacy requests, abuse reports, and operational issues.

Security, monitoring, and fraud-prevention providers: Detect threats, investigate misuse, monitor availability, protect accounts, and maintain service integrity.

Professional advisers and legal service providers: Provide legal, accounting, compliance, insurance, audit, or similar professional services.

Business transaction participants: May receive information in connection with a merger, acquisition, financing, reorganization, or sale of assets when reasonably necessary and legally permitted.

Providers processing information on AthleteThread’s behalf are subject to written contractual requirements appropriate to their role, including permitted use, confidentiality, security, access restrictions, retention and deletion, incident notification, subprocessor controls, and cooperation with applicable privacy obligations.

The exact obligations may vary by jurisdiction, provider, and customer agreement.

AthleteThread does not currently publish a separate provider list.

The providers identified in this policy include OpenAI for AI processing and the infrastructure, authentication, email, storage, security, monitoring, and support providers selected by AthleteThread to operate the service.

The current provider list and applicable processing locations may be requested from the Privacy Contact identified in Section 23, subject to confidentiality, security, and legal limitations.

We may also disclose information to:

Legal and security recipients: When required by law or reasonably necessary and legally permitted to address threats, misuse, fraud, security incidents, or legal claims.

Government authorities and courts: When required by a valid legal process or necessary to comply with applicable law.

Business transaction participants: As described above and subject to appropriate confidentiality protections and applicable notice or consent requirements.

We do not sell personal information or disclose it for cross-context behavioral advertising.

We do not disclose customer-controlled athlete records to a provider for the provider’s independent advertising, unrelated commercial purposes, or general-purpose AI model training.

10. Recap Sharing

Coaches must verify recipient details and sharing authority before approving a recap.

Recap notifications may use protected links. Access may require verification through the approved recipient’s email or another authentication method selected by AthleteThread.

Email verification alone may not establish legal identity, parental status, or legal authority.

Coaches and organizations remain responsible for selecting recipients and confirming that sharing is lawful.

Recipients can access only the content shared with them, not the athlete’s entire coaching record.

Links expire after seven days unless access is revoked sooner.

An authorized coach may issue a new link when appropriate.

Recipients may still copy, download, photograph, or forward information after accessing it.

AthleteThread cannot recall copies retained outside the service.

Deleting a record or revoking a link prevents further access through that link but does not necessarily delete external copies.

11. Cookies and Similar Technologies

AthleteThread uses strictly necessary session cookies and similar browser-storage technologies required for authentication, session management, security, and application preferences.

These technologies generally remain active for the browser session or until the applicable authentication session expires or is revoked.

Analytics and other optional technologies: AthleteThread does not currently use third-party advertising pixels or optional analytics technologies on athlete recap pages.

Where legally required, we obtain consent before using optional technologies and honor applicable opt-out preference signals.

If optional technologies are introduced, AthleteThread will update its cookie disclosures and consent mechanisms as required.

Browser privacy signals and Do Not Track: AthleteThread does not currently respond to Do Not Track signals as a separate technical mechanism.

We honor legally recognized opt-out preference signals where required by law and where the signal applies to the relevant processing.

We do not place advertising pixels on athlete recap pages.

12. Retention and Deletion

We keep personal information only as long as reasonably necessary for the purposes described in this policy, subject to applicable legal requirements, customer instructions, active disputes, security needs, and technical limitations.

When an athlete record is deleted:

Ordinary access is disabled and related recap links are promptly revoked.

The record and associated notes and recaps are deleted from active systems within 30 days, unless a shorter legal deadline applies or retention is required or permitted by law.

Deletion is coordinated with relevant providers according to their applicable deletion procedures and contractual terms.

Backup copies are scheduled to expire within 90 days.

If a backup is restored, applicable deletion records are reapplied before restored information becomes available for ordinary use.

These periods are targets and may vary by system, provider, legal requirement, backup architecture, customer instruction, or security investigation.

Where a law requires a different period, the legally required period controls.

Coach account information after closure:

Up to 30 days after account closure, except information retained for legal, security, fraud-prevention, dispute-resolution, or accounting purposes.

Inactive athlete records:

Deleted within 30 days after the coach or organization requests deletion or the applicable customer relationship ends, subject to lawful retention requirements and customer instructions.

