Privacy Policy

This is a draft policy for development purposes. It must be reviewed and approved by qualified legal counsel before production use.

The Gymnast Portal processes personal data to deliver club management, training logs, welfare tools, and communications.

The data controller for athlete data is usually the gymnastics club. The platform operator acts as a processor for club-entered data.

Account data: name, email, role, club membership.

Athlete data: profile, squad, attendance, session logs, skills progress, coach notes.

Profile images: optional athlete headshots, coach profile photos, and club logos uploaded by authorised users. Images are compressed and stored in secure cloud storage.

Session media: optional short session video highlights where enabled (separate retention rules apply).

Safeguarding data: welfare flags, incidents, and related notes where enabled.

Technical data: audit logs, notifications, consent records.

Authorised users may upload optional profile images: parents or guardians may upload a child's headshot; coaches may upload their own headshot; club administrators may upload coach profile photos and club logos; certificate artwork where enabled.

Uploading a child's photo requires valid data-sharing consent and confirmation that you have authority to provide the image. Upload is never required — generated avatars are used when no photo is set.

Profile images are visible only to authenticated users authorised to view that athlete or club context (for example coaches and club staff at the same club, and parents for their own child). They are not public.

Images are stored using Google Firebase Storage (a sub-processor). We compress images before upload to reduce size. You may request deletion via GDPR tools or by removing the photo in the app where available.

Coaches may use browser-based speech-to-text to draft notes. Audio is processed by your browser or device operating system (for example Google Chrome or Apple Safari) and is not stored by us.

Only the text you review and save is stored, in the same way as typed notes.

You can revoke microphone permission in your device or browser settings at any time.

We rely on contract, legitimate interests, legal obligations, and consent (where required) depending on the data type and user role.

Parent data-sharing consent is collected where required before guardian access to child data.

You may request access, correction, or deletion of your personal data subject to legal and safeguarding constraints.

Use the GDPR requests page in account preferences or contact your club administrator.

Data is retained according to club policies and legal requirements. Technical and audit records are kept for security and compliance.

We use industry-standard hosting (including Google Firebase) with access controls and encryption in transit.

We use sub-processors including Google Cloud / Firebase for hosting and authentication. A full list is available on request.