OneClub OS Children’s Privacy Notice

What changed

• Stage review draft: describes authorized 21-day clip links while retaining child-account and guardian safeguards.

1. Before a child uses an account

For children under 13, the parent or legal guardian operates their own account with a separate child profile. The parent overview uses the player dashboard’s presentation with parent-specific wording. It currently shows authorized teams, upcoming team events and completed shared development plans; it does not yet provide every player-portal feature. The child must not use the parent’s credentials. A parent confirmation records the statement but does not establish identity, parental authority or required permission.

Direct accounts for children under 13 remain unavailable even after a guardian form is received. A future direct-child pathway requires a legally sufficient method of verified parental consent, complete delivered parent notice including a verified public operator telephone number, age-appropriate account controls and a separately approved launch. The public operator telephone is N/A for the current version. Contact legal@oneclubos.com or support@oneclubos.com. The current version does not complete a telephone requirement in an applicable child notice and does not complete that future launch.

Players aged 13 to 17 may accept Terms for basic access and optional non-health AI coaching where the AI acknowledgement, current club membership, age and safeguarding controls allow it. This acceptance is not parental or health consent. AI use of wellness or health information requires the underlying health permission, a separate AI-health choice and applicable guardian authority. Media, messaging and external delivery retain their own permissions. Minor staff may accept for basic authorized access but cannot perform adult-only guardian, privacy-review or health-workspace duties. Player setup uses the club-recorded birthdate, or asks for a missing birthdate before routing; a supplied date is not independent verification and cannot override conflicting authoritative evidence. A minor’s acceptance or age correction cannot override guardian withdrawal, an unresolved restriction or inactive membership.

For a use requiring guardian authority, the reviewer must establish the adult’s identity and relationship to the particular child with evidence appropriate to the approved verification method. The record includes the method, evidence reference, child and club, permissions, notice version and delivery evidence, expiry, and an independent reviewer who is not the submitting guardian. A failed notice delivery or insufficient evidence leaves that use pending. Possession of an email address, a staff attestation or two reviewers alone does not establish parental identity or legal authority. Do not send identity documents in ordinary email.

An adult parent or legal guardian may sign in under their own identity and confirm their own account use to enter a limited workspace. This current-package confirmation is remembered; it does not verify the relationship or grant access to child records. Access by that adult to a child’s records requires the relevant verified relationship and current purpose permission. A portal claim is not required for staff-managed child records supported by an approved assessment of valid existing guardian permission. Guardians may also contact us or their club to review or withdraw permission. They must never use or share the child’s credentials. Transfer to another club requires its own assessment of applicable authority; it does not automatically transfer the old club’s evidence. On turning 18, the user accepts for themselves.

You may request correction of your own inaccurate birthdate. Routine corrections may pass an automated review without a club administrator when the change does not override conflicting authoritative evidence or make a current or future access restriction less protective. We preserve the original information, its source and the correction decision. An accepted routine correction updates your own recorded birthdate and any player record already securely linked to your account, with a correction receipt. It cannot move an eligibility date earlier, extend a permission, override conflicting club age information or establish guardian authority. Conflicts and changes that would increase access need appropriate additional review or verification.

The planned handover will be available only after its account and permission controls have been implemented and verified. When the server establishes that the player has reached 13 and meets the current account requirements, a popup will offer the verified parent a handover to the player’s own email and account. The player must verify their own email and accept the current terms before the new player access is activated. The parent’s identity and personal account, the player’s history and original evidence remain intact. Handover grants no optional permissions. Valid guardian-controlled permissions remain subject to their original scope, expiry and withdrawal. A pending, expired or canceled handover does not change existing account control.

2. Information collected and how it is used

• Account and roster: name, login email, recorded or supplied player birthdate for player account routing, team, profile details, guardians and access permissions. A basic roster record outside that routing may omit the birthdate. These support club membership, age checks, schedules and access to the player’s records. A basic roster record does not itself authorize sign-in, health processing, messaging or access by a parent.
• Development and participation: training and match information, goals, evaluations, self-reviews, attendance and performance information entered by the club or player.
• Optional health information: wellness responses, availability, injuries, restrictions, load and fitness information. This requires separate permission and is used to support training and player care, not medical diagnosis.
• Optional media: profile photos, match or training video, clips and player tags. Media can identify a child even when their name is omitted.
• Optional communication: messages, replies and related service notifications. Authorized club administrators can audit club messages for safety. Parents can request review through their club or us.
• Security and consent: access and activity records, acceptance versions and timestamps, signed forms and review evidence. Technical providers may receive network identifiers needed to deliver and secure the service.

We do not require optional health information, media or external sharing as a condition of basic player-account access. Clubs must collect only information needed for the selected features. Free-text and uploaded content must not contain unnecessary sensitive information.

3. Who receives information

Authorized club staff receive information according to their roles and teams. Players have limited access to their own records and permitted team functions. Service providers host, authenticate, store, deliver and protect information on our behalf; the current provider list is in Section 3 of the Privacy Notice. These necessary service functions are explained in the parental notice. Optional delivery of identifiable clips outside the platform requires its own permission.

We do not sell children’s information, use it for targeted advertising or authorize model training on it. AI chat for players under 13 is paused. For eligible older players, approved AI coaches send permitted messages and bounded context to OpenAI for an answer, with moderation of player messages and answers. Wellness or health information requires both underlying health permission and a separate AI-health choice with applicable guardian authority. A separate safety event records a category and fingerprint without duplicating message text; ordinary chat history may still hold the message. General staff prompts must not manually submit a child’s restricted information. Approved structured staff features may use only server-selected, authorized context. AI coaches may not be suitable for some minors. See the Data & AI Notice and AI Crisis Protocol.

4. Your choices and rights

• Review or obtain a copy of your child’s information and correct inaccurate details.
• Decline optional health, media, messaging or external-delivery purposes, or withdraw a specific permission without opening an under-13 direct account.
• Withdraw account permission and stop further use requiring that permission.
• Request deletion, including relevant originals, copies, reports and processors; receive an explanation of any narrowly scoped lawful hold.

Use the separate guardian channel where your relationship is verified, or contact legal@oneclubos.com or the club. Requests and withdrawal must remain available without accepting revised terms. We verify authority before disclosure. A previously issued playback link can remain usable until expiry and downloaded copies cannot be recalled automatically; affected recipients must comply with applicable deletion duties. Withdrawal restricts further permitted use and is distinct from deletion.

5. Retention and security

Every child-data category needs a specific purpose and bounded retention schedule. Review permissions when notice, purpose, relationship or scope changes and at expiry, and review continuing necessity at least annually. An open club account is not a reason to keep every child record. New uses with unresolved retention remain restricted.

Consent evidence and player media are private. The Privacy Notice states the approved video and new wellness, GPS, clinical/status and sanitized-import periods. Existing records remain restricted pending review, with no automatic deletion under the new schedule. Shorter source permissions and valid erasure requirements take priority. Verified deletion includes relevant copies and recipients. Backup limits must be verified and deletions and withdrawals reapplied before restored data becomes accessible.