Privacy notice for parents and guardians
What Recov collects about your child, why we are allowed to, who can see it, where it is processed, and what you and your child can ask us to do. It also sets out, deliberately, the things Recov does not do.
Three things to know before anything else
- Recov is not a monitoring service. It does not read your child's journal, detect distress, or alert an adult on your behalf. Your club's own safeguarding process is the safeguarding that protects your child.
- A coach receives nothing from your child's journal, and neither do you. The journal is written for the child alone, and Recov is built so that no adult can read it.
- Withdrawing consent stops future collection; it does not delete what is already held. Deletion is a separate request, and section 12 explains how to make one.
Contents
- Who we are, and who is responsible for your child's data
- What we collect and why, purpose by purpose
- Health information, and the extra condition we rely on
- What we do not collect
- How it is protected, and what is encrypted
- Who inside the club can see what
- Companies we send data to
- Where data is processed
- Consent: what it controls
- Safeguarding: what Recov does and does not do
- How long we keep things
- Your rights, and your child's
- What changes when your child turns 18
- How to complain
- Contact
1. Who we are, and who is responsible for your child's data
Recov is software for junior sport clubs. It records training, wellbeing and welfare information about young athletes so that coaches can plan sensibly and clubs can look after the children in their care.
Your child's club decided to use Recov, invited your child, and decides who at the club holds which role. Recov builds and runs the software and holds the data on the club's behalf.
Your child's club is the controller of your child's data, and Recov is its processor. For the limited data we need in order to operate and secure the service itself — account records, security and audit logs, and records of the emails we send — Recov is a controller in its own right.
In practice this means you can make any request to either of us. Send it to your club, or to Recov, and it will reach the right place.
2. What we collect and why, purpose by purpose
Each purpose below sets out what is collected, why, and the lawful basis — the legal reason we are permitted to process it.
2.1 Setting up and running the account
What: your child's name, email address and a one-way hashed version of their password; their date of birth, which is encrypted; the link between you and your child; your email address, which comes from the club and is never typed in by the child; which club and squad they belong to and what role they hold; and basic information about the devices used to sign in — a device name, the browser or app identifier, and a hashed sign-in token.
Why: so people can sign in, so we know who may see what, and so your child's age determines the protections that apply to them.
Lawful basis: performance of the agreement between the club and your family (UK GDPR Article 6(1)(b)), and the club's legitimate interests in running its athlete programme (Article 6(1)(f)).
We do not store IP addresses anywhere.
2.2 Training and performance records
What: ergometer and training results, effort ratings (RPE), and sessions your child logs themselves. The free-text comment on a self-logged session is encrypted.
Why: so coaches can see how training is going and plan the next block.
Lawful basis: the club's legitimate interests in coaching its athletes safely and effectively (Article 6(1)(f)).
2.3 The wellbeing journal
What: free text your child writes, which is encrypted, and tap-to-answer prompts — short preset answers, which are not encrypted. The preset vocabulary includes health-revealing options such as painful, worse on a deep breath, worse when coughing, sore on stairs, and a mood of rough.
Why: so your child has somewhere private to record how they are, and so patterns in the preset answers can inform coaching.
Lawful basis: legitimate interests (Article 6(1)(f)), together with the safeguarding condition in section 3.
The journal is designed to be unreadable by adults, and it is. No screen in Recov shows journal text to a coach, a guardian, a welfare officer or a club administrator, and the text itself is encrypted at rest. There is no summary of it, and nothing derived from it reaches you or a coach. Where any screen inside the product describes this differently, this notice is correct and the screen is being corrected.
2.4 Soreness and pain
What: body area, left or right side, a severity from 1 to 5, and what makes it worse. Recorded by tapping, with no free text, and stored unencrypted.
Why: so a coach can adjust training before a niggle becomes an injury.
Lawful basis: legitimate interests (Article 6(1)(f)), together with the safeguarding condition in section 3.