Authorization records:

Retained for the duration of the relevant processing and for a period afterward reasonably necessary to document consent, authority, withdrawal, or legal compliance. A period of up to seven years may apply where reasonably necessary, but no fixed period is guaranteed for every jurisdiction or record.

Security and access logs:

Up to 12 months, unless needed longer for an active security investigation, legal obligation, fraud prevention, or dispute.

Support and privacy-request records:

Up to three years after resolution, unless needed longer for legal, regulatory, security, or compliance purposes.

AI provider copies and logs:

Retention depends on the applicable provider terms, account configuration, and customer agreement. OpenAI API content may be retained for a limited period for abuse and misuse monitoring unless a qualifying zero-data-retention or modified-abuse-monitoring arrangement applies.

AthleteThread retains related service records according to the applicable retention period above.

We may retain specific information when necessary for a legal obligation, security investigation, or legal claim.

Access and use are restricted to that purpose, and the information is deleted when the retention need ends.

Deleting information from AthleteThread does not necessarily delete copies independently retained by coaches or recipients.

13. Privacy Rights and Requests

Depending on applicable law and our role, individuals may have the right to:

Access their personal information.

Correct inaccurate information.

Request deletion.

Obtain a portable copy.

Withdraw consent.

Object to, restrict, or opt out of certain processing.

Request information about processing purposes, categories, recipients, retention, legal bases, and international transfers.

Request review of certain automated processing.

Appeal a decision about a privacy request.

Lodge a complaint with a data-protection authority or other regulator.

Submit requests to privacy@athletethread.com.

No AthleteThread account is required.

We verify identity and, where relevant, the authority of a parent, guardian, or representative using information reasonably necessary for that purpose.

We will not use verification procedures that are disproportionate to the sensitivity of the request, subject to applicable law and reasonable fraud-prevention measures.

Where a coach or organization controls the relevant records, we coordinate with that customer as appropriate without avoiding our own responsibilities.

We respond within applicable legal deadlines.

When we cannot fulfill a request, we explain the reason to the extent permitted by law and provide applicable appeal instructions.

Appeals: Submit an appeal to privacy@athletethread.com with the subject line “Privacy Request Appeal.”

We do not unlawfully discriminate against anyone for exercising privacy rights.

14. United States State Privacy Rights

This section applies to residents of U.S. states with applicable comprehensive privacy laws to the extent those laws apply to AthleteThread.

These laws include, among others, California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia.

The list is not exhaustive and may change as laws take effect, are amended, or become applicable.

Rights vary by state and may include:

The right to confirm whether AthleteThread processes personal information.

The right to access personal information.

The right to correct inaccurate personal information.

The right to delete personal information.

The right to obtain a portable copy.

The right to opt out of targeted advertising, sale, or certain profiling.

The right to limit certain uses of sensitive personal information, where provided by law.

The right to appeal a denied request.

The right to nondiscrimination for exercising rights.

The right to use an authorized agent, where permitted.

AthleteThread does not sell personal information or use it for targeted advertising.

AthleteThread does not use personal information for profiling that produces legal or similarly significant effects.

AthleteThread does not knowingly sell or use for targeted advertising the personal information of individuals under 16.

For California residents, “sale” and “sharing” have the meanings assigned by the California Consumer Privacy Act, as amended.

AthleteThread does not sell or share personal information for cross-context behavioral advertising.

California residents may request the categories of personal information collected, purposes, sources, recipients, retention periods, and other disclosures required by the California Consumer Privacy Act.

Requests may be submitted to privacy@athletethread.com.

We will not require an account to submit a request.

We may request information reasonably necessary to verify the request.

Authorized agents must provide evidence of authority where required.

We generally respond within the period required by applicable law and may extend the response period where permitted.

If a request is denied, the requester may appeal by emailing privacy@athletethread.com with the subject line “Privacy Request Appeal.”

If an appeal is denied, the requester may have the right to contact the applicable state attorney general or other regulator.

State-specific rights may apply differently to customer-controlled athlete records, information processed on behalf of a customer, deidentified information, publicly available information, employment-related information, or information subject to other exemptions.

AthleteThread will apply the role and exemptions required by applicable law.

15. European Economic Area, United Kingdom, and Switzerland

This section applies to individuals in the European Economic Area, the United Kingdom, and Switzerland.

