How long we keep data

What we keep, for how long, and the records where we will refuse an erasure request — published in advance, with the reasons, so that you know the answer before you ask rather than after.

1. The schedule

Retention is organised by what competes with the right to erasure. Where nothing competes, we delete. Where a young person's protection or a legal obligation competes, we keep the record, we say so here, and we give the reason.

2. A young person's own words

A journal entry, a photograph of a plate of food, a sentence a fourteen-year-old typed about what they ate: these exist for the young person and for nobody else. No club has an interest in them. No insurer will ever ask for them. No safeguarding purpose needs them once the young person has asked for them to go.

So there is nothing to weigh and nothing to approve. When an athlete or their guardian asks for this material to be deleted, it goes — and no adult at the club is asked to authorise it.

Meal photograph files are deleted seven days after they are taken, whether or not anyone asks. The verdict derived from a photograph — "spot on", and the estimated grams — is part of the training record and follows that row of the schedule.

3. The training record

Results, effort scores, sleep and resting heart rate, soreness entries and the injury-risk flags derived from them are performance monitoring. They are useful while a young person is training at the club and they stop being useful when that ends.

Keeping a teenager's day-to-day soreness history for a decade because it is technically health data would be exactly the over-retention that the storage limitation principle exists to prevent. So this category is deleted on request, and deleted automatically 30 days after an athlete leaves the club, without anyone having to ask.

Soreness entries and derived risk flags belong here rather than with injury reports. They are routine training monitoring. An injury report is a different kind of record.

4. Accident and injury reports

An injury report is an accident log, not a performance statistic. If a young person is hurt at a club, a claim can arrive years afterwards — the limitation clock on a personal-injury claim does not start until they turn 18. A club that deleted its accident records on request would be unable to answer such a claim, and neither could we.

So injury reports are retained until the athlete's 21st birthday, in a form that no longer names them, and an erasure request for them is refused under Article 17(3)(e). Where a club's insurer or national governing body requires a longer period, that schedule applies instead.

5. Safeguarding, consent and audit records

If a concern has been raised about a young person, the record that it was raised must survive an erasure request — including, and especially, an erasure request from the person the concern is about. A safeguarding record that an adult can destroy is worse than no record at all, because it reads as protection while functioning as a delete button for evidence.

That is why this processing does not rest on consent. If it did, a withdrawal would collapse it, and Recov would be a system in which the person a concern is about can switch the concern off.

Two things make this much narrower than it sounds:

• The case itself is not in Recov. Investigation is deliberately off-platform. The welfare officer's substantive notes live in the club's own safeguarding system. Recov holds only the record that a signal was raised, delivered and acknowledged.
• No athlete data is attached to it. This category is timestamps and the fact of a referral. Narrow records are far easier to justify keeping and far less damaging to hold.

It is retained for the young person, not for us. The consent ledger and the audit log are held on the same schedule, because their whole purpose is to show, years later, what was agreed and who did what.

6. Financial records

Tax law requires a business to keep its financial records for six years, and an erasure request does not override a statute. Only athletes consume a paid seat; coaches, guardians, welfare officers and deputies are free, and Recov holds no payment details about them.

7. How an erasure request works

Make the request to your club or to Recov — see Your rights, and how to use them. We respond within one month.

An erasure removes the account and identity records, and the athlete records in the categories the schedule marks as deleted. The categories the schedule marks as refused are retained for the period stated, and we tell you which categories those are.

8. Why our records are append-only

Recov's consent ledger, audit log, results, welfare records and plan versions are append-only. A correction is made by adding a superseding record; the earlier version stays alongside it. Database triggers enforce this, so it holds even against a database administrator.

This is a deliberate property, not a limitation. A consent history that could be edited would prove nothing, and an audit log that could be tidied is not an audit log. The cost is that "correcting" a record means recording the correct value rather than making the old one vanish. Deletion under this schedule removes the whole record, including its superseded versions.

9. What your club keeps, separately from us

Your club's own retention schedule governs your club's own records, and deleting an athlete in Recov does not touch them. Sector guidance requiring child protection records to be kept until 25 or longer lands mostly on the club, because the club holds the case file. Recov holds a delivery log.

Version 1.1 · Effective 10 September 2026 · Last reviewed 10 September 2026 · Audience: everyone