OneClub OS player consent form

1. Before a child uses an account

A player account with an unknown age or missing parental permission stays pending. For players under 18, an authorized member of club staff must review a returned consent form signed by a parent or legal guardian, link it to that guardian and player, and record the exact permissions given. Children cannot approve themselves, and a checkbox stating that a guardian agreed is not sufficient.

Parents receive this notice and the printable consent form before permission is recorded. Return the signed form by an agreed private channel to your club or to us. Club staff check the signature, the signer’s identity and parental authority, the date and the selected permissions. The signed evidence is held in private storage. We may request additional verification if the evidence is insufficient; we do not ask children to upload identity documents.

After the required account permission is recorded, children may use their own limited player account. Adults must use their own accounts rather than share a child’s credentials. Players turning 18 accept the current terms for themselves. A changed or withdrawn permission takes effect when recorded, and expired or superseded consent cannot enable new collection.

2. Information collected and how it is used

• Account and roster: name, login email, date of birth, team, profile details, guardians and access permissions. These support club membership, age checks, schedules and access to the player’s records.
• Development and participation: training and match information, goals, evaluations, self-reviews, attendance and performance information entered by the club or player.
• Optional health information: wellness responses, availability, injuries, restrictions, load and fitness information. This requires separate permission and is used to support training and player care, not medical diagnosis.
• Optional media: profile photos, match or training video, clips and player tags. Media can identify a child even when their name is omitted.
• Optional communication: messages, replies and related service notifications. Authorized club administrators can audit club messages for safety. Parents can request review through their club or us.
• Security and consent: access and activity records, acceptance versions and timestamps, signed forms and review evidence. Technical providers may receive network identifiers needed to deliver and secure the service.

We do not require optional health information, media or external sharing as a condition of basic player-account access. Clubs must collect only information needed for the selected features. Free-text and uploaded content must not contain unnecessary sensitive information.

3. Who receives information

Authorized club staff receive information according to their roles and teams. Players have limited access to their own records and permitted team functions. Service providers host, authenticate, store, deliver and protect information on our behalf; the current provider list is in Section 3 of the Privacy Notice. These necessary service functions are explained in the parental notice. Optional delivery of identifiable clips outside the platform requires its own permission.

We do not sell children’s information, use it for targeted advertising, or train AI models on it. Current AI assistance is for staff. Children’s personal information, health records, photos, video and messages must not be submitted to external AI tools through staff prompts. Future AI or machine-learning features involving player data require a separate review of purpose, consent, provider terms, retention and access before activation; agreeing to this notice does not authorize future training.

4. Your choices and rights

• Review or obtain a copy of your child’s information and correct inaccurate details.
• Decline optional health, media, messaging or external-delivery permissions, or withdraw a specific permission later.
• Withdraw account permission and stop further collection through the player account.
• Ask for deletion of your child’s information. We verify the request and explain any specific legal or safety record that must be retained, its purpose and applicable period.

Contact your club or legal@oneclubos.com. We verify parental authority using the guardian details and evidence on file before providing records or changing access. The club can record a withdrawal in the player’s guardian-and-consent panel. New requests are checked against current permissions. A playback link already issued can remain usable until it expires, for up to four hours and fifteen minutes. Copies already downloaded cannot be recalled through an account setting. Withdrawal does not itself erase prior records or remove your child from the team; request deletion separately if that is what you want.

5. Retention and security

Permissions are reviewed when their scope or notice changes and at expiry. Clubs must review continuing need at least annually and request deletion when a record is no longer needed. Records needed to fulfill a verified request, resolve a dispute, document consent or meet a specific legal obligation may be retained for that identified purpose. We do not treat an open club account as justification to keep every child record indefinitely.

Consent evidence, player photos and uploaded video use private storage with authorized access. Public club branding is separate. A deletion from active storage does not immediately rewrite provider backups; backup copies expire according to the provider’s applicable retention and must not be restored into active use without reapplying deletions. Contact us if you believe a child is using an account without the required permission.

1. What we collect and where it comes from

Before signup we ask for an age range without retaining that answer as a birthdate. Account setup then asks for your email address, a password (held by our identity provider, never by us), your first and last name, and the access code your club gave you. Everything else described below is entered by your club’s authorized staff, imported by your club from a connected source, or added by you voluntarily inside the platform. If you add a phone number or birthdate to your own account, and your account is linked to a player record, your email and phone are also written to that player record’s contacts so your club can reach you.