Controller and representative details

Data controller: AthleteThread, legal entity and address to be completed before publication.

EU representative: To be appointed and identified before publication if required by Article 27 of the GDPR.

UK representative: To be appointed and identified before publication if required by Article 27 of the UK GDPR.

Swiss representative: To be appointed and identified before publication if required by Swiss data-protection law.

Individuals may contact AthleteThread or the applicable representative using the contact details in Section 23.

Depending on the processing, AthleteThread may act as a processor for a coach or organization or as an independent controller for its own account, security, support, legal, and operational processing.

The relevant coach or organization may be the controller for athlete records and may have separate obligations to provide notices and respond to requests.

Individuals may have the right to:

Access personal data.

Correct inaccurate or incomplete personal data.

Erase personal data.

Restrict processing.

Object to processing based on legitimate interests or direct marketing.

Receive personal data in a portable format.

Withdraw consent.

Object to certain automated decision-making.

Lodge a complaint with a supervisory authority.

Requests may be submitted to privacy@athletethread.com.

We generally respond within one month, subject to lawful extensions.

We may request additional information to verify identity.

Individuals may lodge a complaint with the supervisory authority in the country where they live, work, or believe an infringement occurred.

Relevant authority information is available through:

European Data Protection Board:

UK Information Commissioner’s Office:

Swiss Federal Data Protection and Information Commissioner:

For processing based on legitimate interests, individuals may object on grounds relating to their particular situation.

AthleteThread will stop the processing unless it demonstrates compelling legitimate grounds or needs the information to establish, exercise, or defend legal claims.

AthleteThread does not make decisions based solely on automated processing that produce legal or similarly significant effects.

If that practice changes, AthleteThread will provide required information and safeguards before the change takes effect.

Where AthleteThread processes special-category data, it will do so only where an applicable legal condition exists and appropriate safeguards are in place.

AthleteThread does not intentionally request special-category data for ordinary coaching functions.

16. Canada

This section applies to individuals in Canada, including where applicable under the federal Personal Information Protection and Electronic Documents Act and substantially similar provincial laws.

AthleteThread is responsible for personal information under its custody or control and will identify the purposes for which information is collected, used, or disclosed.

Consent is generally obtained where required, subject to lawful exceptions.

Consent may be express or implied only where permitted by applicable law and appropriate to the sensitivity and context of the information.

Individuals may withdraw consent, subject to legal or contractual restrictions and reasonable notice.

Individuals may request access to personal information, correction of inaccurate information, information about collection and use, and information about disclosures.

Requests may be submitted to privacy@athletethread.com.

AthleteThread may process or store personal information outside Canada, including in the United States and other countries.

Information processed outside Canada may be subject to the laws of those jurisdictions and may be accessible to courts, law-enforcement agencies, and national-security authorities in accordance with applicable law.

AthleteThread uses contractual and technical safeguards appropriate to the transfer and provides any notice required by applicable law.

For Canadian privacy complaints, individuals may contact AthleteThread first.

If the complaint is not resolved, individuals may contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator.

17. Australia

This section applies to individuals in Australia and is intended to address the Australian Privacy Act 1988 and the Australian Privacy Principles where applicable.

AthleteThread may collect, use, and disclose personal information for the purposes described in this policy.

Individuals may request access to or correction of personal information and may complain about privacy handling by contacting privacy@athletethread.com.

AthleteThread may disclose personal information to overseas service providers, including providers located in the United States and other countries.

Before making an overseas disclosure, AthleteThread will take steps required by applicable Australian law, including reasonable steps concerning the handling of personal information by overseas recipients where required.

The legal consequences of an overseas disclosure may vary depending on the recipient, contractual arrangements, and applicable law.

If a complaint is not resolved, individuals may contact the Office of the Australian Information Commissioner:

18. New Zealand

This section applies to individuals in New Zealand where the Privacy Act 2020 applies.

Individuals may request access to and correction of personal information and may complain about privacy handling by contacting privacy@athletethread.com.

AthleteThread may disclose information to overseas service providers where permitted by applicable law and will use reasonable safeguards for those disclosures, including the safeguards required by the Information Privacy Principles where applicable.