2.5 Injury reports and injury-risk flags
What: body area, side, when it started and who raised it, stored unencrypted; the free-text description is encrypted. Recov also derives injury-risk flags from data it already holds.
Why: so injuries are recorded and training is adjusted around them.
Lawful basis: legitimate interests (Article 6(1)(f)), together with the safeguarding condition in section 3.
2.6 Recovery markers
What: resting heart rate, heart-rate variability (HRV), hours of sleep and VO2 max. Your child types these in or, if wearable sync is on, some of them are read from the health app on their phone or tablet (section 2.6a). Stored unencrypted.
Why: to give context to how training is landing.
Lawful basis for numbers typed in by hand: legitimate interests (Article 6(1)(f)), together with the safeguarding condition in section 3.
2.6a Wearable sync: numbers read from your child's phone
What: if wearable sync is on, the Recov phone app reads a few numbers from the health app on the phone or tablet where it is switched on — Apple Health on an iPhone or iPad, Health Connect on Android — so your child does not have to type them in. In the rest of this section, "the phone" includes a tablet. On an iPhone or iPad it reads resting heart rate, sleep duration and VO2 max. On Android it reads the same three and, if your child allows it on the phone, heart-rate variability (HRV) as well. Nothing else is read: not location history, not body composition and not menstrual data.
When: each time the app is opened or comes back on screen, and in the background no more often than about once every 12 hours, when the phone allows it. Each time, it looks at the last 31 days, so the first sync can bring in up to a month of numbers that were already on the phone.
Three things must all be on before anything is read: your consent, or another linked guardian's, to the Wearable sync permission (an athlete aged 18 or over can give it themselves); your child's own Sync this phone switch in the app; and the phone's own permission for Recov to read its health app.
Where it goes: the numbers are read on the phone and sent only to Recov's own servers. Recov keeps no device, watch or brand name with them, and never writes anything into the health app.
Who sees them: the same people as numbers typed by hand — your child and their coach. Not you, not the welfare officer and not a club administrator, unless they also coach one of your child's squads (section 6). No AI feature is sent them.
If a number is wrong: if this morning's resting heart rate, sleep or HRV is wrong, your child can type the right one in. Their correction stays for that number, and the phone keeps updating the others. If your child typed a number before the phone had sent one, the phone's number is used instead. For any other wrong number, including VO2 max or a number for an earlier morning, ask us to correct it (section 12).
Shared phones and tablets: sync reads the health app on the phone or tablet where it is switched on, whoever's numbers are in it. A family iPad's Health app can also hold numbers synced from someone's iPhone or Apple Watch. Only switch it on on your child's own phone.
Lawful basis: your explicit consent (Article 6(1)(a) and Article 9(2)(a)), given through the Wearable sync permission. Another linked guardian can give it instead of you, and your child can give it themselves once they are 18 — see sections 3 and 9.
Turning it off: withdraw the permission, and nothing new is read. Your child can also stop it on the phone. On Android, they switch off Sync this phone. On an iPhone or iPad, the app cannot switch it off; they turn off Recov's access in the phone's health app settings, and the health app then gives Recov no new numbers. None of this deletes numbers already sent: they stay in your child's record, and their coach can still see them. They are part of your child's record, so if that whole record is erased they go with it, but they cannot be deleted on their own.
2.7 Food photographs and fuelling
What: photographs of meals — a child's hand is often in frame as a size reference; your child's own typed description of the food, up to 2,000 characters, stored unencrypted; and a derived verdict on whether they ate enough, with a confidence level and estimated carbohydrate, protein and fat in grams. Recov also stores a hand calibration derived from a photograph of your child's hand.
Why: to help young athletes eat enough for the training they are doing.
Lawful basis: your explicit consent (Article 6(1)(a) and Article 9(2)(a)). This is one of the categories Recov gates on a recorded consent — see section 9.
