Privacy notice for coaches, welfare officers and club administrators

Part one: what Recov holds about you. Part two: what you are responsible for when you handle children's data through Recov — including the rules that only a person can keep, which is exactly why they are written down here.

1. Who we are, and who is responsible

Recov builds and runs the software your club uses to record junior athletes' training, wellbeing and welfare information. Your club decided to use it, invited you, and set your role.

Your club is the controller of the athlete and staff data in Recov, and Recov is its processor. For the data we need in order to operate and secure the service itself — account records, security and audit logs, and records of the emails we send — Recov is a controller in its own right.

2. What we hold about you, and why

2.1 Your account

What: your name and email address, stored as ordinary readable data; a one-way hashed version of your password, so we never hold the password itself; your date of birth if it is recorded, which is encrypted; which club and squads you belong to and what role you hold.

Why: to let you sign in, and to decide what you are permitted to see.

Lawful basis: performance of a contract (Article 6(1)(b)), and the club's legitimate interests in running its coaching and welfare programme (Article 6(1)(f)).

2.2 Sessions and devices

What: a device name, the browser or app identifier, and a hashed version of your sign-in token.

Why: to keep you signed in, to let you see and end your own sessions, and to investigate suspicious access to a system holding children's data.

Lawful basis: legitimate interests in security (Article 6(1)(f)).

We do not store IP addresses anywhere in Recov.

2.3 The audit log

What: a record of significant actions and who took them, including every change to who holds the welfare officer or deputy role. The log is append-only: it cannot be edited, by you, by a club administrator, or by us.

Why: so a club can show who saw and did what with children's data.

Lawful basis: legal obligation (Article 6(1)(c)) and legitimate interests in accountability (Article 6(1)(f)). This is data about you that you cannot have removed while it is within its retention period, and section 7 is worth reading with that in mind.

2.4 Consent records you act on

What: when a consent is granted or withdrawn, the record names who acted. If you administer a consent, your action is recorded.

Lawful basis: legal obligation (Article 6(1)(c)) — being able to demonstrate consent.

2.5 Your coaching content

What: the sessions, events, training patterns and blocks you create; the briefs you write for plan generation; the plans generated from them; and your coach comments. Stored unencrypted.

Why: to run squad planning.

Lawful basis: the club's legitimate interests (Article 6(1)(f)).

Your brief text and your comments are sent to Anthropic when a plan is generated. See section 9.

2.6 Emails we send you

What: your email address, a single-use sign-in or consent link, your club's name and its identifier, delivered through Resend. We also keep a log of what was delivered.

Lawful basis: contract (Article 6(1)(b)) and legitimate interests (Article 6(1)(f)).

Email bodies are rebuilt from fixed templates and byte-compared before sending, so an email is structurally incapable of carrying a child's name.

2.7 Seats and billing

Only athletes consume a paid seat. Coaches, guardians, welfare officers and deputies are free, and this is enforced when an invitation is issued rather than left to policy. Recov holds no payment details about you.

3. Special category data about you

Recov holds no health data, and no other special category data, about club staff. The special category protections described in the parents' and guardians' notice concern children's data, which you handle but which is not about you.

Two exceptions to note: if you are also a guardian of a child at the club, that notice applies to you in that capacity, and if you are also an athlete, the athlete data described there is held about you.

4. Who we send data to

There are no analytics, telemetry, error-reporting or advertising providers, because none are built into the product. We do not sell data. The full detail is in the sub-processor list.

5. Where data is processed

Several of Recov's providers operate globally, and data may therefore be processed outside the United Kingdom. Where it is, we rely on the transfer safeguards in that provider's data processing terms — the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, or UK adequacy regulations where they apply.

If a parent asks you where their child's data is processed, give them that answer and point them at the sub-processor list. Do not tell them it is processed in the UK.

6. How long we keep it

Retention periods are in the retention schedule, which covers staff records as well as athlete records. Two points apply particularly to you: the audit log and the consent ledger are append-only and are retained on the safeguarding schedule, and your coaching content is retained for as long as your club uses Recov.

7. Your rights

You can ask to see your data, correct it, have it erased, restrict or object to its use, receive a copy in a portable form, and withdraw any consent you have given. How to do that is in Your rights, and how to use them. We respond within one month.

8. What you can and cannot see

Access is decided in one place in the software and enforced by the system, not by each screen remembering to check. Being permitted by the table is only step one: every request independently proves the concrete relationship as well — that you actually coach that squad, that a guardian is actually linked to that child.

* An athlete under 18 is shown the method behind their calorie figure, not the figure. This applies anyway when the date of birth cannot be read.

What this means for you specifically

• A coach receives nothing from an athlete's journal. Not the text, not a summary, not a derived score. The journal is the athlete's own record, and it is designed to be unreadable by every adult role.
• Coaches cannot see meal photographs, meal descriptions or body measurements. That is deliberate. Do not ask an athlete to show you a photo or tell you their weight as a way around it — that turns a designed boundary into a social one.
• Guardians cannot see recovery markers, the soreness log or meal photographs. If a parent asks you what their child logged in those areas, you are being asked to relay data the system withholds from them. Refer them to the club's process, not to your screen.
• A guardian's access is always a subset of a coach's. There is no row a guardian sees that a coach cannot.
• An athlete can never see another athlete's data. This is checked structurally, before any category rule.
• Being a club administrator opens no athlete data at all. Administering the club is not a reason to open a child's record, and the software will not permit it. If you are also a coach, you see what a coach sees for the squads you coach, and nothing more.