If a complaint is not resolved, individuals may contact the Office of the Privacy Commissioner of New Zealand:

19. Brazil

This section applies to individuals in Brazil where the Lei Geral de Proteção de Dados Pessoais applies.

AthleteThread may process personal data on the legal bases recognized by Brazilian law, including consent, compliance with legal or regulatory obligations, execution of contracts, exercise of rights, legitimate interests, and protection of life or physical safety where applicable.

Individuals may request confirmation of processing, access, correction, anonymization, blocking, deletion where applicable, portability, information about public and private entities with which data is shared, information about the possibility of refusing consent, and review of automated decisions where applicable.

The scope, form, and timing of these rights may depend on applicable law and regulatory requirements.

Requests may be submitted to privacy@athletethread.com.

AthleteThread will respond within the periods required by applicable law.

Brazilian data-protection officer or contact: To be appointed and identified before publication if required.

Individuals may contact the Autoridade Nacional de Proteção de Dados:

20. Processing Locations and International Transfers

Personal information may be stored or accessed in the United States and other countries where AthleteThread, OpenAI, or other service providers maintain facilities or personnel.

Support and administrative access may occur from the United States.

Where applicable law requires safeguards for international transfers, AthleteThread implements those safeguards before making the transfer.

The applicable safeguard may depend on the destination country, the parties’ roles, the type of information, the transfer mechanism, and the applicable law.

For transfers from the European Economic Area, the United Kingdom, or Switzerland to countries not recognized as providing adequate protection, AthleteThread uses an applicable adequacy decision, Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, Swiss-approved or recognized contractual mechanisms, or another lawful transfer mechanism, as applicable.

Where required, AthleteThread also applies supplementary safeguards based on the circumstances of the transfer.

Individuals may request additional information about applicable transfer mechanisms by contacting privacy@athletethread.com, subject to lawful limitations.

For transfers from Canada, Australia, New Zealand, Brazil, or other jurisdictions, AthleteThread uses contractual, technical, organizational, or other safeguards required by applicable law.

No transfer safeguard guarantees that foreign authorities will be unable to access information where access is authorized under the law of the destination country.

21. Security and Required Notices

We maintain administrative, technical, and physical safeguards appropriate to the information we process.

These may include access restrictions, protected

authentication, encryption in transit and at rest where supported by the relevant system, provider oversight, logging, backup controls, and procedures for investigating security incidents.

Access to personal information is limited to authorized people with a legitimate need. We review access controls and maintain procedures for securely disposing of information.

No storage or transmission system is completely secure. If an incident occurs, we investigate, take appropriate corrective action, and provide notices required by applicable law to affected individuals, customers, regulators, law-enforcement authorities, or other recipients.

Notification timing and content depend on the applicable law, the type of incident, the information involved, the risk of harm, and AthleteThread’s role.

Where required, security notices may be delivered by email, through the service, by direct communication, through a customer or organization, by public notice, or by another legally permitted method.

Notices may describe the nature of the incident, affected information, steps taken, recommended protective measures, and available contact information.

For customer-controlled information, AthleteThread will notify the relevant customer or organization as required by the applicable agreement and law.

The customer may be responsible for notifying affected individuals or regulators where applicable, while AthleteThread remains responsible for notices and obligations that apply directly to AthleteThread.

Report suspected security issues to Trey Morrill, Co-CEO, or Riley Egloff, Co-CEO and Founder, at security@athletethread.com.

22. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements.

We display the effective date and provide notice of material changes as required by law.

If a new use or disclosure requires consent, we obtain that consent before proceeding.

Posting an updated policy or continued use of the service does not replace legally required consent.

23. Contact Us

Legal operator: AthleteThread

Legal entity: To be completed before publication

Principal business address: To be completed before publication

Privacy contact: privacy@athletethread.com

Security contact: security@athletethread.com

Data-protection officer: To be appointed and identified if required

EU representative: To be appointed and identified if required

UK representative: To be appointed and identified if required

Swiss representative: To be appointed and identified if required

Brazilian data-protection officer or representative: To be appointed and identified if required

Mailing address: To be completed before publication

Privacy request form: No separate form is currently available. Submit requests by email to privacy@athletethread.com.

Supervisory-authority information: Available through the applicable authority identified in Sections 15 through 19 or by contacting privacy@athletethread.com.