Your child's own words about food are for your child. A coach and a guardian see the verdict and the estimated grams. Neither sees the photograph, and neither sees what your child typed. Location data (EXIF and GPS) is stripped from every photograph when it reaches our servers, before it is stored or sent anywhere else. The original is not kept. The photographs are sent to Anthropic for analysis — see section 7 — and the image files themselves are held on Recov's application servers rather than in the encrypted database columns.
2.8 Body measurements
What: body mass, height and sex. All three are encrypted.
Why: to make fuelling and training guidance appropriate to the individual.
Lawful basis: your explicit consent (Article 6(1)(a) and Article 9(2)(a)).
A child under 18 is not shown their own derived calorie figure — only the method behind it. If a date of birth cannot be read, that protection applies anyway.
2.9 Coach planning, including AI-generated plans
What: sessions, events, training patterns, blocks, coach comments, and the briefs coaches write to have a plan drafted. Stored unencrypted.
Why: to plan squad training.
Lawful basis: the club's legitimate interests (Article 6(1)(f)).
What reaches the AI provider. When a coach asks Recov to draft a plan, we send squad specialty, age band, goals, a description, the coach's brief, event names and dates, the training pattern, any previous plan, and coach comments to Anthropic. No identifiers are included. That is structural rather than a filter: the data sent has no field capable of carrying a name or an account identifier, and an automated test fails our build if that ever changes.
A coach's own words are sent exactly as typed. If a coach writes a child's name into a brief, that sentence is transmitted. Coaches are instructed in their own privacy notice never to write a child's name, initials or identifying detail into a brief or a comment, and this is a written obligation on every member of club staff.
Coaches can also import a plan by photographing a whiteboard. Those photographs go to Anthropic too, and are not identity-stripped, because redacting a photograph would destroy the plan being imported. Staff are required not to photograph a board that names individual children.
2.10 Consent records
What: which consent category, what happened, who did it, and when. Stored unencrypted and append-only: a withdrawal is added as a new record and never overwrites the earlier one, so the full history is preserved.
Why: so we can demonstrate what was agreed and when.
Lawful basis: compliance with a legal obligation (Article 6(1)(c)) — we are required to be able to demonstrate consent.
2.11 Security, audit and email
What: an append-only audit log of significant actions, and a log of notifications sent. Emails are delivered by Resend and contain the recipient's email address, a single-use sign-in or consent link, the club name and the club's identifier.
Why: to keep the service secure, to investigate problems, and to send sign-in and consent emails.
Lawful basis: legal obligation (Article 6(1)(c)) and our legitimate interests in the security of a system holding children's data (Article 6(1)(f)).
Email bodies are rebuilt from fixed templates and byte-compared before sending, so an email is structurally incapable of carrying a child's name.
2.12 Safeguarding records
What: the tier and state of a welfare record, counts, which signals converged, and a pattern description which is encrypted.
Why: to route a welfare concern to the club's welfare officer and to record that it was raised, delivered and acknowledged.
Lawful basis: legitimate interests (Article 6(1)(f)), together with the safeguarding condition in section 3. This processing is deliberately not based on consent, so withdrawing a consent cannot switch it off.
3. Health information, and the extra condition we rely on
Some of what Recov holds is special category data under UK data protection law — information about health, which carries additional legal protection. In Recov this covers soreness and pain entries; injury reports and derived injury-risk flags; resting heart rate, heart-rate variability, sleep hours and VO2 max; body mass, height and sex; meal photographs and the derived eating-adequacy verdict; wellbeing and mood answers; and welfare records.
Holding health data requires a second condition on top of the lawful basis. These are the conditions we rely on:
| Health data | Condition relied on |
|---|---|
| Meal photographs, meal descriptions, fuelling verdicts, body measurements | Explicit consent — UK GDPR Article 9(2)(a). These, with wearable sync below, are the categories Recov gates on a recorded consent. |
| Recovery markers read from the phone by wearable sync | Explicit consent — UK GDPR Article 9(2)(a), given through the Wearable sync permission. |
| Wellbeing answers, soreness, injury reports, injury-risk flags, hand-entered recovery markers, welfare records | Substantial public interest: safeguarding of children and of individuals at risk — Article 9(2)(g) with paragraph 18 of Schedule 1 to the Data Protection Act 2018. |
These categories are not offered on a consent basis, and that is deliberate. Processing that exists to notice a child being hurt should not be switchable off by the adults around them, and a club cannot run a squad safely while being unable to record that an athlete is injured. Access to them is restricted by role instead, as section 6 sets out.