Our account and player forms do not request payment card data, Social Security or other government identifiers, precise device location, or biometric identifiers. Clubs must remove unnecessary sensitive information and location coordinates from uploaded files and free text. Video is stored as ordinary media and is not processed for facial recognition or other biometric identification.

2. How we use information

• To provide the platform to your club: authentication, rosters, scheduling, evaluations, wellness and availability workflows, messaging, video, and Coaches Corner.
• To send the notifications your club configures, such as development-review reminders and the scheduled wellness and availability reports staff receive, by email, push, or in-app message.
• To secure the platform: detect abuse, enforce permissions and tenant isolation, investigate incidents, and keep audit trails of privileged actions.
• To operate and improve the platform using aggregate, club-scoped usage and error diagnostics.
• To comply with law and to enforce our Terms.

We do not sell personal information, use it for targeted advertising or train AI models on it. Staff AI features include Ask ClubOS help/navigation and optional Coaches Corner drafting, summaries and quizzes. These can process a staff question, limited recent help conversation and coaching content selected by an administrator. They do not automatically query a roster or health records. Do not include children’s personal information, health details or private club messages in AI inputs. Input checks reduce exposure but cannot guarantee that free text is anonymous. Provider storage controls and permitted data classes must be approved before any player-data AI feature is enabled; a store:false request is not the same as zero data retention.

Future agents must use the same tenant, role and purpose permissions as the corresponding user action. Model output does not grant authority. These notices do not give us blanket permission to use historical data for future AI training, player profiling or unrelated features.

Planned independent-player and AI features

We plan a player experience for people without an affiliated club. It may use information a player chooses to enter to produce personal summaries, comparisons and AI-assisted sporting insights. This experience, player-data AI and model training are not enabled by this policy update. Before launch, we will explain the actual inputs, purposes, recipients, retention and choices for the selected feature.

For a direct player service, OneClub OS would be responsible for its own processing decisions and for handling rights requests directly, rather than routing them to a club you do not have. Independent-player information would not automatically become visible to a club. Moving or sharing information with a club would require an authorized, specific action.

Generating an answer for you, building comparison statistics and training or improving a model are different uses. Accepting these notices does not authorize future training on your information or reuse of historical club records. Health-related inferences receive health-data protections. Any new use that requires consent will have a separate, specific choice before it starts, with parental permission where required. Contact legal@oneclubos.com with questions.

3. Who we share information with

Within your club, information is visible only to roles your club authorizes, and a player-only account is refused the staff wellness, availability, and evaluation workspaces by the platform itself, whatever the club’s role settings say. Outside your club, the services below support the features described. Infrastructure processing is governed by the applicable service agreements and data-processing terms. External media sites that your club links have their own privacy policies. The separate permission for external clip delivery covers recipients approved by your club. We may also disclose information where required by law, as described below.

We may also disclose information to comply with a subpoena, court order, or legal process; to protect the rights, safety, or property of users, minors, or the public; or in connection with a merger, acquisition, or sale of assets, in which case this notice will continue to apply.

4. Google user data

A club administrator may optionally connect a Google Drive folder to the Coaches Corner asset library. When connected, OneClub OS accesses only file metadata (file name, type, size, link, modified time, and the owner’s display name) through the read-only scope drive.metadata.readonly; we do not read, download, or store file contents. Metadata is stored scoped to the connecting club and refreshed when an administrator syncs, when the Coaches Corner portal opens, and by a daily scheduled refresh that keeps the connection current. OAuth refresh tokens are encrypted at rest with a key held outside the database.

OneClub OS’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only for the connected feature and necessary service processing, never for advertising or model training. Do not select private Drive content for an external AI workflow unless that transfer is permitted and disclosed. A club can disconnect its Drive folder at any time inside Coaches Corner (which deletes the stored tokens) or revoke access from its Google account permissions.

5. How we protect information

• Club records are scoped to their club. The server resolves the club from an approved domain and checks the authenticated user’s permissions. Server authorization and database row-level policies restrict access to club data.
• Our hosting and database providers encrypt data in transit and at rest. Platform-hosted video and imports use private storage. Authorized playback uses signed links that expire within four hours and fifteen minutes. External media linked by a club follows the source service’s access settings; clubs must obtain permission for everyone identifiable in uploaded media.
• Access to health, injury, and minors’ information is limited by role, and a player-only account is refused the staff workspaces regardless of role settings. Reads of the wellness staff workspace, wellness report deliveries, contract financials, the message audit, and roster exports are logged with the reader’s identity.
• Support-view access to a club is time-limited, read-only and audit-logged. Administrative changes use separately authorized workflows.
• Our documented security program (available to clubs on request) includes a continuous-integration pipeline that runs type checks, lint, unit and smoke tests, accessibility and visual checks, and static security audits on every change; a two-stage release flow through a staging environment with its own database; versioned database migrations; error monitoring with cookies, authorization headers, user identity, and record identifiers removed before an event is sent; and automated database backups with a written recovery-target policy. No system is perfectly secure; we cannot guarantee absolute security.

