OneClub OS Consumer Health Data Privacy Policy

What changed

• Privacy and legal requests now go to legal@oneclubos.com; product help and misuse reports go to support@oneclubos.com.
• Updated age-aware access, separate data permissions, guardian evidence and AI data-use rules.

1. Consumer health data we collect

• Self-reported wellness indicators submitted by a player, such as readiness, sleep, soreness, fatigue, mood, and body-map locations.
• Availability status, such as fit, managed, limited, or out.
• Injury indicators you report in a check-in, and the availability record staff keep: status, restriction, return-to-play status and date, coach context, and a confidential availability note.
• Physical measurements a club records, such as height and weight.
• Training and match load metrics, including heart-rate readings, from GPS and heart-rate device files a club imports, and physical benchmarks.
• Wellness summaries and decision reports that a club generates from the above and, where a club configures it, delivers to authorized staff by message.

We do not request biometric identifiers, genetic data, reproductive or sexual health information, or precise device location from a player’s browser. Clubs must remove unnecessary identifiers, location coordinates and other sensitive fields from imported files and free text. We do not use the platform to diagnose health conditions.

2. Sources

Consumer health data comes from you, when you submit a wellness check-in; from authorized club staff, when they record availability, an injury, a measurement, or an evaluation; and from device files your club imports, when they contain load and heart-rate metrics.

3. Why we collect and use it

• To let your club monitor player readiness, availability, and recovery, and to support qualified staff in training and return-to-play decisions.
• To send the scheduled wellness and availability reports your club configures to authorized staff, and to show you when a check-in is due.
• To display trends and summaries to you and to the staff your club authorizes.
• To secure the platform and comply with law.

We do not use consumer health data for advertising, do not sell it, and do not share it for any purpose other than those above.

4. Who can see it

Inside your club, wellness data is visible only to roles your club grants the wellness permission, typically athletic trainers, strength staff, and coaches. The availability record, including the confidential availability note, is visible to the roles your club grants the availability workspace. A player-only account is refused both staff workspaces by the platform itself and sees only its own data. Outside your club, health data is processed only by the infrastructure providers named in the Privacy Notice (database, hosting, and push delivery), each bound to process it only on our instructions. We disclose it to third parties only when required by law or to protect someone’s safety.

5. Consent, and how to withdraw it

Health permission is optional and separate from accepting the terms or opening a player account. Adults choose it for themselves. For a minor, a parent or legal guardian selects it on the signed form reviewed by the club. A general club attestation, missing record, unknown age, or expired or withdrawn consent does not enable new health collection.

Adult players can change their health permission in Personal Settings. Parents and guardians can contact their club or legal@oneclubos.com to change a specific permission or request deletion. Staff record that change in the player’s guardian-and-consent panel. Withdrawal stops new collection for that purpose; it does not automatically erase historical records needed for an identified legal or safety purpose. Ask for deletion separately and we will explain the outcome.

A future independent-player feature may generate health-related trends or inferences from information you provide. It is not enabled by this update. Before any such processing, the feature must identify the health inputs and inferences, their purpose, the recipients and retention, and obtain any required specific consent. General account acceptance is not consent to future health profiling or model training.

Health records must not be entered in staff AI prompts. This policy does not authorize future AI training, clinical decisions or unrelated profiling.

6. Your rights

• To confirm whether we hold consumer health data about you, to access it, and to receive a list of the third parties and affiliates with whom we have shared it, with their contact information.
• To withdraw consent to collection or sharing.
• To have your consumer health data deleted. Our operators verify the request, identify the affected database, files and necessary service providers, carry out the applicable deletion and confirm the result or explain a specific legal exception. Deactivating an account alone does not erase all player records. Deleted data persists in provider-managed database backups until the provider’s backup retention window elapses; backups are not rewritten.
• To appeal a decision about your request by replying to our response; if we deny your appeal, you may contact your state attorney general.

Send requests to legal@oneclubos.com or through your club. We will verify your request using your account, respond within 45 days, and never discriminate against you for exercising a right.

7. Security and retention

Health data is protected by the controls described in the Privacy Notice, including tenant isolation, role-based access, the platform’s refusal of staff workspaces to player-only accounts, encryption by our providers, and logging of reads of the wellness staff workspace and report deliveries. Health records are retained only while needed for the selected purpose or an identified legal or safety obligation. Continuing need is reviewed at least annually, and a verified deletion request is handled as described above. An open club account alone is not a reason to keep every health record indefinitely. Wellness decision reports sent to staff are removed by scheduled cleanup 24 months after creation, or 7 days after a confirmed delivery failure.

8. Geofencing

We do not use geofencing around any facility that provides health-care services, and our browser forms do not request precise device location. Clubs must remove unnecessary location coordinates from uploads.

9. Contact

Privacy questions and requests: legal@oneclubos.com. Legal notices: legal@oneclubos.com. Changes to this policy are versioned and shown to every user for acceptance at their next sign-in.