4. What we do not collect
- No menstrual cycle data. There is nowhere in Recov to store it.
- No link to any watch, fitness tracker or fitness account — no Garmin, Strava, Concept2, Whoop, Fitbit, Oura or Polar account is linked to Recov. If wearable sync is on, Recov reads the health app on the phone or tablet, which may hold numbers a watch put there (section 2.6a).
- No analytics, no tracking, no error reporting, no advertising identifiers and no push notifications from our servers. The app shows two daily reminders (morning check-in and evening logging), scheduled on your child's phone. They are on unless your child switches them off in the app's settings, and nothing about them is sent to us.
- No location data, no contacts, no browsing history.
- No IP addresses.
- Fonts inside the app are served by us, so opening it does not call out to a font provider.
5. How it is protected, and what is encrypted
Recov separates your child's identity from your child's data. Names, email addresses and dates of birth live in one database area; training, wellbeing and health records live in a separate area under a different database account that cannot read the first, keyed only by a meaningless identifier. No query joins the two. Row-level security is forced on all 43 tables, so one club's data cannot be reached from another club's session.
Where we encrypt, we encrypt properly: a fresh key for every individual value, wrapped by a managed key service, bound to the specific row so a copied value cannot be moved elsewhere, failing closed if anything is wrong, and padded so the length of the stored value does not reveal how much your child wrote.
| Encrypted | Stored unencrypted |
|---|---|
|
Date of birth Journal free text Injury report description Self-logged session comment Body mass, height and sex Welfare record pattern text |
Wellbeing preset answers Soreness entries Recovery markers (resting HR, HRV, sleep, VO2 max), typed or synced Fuelling verdicts, including your child's typed food description Injury report body area, side and onset date Meal photograph files Names, email addresses, club and squad structure, coach plans |
Passwords are never stored, only a one-way hash of them. Sign-in uses cookies that page scripts cannot read — see the cookie notice.
6. Who inside the club can see what
Access rules live in one place in the software and are enforced by the system itself, rather than by each screen remembering to check. A test fails our build if any part of the app handles athlete data without declaring which category it is.
| Category | Your child | Coach | You (guardian) | Welfare officer | Club admin |
|---|---|---|---|---|---|
| Training results and % of gold-medal time | Yes | Yes | Yes | No | No |
| Recovery markers | Yes | Yes | No | No | No |
| Soreness log | Yes | Yes | No | No | No |
| Fuelling verdict and grams | Yes | Yes | Yes | No | No |
| What the child typed they ate | Yes | No | No | No | No |
| Meal photographs | Yes | No | No | No | No |
| Journal | Yes | No | No | No | No |
| Injury reports | Yes | Yes | Yes | No | No |
| Welfare records | No | A softened prompt only | Not automatically | Yes | No |
| First-tier welfare notice | Yes | No | No | No | No |
| Body measurements | Yes* | No | Yes | No | No |
* A child under 18 sees the method behind their calorie figure, not the figure itself.
Three guarantees are worth stating plainly:
- One athlete can never see another athlete's data. This is checked once, structurally, before any other rule is considered.
- A guardian's access is always a subset of the coach's. There is no row a guardian can see that the coach cannot.
- Being a club administrator opens no athlete data at all. Administering the club is not a reason to open a child's record, and the software does not permit it. An administrator who is also one of your child's coaches sees what a coach sees, and nothing more.
Being permitted by the table is only the first step. Every request also independently proves the actual relationship — that this coach really coaches this squad, that this guardian is really linked to this child.