If we learn of a breach of security involving your personal information, we will notify your club and, where required by the law of your state, you, without unreasonable delay and within the time the law requires.

6. How long we keep information

7. Your U.S. state privacy rights

Depending on where you live, state law may give you rights over personal information, including to know what is held about you, to access it, to correct it, to delete it, to receive a portable copy, to opt out of its sale, of sharing for targeted advertising, and of profiling that produces legal or similarly significant effects, and not to be discriminated against for exercising those rights. We honor these rights for every user in every state, whether or not a particular statute applies to us, and regardless of the applicability thresholds in those statutes.

Because your club controls its data, most requests about club records are fulfilled through your club, and we support the club in doing so. You may also send a request directly to legal@oneclubos.com and we will route it to your club and respond within 45 days, extendable once by 45 days where reasonably necessary. We will verify your request using your account and may ask for additional information. An authorized agent may submit a request on your behalf with signed permission. If we deny a request, we will explain why and you may appeal by replying to our response; if your appeal is denied, you may contact your state attorney general.

We do not sell personal information and do not share it for targeted advertising, so there is nothing to opt out of; we treat browser Global Privacy Control signals as an opt-out request in any case. We do not use personal information for profiling that produces legal or similarly significant effects.

State-specific notes:

• California. This notice serves as our notice at collection. The categories in Section 1 map to the CCPA categories of identifiers, personal records, protected classifications (age and, where a club records it, nationality), commercial information, internet activity, geolocation (none precise), audio and visual information, professional information, and sensitive personal information (health, and precise data about children). We do not sell or share personal information and have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of anyone under 16. California residents may also request a list of third parties to whom we disclosed personal information for their direct marketing purposes; we make no such disclosures.
• Washington, Nevada, and Connecticut. Wellness, injury, and treatment information is consumer health data under the Washington My Health My Data Act, Nevada SB 370, and Connecticut law. The Consumer Health Data Privacy Policy explains the consents we obtain, how to withdraw them, and how to request deletion.
• Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island. The rights above apply, including the right to appeal a denial. Health information and personal information of a known child are sensitive data; we process sensitive data only with the consent your club obtains and records, as described in the companion notices.
• Maryland. We do not sell, and do not process for targeted advertising, the personal data of anyone we know to be under 18, and we collect only the data reasonably necessary for the platform.
• Texas. Where we know a user is a minor, we support parents and guardians through the club in supervising the minor’s use, as described in the Children’s Privacy Notice.
• Illinois and Texas biometrics. We do not collect biometric identifiers or biometric information.
• New York and Massachusetts. Additional security requirements may apply to covered information. Contact us about the safeguards described in this notice; additional requirements depend on the circumstances.
• Nevada. We do not sell covered information as defined in NRS 603A.

8. Children

Direct use by children under 13 requires recorded, reviewed parental permission. Player accounts with unknown age or missing required permission stay pending. Optional health, media and messaging permissions are separate. Parents can review, correct, withdraw permission and request deletion through their club or us. The Children’s Privacy Notice describes the form, verification and rights process.

9. Cookies, analytics, and do-not-track

We use strictly necessary cookies for sign-in sessions, security, and your preferences. We use aggregate page analytics from our hosting provider; before a page view is reported, record identifiers are removed from the path and the query string is dropped, to reduce the risk of linking analytics to a player. We do not use third-party advertising cookies. Content your club links from YouTube, Vimeo, or X loads from those services with their own cookies. Because we do not track you across other sites, we treat do-not-track and Global Privacy Control signals as honored by default.

10. Where information is processed

We operate from the United States. Our providers may store or process information in the United States and other countries as needed to deliver their services. Locations depend on the service, configured hosting region and global delivery or support infrastructure. Contact us for information about the services used by your club and applicable transfer safeguards.

11. Changes to this notice

We will update this notice as the platform evolves. Material changes are announced to club administrators and, because acceptance is recorded per version, every user is shown the new version with a summary of changes at their next sign-in. Use of the platform is also governed by our Terms of Service.