9. The AI rules — free text and photographs

Neither rule can be enforced by software. They are enforced by you, which is why they appear here as obligations rather than as guidance.

10. Safeguarding: what Recov does not do

What Recov does provide is a disciplined record. Welfare officer and deputy are org-scoped roles assigned by an administrator, with every change audited. A database rule makes it impossible for an officer-tier record to exist without the athlete having been notified first. An athlete-tier notice cannot be acknowledged by any adult. The database proves at commit that at least two distinct signals converged, so one stream alone can never raise a record. The officer's queue route has no user parameter at all — "the welfare officer cannot browse children's data" is structural, not a policy. Record pattern text is encrypted with a key bound to the club and the athlete.

Investigation is deliberately off-platform and will stay that way. Your club's own safeguarding records hold the case; Recov holds only the fact that a signal was raised, delivered and acknowledged.

11. Consent: what it gates

• Which categories can be turned on depends on the squad's feature profile: core, wearable sync and body measurements on every profile; meal photos only when one of the athlete's squads is on development or performance; wellbeing logging not yet. Meal photographs and fuelling, body measurements and wearable sync are the categories on which processing genuinely depends. A core category records acknowledgement of the privacy notice and the club's use of Recov; it changes what the app displays and does not itself gate processing.
• Wearable sync lets the Recov phone app read resting heart rate, sleep and VO2 max — and, on Android, heart-rate variability — from the health app on the phone or tablet where the athlete switches it on. It needs the permission, the athlete's own Sync this phone switch and the phone's own permission. Synced numbers have exactly the same visibility as typed ones: the athlete and their coach. Withdrawing the permission stops new numbers arriving; numbers already synced stay on the athlete's record and remain visible to their coach. A synced number is whatever that device's health app held, and on a shared phone or tablet, such as a family iPad, it may be someone else's; if a reading looks wrong, ask the athlete rather than act on it.
• Settings default to off; only an explicit yes writes a record.
• The guardian's email address comes from the club — never typed in by the child. Entering it correctly is a club administrator's job and a real safeguarding responsibility: it decides who is asked to consent on that child's behalf.
• For a minor, only a live linked guardian may grant. For an adult athlete, only the athlete. Either the athlete or any one linked guardian may withdraw, at any age.
• A missing or unreadable date of birth fails closed — the grant is refused. A withdrawal is never blocked.
• Consent is checked against the database on every request and never cached in a token, so a withdrawal takes effect immediately.
• Approval links are single-use, stored hashed, and expire after seven days. Never forward one.
• At 18, guardian visibility ends; processing that rests on inherited consent continues for a 30-day grace period and then pauses: the routes that need that consent accept nothing new, and refuse staff, until the athlete gives their own consent. Data that no consent gates is unchanged. The adult athlete stays listed to their guardian with no ability to open anything.

12. Deletion: describe it accurately

Pass any deletion request to your club's data protection route, and describe what will happen using the retention schedule rather than your own summary. Two things in particular:

• Some records are retained and a deletion request for them is refused. Injury reports are kept until the athlete's 21st birthday; safeguarding, consent and audit records until their 25th. Those reasons are published in advance, so you can explain them without disclosing anything about the individual.
• Never confirm or deny the existence of a safeguarding record in the course of answering a deletion request. The published schedule is the answer; the individual's record is not.

13. Things you must not tell athletes or parents

If a screen inside the product says otherwise, this notice is the accurate statement and the screen is being corrected. Report it to your club administrator so that it reaches us.

14. Looking after your account

• Your sign-in uses cookies that page scripts cannot read. Reloading resumes your session and tells you whose it is, with one tap to leave. Use it on a shared machine.
• Never share your login. Access is granted to a person in a role, and the audit log names that person. A shared account makes the log a record of nobody.
• Your club's data cannot be reached from another club's session — row-level security is forced on all 43 tables — but that boundary is only as good as who holds your password.
• Identity and athlete data live in separate schemas under separate database roles that cannot read each other, and no query joins them. Do not build your own workaround that recombines them in a spreadsheet.
• Exporting children's data out of Recov into your own documents takes it outside every control described in this notice. If you must, follow your club's rules for handling children's records.

15. How to complain

Raise it with your club or with us first. If you are not satisfied you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or on 0303 123 1113. Complaining to the ICO is free and needs nobody's permission. You may also bring a claim in court.

16. Contact

Your club — the administrator or welfare officer who set Recov up is the right first contact for roles, access and anything about a child.

Recov — how to send us a request is set out on the rights page.

What changed in version 1.2 (10 October 2026). Section 8 now says what an administrator who is also a coach sees. Section 11 now names wearable sync as a consent category and describes what it reads. The rest of this notice was last fully reviewed on 10 September 2026.

Version 1.2 · Effective 10 October 2026 · Last reviewed 10 September 2026 · Audience: coaches, welfare officers, deputies and club administrators