7. Companies we send data to
Four companies receive data from Recov. What reaches each of them is set out in full in the sub-processor list; this is the summary.
| Company | What we send | What you should know |
|---|---|---|
| Anthropic (AI plan generation, photographs and meal descriptions) |
Squad specialty, age band, goals, description, the coach's brief text, event names and dates, training pattern, any prior plan, coach comments. Also meal photographs, often with your child's hand in frame; your child's typed meal description; a photograph of your child's hand for calibration; photographs of coach whiteboards imported as plans. | No identifiers are sent when a plan is generated — the data has no field for one, and a test enforces it. A coach's free text is sent as typed. Location data is stripped from images first. Whiteboard photographs are not identity-stripped, and staff are required not to photograph a board naming children. |
| Resend (email delivery) |
Email address, a single-use sign-in or consent link, club name, club identifier. | Email bodies are rebuilt from fixed templates and byte-compared before sending, so they cannot carry a child's name. |
| Amazon Web Services (key management) |
Only a 32-byte encryption key, for wrapping and unwrapping. | No content of any kind reaches AWS — not plaintext, not ciphertext. |
| Railway (hosting) |
The application, its filesystem and the database. | This is where the data physically lives, including the meal photograph files. |
Apple and Google are not on this list. Wearable sync reads Apple Health or Health Connect on the phone or tablet itself. It sends none of the numbers it reads to Apple or Google: Recov gets them from the app on that device, not from Apple's or Google's servers. The health app is run by Apple or Google under their own terms, not ours.
We do not sell data, and we do not share it for advertising. There are no advertising or analytics companies in that list because there are none in the product.
8. Where data is processed
Recov's application and database are hosted by Railway. Encryption keys are managed by Amazon Web Services. Email is delivered by Resend. The AI features use Anthropic.
Several of these providers operate globally, and your child's data may therefore be processed outside the United Kingdom. Where it is, we rely on the transfer safeguards in that provider's data processing terms — the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, or UK adequacy regulations where they apply.
You can ask us for the current processing locations and the safeguard relied on for any individual provider, and we will tell you.
9. Consent: what it controls
How consent works in Recov
- Which consent categories can be turned on depends on your child's squad: core, wearable sync and body measurements always; meal photos only when one of your child's squads is on development or performance; wellbeing logging not yet. Meal photographs and fuelling, body measurements and wearable sync are the categories on which processing genuinely depends: withdraw any one and Recov refuses the next request in that area. For wearable sync, that means the phone reads nothing more and Recov accepts no new numbers from it. A core category records your acknowledgement of this notice and the club's use of Recov; it changes what the app displays and does not itself gate any processing.
- Every setting starts off. Only an explicit yes creates a record. Silence is never treated as agreement.
- Your email address comes from the club, and is never typed in by your child.
- For a child, only a live linked guardian can give consent. Where there is more than one guardian, any one of you may give it.
- Either the child or any one linked guardian may withdraw, at any age. A child can always withdraw a consent they were not permitted to give.
- If a date of birth is missing or cannot be read, a grant is refused — but a withdrawal is never blocked.
- Consent is checked against the database on every request. It is never cached in a sign-in token, so a withdrawal takes effect immediately.
- Consent and sign-in links are single-use, stored hashed, and expire after seven days.
- The consent record is append-only: a withdrawal is a new entry, never an edit. The full history of your decisions is preserved, which is also what allows us to demonstrate what was agreed and when.
What withdrawing consent does, and does not do
- It stops future processing in that category — from the next request onwards, in the areas listed above. For wearable sync, it stops new numbers being read; numbers already sent stay in your child's record, and their coach can still see them (section 2.6a).
- It does not delete anything already recorded. If you want data removed, make an erasure request; section 12 explains how.
- It does not stop the categories that are not consent-based. The journal, soreness log, injury reports and hand-entered recovery markers are processed under legitimate interests and the safeguarding condition, and limited by role rather than by a consent setting. Section 3 explains why, and section 12 sets out your right to object.