1. Consumer health data we collect

• Self-reported wellness indicators submitted by a player, such as readiness, sleep, soreness, fatigue, mood, and body-map locations.
• Availability status, such as fit, managed, limited, or out.
• Injury indicators you report in a check-in, and the availability record staff keep: status, restriction, return-to-play status and date, coach context, and a confidential availability note.
• Physical measurements a club records, such as height and weight.
• Training and match load metrics, including heart-rate readings, from GPS and heart-rate device files a club imports, and physical benchmarks.
• Wellness summaries and decision reports that a club generates from the above and, where a club configures it, delivers to authorized staff by message.

We do not request biometric identifiers, genetic data, reproductive or sexual health information, or precise device location from a player’s browser. Clubs must remove unnecessary identifiers, location coordinates and other sensitive fields from imported files and free text. We do not use the platform to diagnose health conditions.

2. Sources

Consumer health data comes from you, when you submit a wellness check-in; from authorized club staff, when they record availability, an injury, a measurement, or an evaluation; and from device files your club imports, when they contain load and heart-rate metrics.

3. Why we collect and use it

• To let your club monitor player readiness, availability, and recovery, and to support qualified staff in training and return-to-play decisions.
• To send the scheduled wellness and availability reports your club configures to authorized staff, and to show you when a check-in is due.
• To display trends and summaries to you and to the staff your club authorizes.
• To secure the platform and comply with law.

We do not use consumer health data for advertising, do not sell it, and do not share it for any purpose other than those above.

4. Who can see it

Inside your club, wellness data is visible only to roles your club grants the wellness permission, typically athletic trainers, strength staff, and coaches. The availability record, including the confidential availability note, is visible to the roles your club grants the availability workspace. A player-only account is refused both staff workspaces by the platform itself and sees only its own data. Outside your club, health data is processed only by the infrastructure providers named in the Privacy Notice (database, hosting, and push delivery), each bound to process it only on our instructions. We disclose it to third parties only when required by law or to protect someone’s safety.

5. Consent, and how to withdraw it

Health permission is optional and separate from accepting the terms or opening a player account. Adults choose it for themselves. For a minor, a parent or legal guardian selects it on the signed form reviewed by the club. A general club attestation, missing record, unknown age, or expired or withdrawn consent does not enable new health collection.

Adult players can change their health permission in Personal Settings. Parents and guardians can contact their club or legal@oneclubos.com to change a specific permission or request deletion. Staff record that change in the player’s guardian-and-consent panel. Withdrawal stops new collection for that purpose; it does not automatically erase historical records needed for an identified legal or safety purpose. Ask for deletion separately and we will explain the outcome.

A future independent-player feature may generate health-related trends or inferences from information you provide. It is not enabled by this update. Before any such processing, the feature must identify the health inputs and inferences, their purpose, the recipients and retention, and obtain any required specific consent. General account acceptance is not consent to future health profiling or model training.

Health records must not be entered in staff AI prompts. This policy does not authorize future AI training, clinical decisions or unrelated profiling.

6. Your rights

• To confirm whether we hold consumer health data about you, to access it, and to receive a list of the third parties and affiliates with whom we have shared it, with their contact information.
• To withdraw consent to collection or sharing.
• To have your consumer health data deleted. Our operators verify the request, identify the affected database, files and necessary service providers, carry out the applicable deletion and confirm the result or explain a specific legal exception. Deactivating an account alone does not erase all player records. Deleted data persists in provider-managed database backups until the provider’s backup retention window elapses; backups are not rewritten.
• To appeal a decision about your request by replying to our response; if we deny your appeal, you may contact your state attorney general.

Send requests to legal@oneclubos.com or through your club. We will verify your request using your account, respond within 45 days, and never discriminate against you for exercising a right.

7. Security and retention

Health data is protected by the controls described in the Privacy Notice, including tenant isolation, role-based access, the platform’s refusal of staff workspaces to player-only accounts, encryption by our providers, and logging of reads of the wellness staff workspace and report deliveries. Health records are retained only while needed for the selected purpose or an identified legal or safety obligation. Continuing need is reviewed at least annually, and a verified deletion request is handled as described above. An open club account alone is not a reason to keep every health record indefinitely. Wellness decision reports sent to staff are removed by scheduled cleanup 24 months after creation, or 7 days after a confirmed delivery failure.

8. Geofencing

We do not use geofencing around any facility that provides health-care services, and our browser forms do not request precise device location. Clubs must remove unnecessary location coordinates from uploads.

9. Contact

Privacy questions and requests: legal@oneclubos.com. Legal notices: legal@oneclubos.com. Changes to this policy are versioned and shown to every user for acceptance at their next sign-in.