What is enforced

Safeguarding by construction.

Recov holds health and wellbeing data about children. Every claim on this page describes what the running system does — including the places where it does less than it should. Where a control is not switched on, this page says so.

1. The need-to-know matrix

One set of rules decides every combination of role and data category. It is applied to every request and covered by tests, so there is no second copy of these rules to drift out of step with the first.

Category	Athlete (own)	Coach	Guardian	Welfare officer	Club admin
Training results, progress vs GMT	Yes	Yes	Yes	No	No
Recovery markers	Yes	Yes	No	No	No
Soreness log	Yes	Yes	No	No	No
Fuelling verdict and grams	Yes	Yes	Yes	No	No
What the child said they ate	Yes	No	No	No	No
Meal photographs	Yes	No	No	No	No
Journal	Yes	Derived only †	Derived only †	No	No
Injury reports	Yes	Yes	Yes	No	No
Welfare alerts	No	Softened prompt only ‡	Not automatic ‡	Yes	No
Low-tier wellbeing notice	Yes	No	No	No	No
Body measurements	Yes*	No	Yes	No	No

* A child under 18 is not shown a derived calorie figure about themselves — the method, not the number. Where a date of birth is missing or cannot be read, the stricter case is assumed.

† The matrix permits a coach and a guardian to see something derived from the journal — never the text. Nothing derives anything from it today, so a coach and a guardian receive nothing at all from a journal.

‡ Alert handling is not switched on. See section 4.

Three things sit underneath the table and matter more than any single row:

An athlete can never read another athlete's data.
Being allowed by the matrix is only step one. Every request then has to prove the concrete relationship: this coach coaches this squad; this guardian is linked to this child. A role by itself grants nothing.
A coach is granted access on the training and wellbeing record; a guardian is not. The exception runs the other way for body measurements, which reach the parent and not the coach.

2. Identity and training data are held apart

Who someone is and what they recorded are held apart, and one club cannot reach another club's data. That separation is enforced in the database rather than the app, and covered by tests.

One qualification: for entries a child records about themselves — soreness, recovery markers, meal photos, self-logged sessions — the training side also records who wrote them, so those entries do carry the child's identifier. That has consequences for deletion, and we would rather say it here than have you discover it.

3. Sensitive values are encrypted

Sensitive values are encrypted individually, with the keys held by a separate key manager. Which values are encrypted and which are not is listed in the privacy notice for parents and guardians.

Two things in that list deserve saying here. A child's typed description of a meal is not encrypted, and although it is never shown to a coach or a parent, the screen that withholds it does not reveal whether anything was typed. Meal photograph files are held on the server's disk, not encrypted, and are lost on a redeploy while the catalogue entry survives.

4. Athlete-told-first, and what is not running

Welfare escalation is designed athlete-told-first — the child is told before an adult is — and it is not switched on. Nothing currently produces an alert. Recov monitors nothing today.

There is no way to raise a concern inside Recov. There is no concern form for a coach or a parent. Concerns go through the club's own safeguarding route. Anyone telling a family otherwise is describing a product that does not exist.

5. Investigation happens off Recov

This is a deliberate boundary, not a missing feature. A club's safeguarding case belongs in the club's own records, under its own policy and its governing body's, handled by people with training and a duty. Recov is designed to hold the narrow part: that a signal was raised, that it was delivered, and that it was acknowledged.

Put a case file in a training app and two bad things follow. The record of a child's worst week ends up in the same system as their ergo scores, and the people who should be leading a response start treating a piece of software as though it were leading one.

6. Nothing is quietly edited

Nothing in Recov is quietly edited: a correction adds to the record rather than replacing it, so the history of what was agreed, and when, is preserved. What that means for deletion is set out in how long we keep data.

7. Who else handles the data

Who	What reaches them
Anthropic	Coach programme drafting: squad specialty, age band, goals, description, the coach's brief and comments, event names and dates, training pattern, prior plan. No identifiers. But the coach's free text is sent exactly as typed. Also meal photographs and the child's typed description, hand-calibration photographs, and imported photographs of coach whiteboards. Location and camera metadata is stripped from images first. Whiteboard imports are not identity-stripped.
Resend	Email delivery: the address, a single-use sign-in or consent link, the club name. A child's name cannot be in a message body.
AWS KMS	An encryption key to wrap or unwrap. No row content, in any form, ever reaches it.
Railway	Hosting for the application, its filesystem and its database.

Apple and Google are not on this list. Wearable sync reads Apple Health or Health Connect on the phone or tablet itself and sends the numbers only to Recov. None of those numbers is sent to Apple or Google.

We do not claim UK or EU data residency. It is not pinned down in our configuration or our suppliers' terms yet, and until it is, saying otherwise would be a guess presented as a guarantee. The sub-processor document has the detail.

The full design write-up

The full design write-up — including what is and is not encrypted, and how each control on this page is enforced — is available to a club on request. Write to [email protected].

Read further

All policies · Privacy notice for parents and guardians · If you are under 18 · How long we keep data · Your rights

Every statement on this page was checked against the code that runs, on 10 September 2026, and the note on Apple and Google under section 7 on 8 October 2026. Where the code and our intentions differ, this page describes the code. Last reviewed 10 September 2026.