10. Safeguarding: what Recov does and does not do
Recov is a record, not a watchdog. It does not monitor your child, does not analyse their journal, and does not notify anybody automatically. If you are worried about your child, contact your club's welfare officer directly through the club's own route. Do not rely on Recov to raise it, and do not treat a quiet app as evidence that nothing is wrong.
What Recov does provide is a disciplined place for a club to record and route a concern, built so that it cannot be misused:
- Welfare officer and deputy are proper roles, assigned by a club administrator, with every change recorded in the audit log.
- A database rule makes it impossible for an officer-level record to exist without the child having been told first.
- A child-level notice cannot be dismissed by any adult.
- A record cannot rest on a single signal — the database itself proves that at least two distinct signals converged before it will accept one.
- The welfare officer's queue has no way to ask about a specific child. "No browsing children's data" is built into the shape of the system rather than left to a rule.
- The description of a concern is encrypted with a key bound to that club and that child.
Investigation is deliberately off-platform and will stay that way. Your club's own safeguarding records hold the case. Recov holds only the fact that a signal was raised, delivered and acknowledged — never the case itself.
11. How long we keep things
Retention periods are set out in full in the retention schedule, so that there is only one version of them to keep correct. In summary: your child's own words and their training record are kept while they are an athlete at the club and deleted shortly after they leave; injury reports are kept until their 21st birthday; safeguarding, consent and audit records are kept until their 25th birthday.
Recov's core records are append-only by design. A correction is made by adding a superseding record rather than by overwriting the original, so that a consent history or an audit trail cannot be quietly rewritten. Deletion under the retention schedule removes the whole record, including its superseded versions.
12. Your rights, and your child's
You and your child have the right to see the data we hold, to have it corrected, to have it erased, to restrict or object to its use, to receive a copy in a portable form, and to withdraw consent. How to exercise each one is set out in Your rights, and how to use them.
A child's rights are their own. Where your child is capable of understanding what they are asking, we act on their wishes about their own data, and the principle throughout Recov is that the child is told first.
We respond to any request within one month. Erasure removes your child's identity records and the athlete records in the categories set out in the retention schedule. Records we will not erase — injury reports, and safeguarding, consent and audit records — are listed there in advance, with the reasons, so that you know before you ask rather than after.
13. What changes when your child turns 18
- Your visibility ends on their eighteenth birthday. Your adult child still appears in your list, but you can no longer open anything.
- Processing that rests on the consent you gave continues for a 30-day grace period and then pauses, so that your child has a window in which to give consent in their own name. A pause accepts nothing new for those permissions and deletes nothing; your child can still see what is already saved and can switch the permissions back on themselves. We ask your child in the app, not you. We do not send you a notification when a pause starts or when your child switches a permission back on, but while you still have access you may notice that some of the data you could see is no longer available to you.
- From 18, only the athlete can grant consent.
- If you are the last guardian of a child under 18, you cannot unlink yourself; the system refuses. A guardian cannot be erased while they still guard a live child athlete.
14. How to complain
Please tell us or the club first, because most things are quicker to fix that way. If you are not satisfied, you can complain to the UK regulator, the Information Commissioner's Office, at ico.org.uk/make-a-complaint or on 0303 123 1113. Complaining to the ICO is free and needs nobody's permission.
You can also bring a claim in court. Nothing in this notice limits that.
15. Contact
Your child's club — the welfare officer or club administrator who invited your child is the fastest route for anything about who sees what, or about your child's welfare.
Recov — how to send us a request, and what to put in it, is set out on the rights page.
What changed in version 1.2 (10 October 2026). Added wearable sync (sections 2.6, 2.6a, 3, 4, 5, 7 and 9). Section 6 now says what an administrator who is also a coach sees. The rest of this notice was last fully reviewed on 10 September 2026.
Version 1.2 · Effective 10 October 2026 · Last reviewed 10 September 2026 · Audience: parents and guardians