Privacy Policy

The data controller is [LEGAL ENTITY NAME], trading as H-PRAXIS, of [REGISTERED ADDRESS], Cyprus[COMPANY REGISTRATION NUMBER, IF ANY].

For any question about this policy or to exercise your rights, contact privacy@h-praxis.com.

Where a club or academy engages us to test its athletes and supplies us with the squad list, that club is the controller for the roster data it gives us and we act as its processor under a written agreement. For the measurements and results we generate ourselves, and for anything a family brings to us directly, we are the controller. If you are unsure which applies to you, ask us and we will tell you.

Account and identity data:

• Email address and password (passwords are stored only as a salted hash by our authentication provider — we never see them).
• Name, role (athlete, coach or administrator) and, for athletes, an internal player ID.
• Sport, team, playing position, date of birth and sex recorded at birth. Sex and date of birth are not optional extras: normative comparison is meaningless without them.

Assessment data, recorded at each testing session:

• Body measurements: standing height, sitting height, body mass and foot length.
• Biological maturity estimate — an assessment of how far the athlete is from peak height velocity, i.e. an estimate of their stage of pubertal development.
• Training history: years training in the sport and overall, sessions per week, session duration, and time spent training with older age groups.
• Physical performance results across the test battery (for example jump, speed, endurance and strength measures).
• The height of the athlete's mother and father, used only as an input to maturity and growth estimation.

Technical data:

• A strictly necessary session cookie that keeps you signed in. We set no analytics, advertising or profiling cookies of any kind.
• Standard server logs (IP address, timestamp, page requested) kept for security and troubleshooting.

Height, body mass, sitting height and — above all — an estimate of pubertal maturity are data concerning health under Article 9 of the GDPR. Processing that category is prohibited by default. The exception we rely on is your explicit consent under Article 9(2)(a), given by the athlete's parent or guardian before testing.

This means consent must be a genuine, informed, freely given choice, recorded separately from any other agreement, and just as easy to withdraw as it was to give. If you refuse, your child is not tested and nothing is recorded. We do not make consent a condition of anything unrelated.

Most of the athletes we assess are minors, in age groups from U7 upwards. We require the consent of a parent or legal guardian for every athlete under 18, and we ask for the child's own agreement alongside it, in language they can understand. A child who does not want to be tested is not tested, whatever the adults have signed.

Under Cypriot law implementing Article 8 of the GDPR, a child aged 14 or over may consent to online services in their own right. We nevertheless apply the higher standard of guardian consent for all under-18s, because the data involved is health data.

Athlete accounts show a young person their own report only. They never expose another athlete's data.

We record the standing height of an athlete's mother and father, because parental height is an input to growth and maturity estimation. That is personal data about people who may never have visited this site. We collect it from the family, we use it for nothing else, we do not build any profile of the parent from it, and a parent may ask us to delete their height at any time — the report is then produced without it.

• To deliver the assessment and produce reports — performance of a contract (Art. 6(1)(b)), and explicit consent for the health data within it (Art. 9(2)(a)).
• To compare results against normative data and track development over seasons — the same contract and consent. Longitudinal comparison is the entire point of the service.
• To give a coach access to their own squad's results — contract with the club, on the consent obtained for each athlete.
• To keep accounts secure and the platform working — our legitimate interests (Art. 6(1)(f)) in operating a safe service.
• To meet legal, accounting and insurance obligations — legal obligation (Art. 6(1)(c)).

We do not use athlete data for marketing, we do not sell or rent it, and we do not share it with advertisers or data brokers.

The platform calculates percentiles, maturity-adjusted comparisons and rankings. Those are calculations, not verdicts. No selection, deselection or other decision about an athlete is made automatically by this system: a coach or practitioner interprets the output and decides. You therefore are not subject to a decision based solely on automated processing within the meaning of Article 22 of the GDPR.

We say this deliberately, because the purpose of maturity-adjusted reporting is to stop children being written off for their birthday. A number produced here is evidence for a human judgement, never a substitute for one.

• The athlete, and their parent or guardian.
• Coaching and performance staff at the athlete's own club, where a club has engaged us — restricted to that club's own athletes.
• Supabase, which provides our database, authentication and file storage. Data is stored in Ireland (eu-west-1), within the European Economic Area.
• [HOSTING PROVIDER], which serves the website and application.
• [EMAIL PROVIDER, IF ANY], used to send account and account-recovery emails.
• Our professional advisers (accountant, insurer, lawyer) where strictly necessary, and public authorities where the law requires it.

Each provider acts on our documented instructions under a written processing agreement, and none of them is permitted to use the data for their own purposes.

Athlete records are stored in Ireland, inside the European Economic Area. Keeping data there is not an international transfer and needs no additional safeguard.

Supabase, who operate that database, are established in the United States. Where their staff access data from outside the EEA in order to support or maintain the service, that access is governed by the Standard Contractual Clauses approved by the European Commission, under our data processing agreement with them.

Our remaining providers and their locations: [HOSTING PROVIDER AND ITS REGION], [EMAIL PROVIDER AND ITS REGION]. Ask us and we will send you a copy of any safeguard we rely on.

Longitudinal monitoring only works if history is preserved, so assessment records are kept for [RETENTION PERIOD] from the last test, after which they are deleted or irreversibly anonymised. Account records are deleted [PERIOD] after an account is closed. Invoicing records are kept for the period Cypriot tax law requires.

Anonymised, aggregated statistics — from which no individual can be re-identified — may be retained indefinitely to maintain reference data. That is no longer personal data.

Under the GDPR you may:

• Ask for a copy of the personal data we hold about you.
• Have inaccurate data corrected — including a mis-recorded measurement.
• Ask for erasure of the data.
• Ask us to restrict processing while a dispute is resolved.
• Receive your data in a portable, machine-readable format, or have it sent to another provider.
• Object to processing carried out on the basis of our legitimate interests.
• Withdraw consent at any time. Withdrawal does not affect processing already carried out, but it stops any further processing and you may ask for erasure at the same time.

Write to privacy@h-praxis.com. We respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

If you are not satisfied, you may complain to the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy), or to the supervisory authority where you live.

Access is controlled per account and enforced at the database level, so a coach can reach only their own squad and an athlete only their own report. Data is encrypted in transit and at rest by our infrastructure provider. Passwords are salted and hashed and are never visible to us.

If a breach occurs that is likely to result in a risk to the rights and freedoms of those affected, we notify the Commissioner within 72 hours, and we notify you directly where the risk is high.

We update this policy when our processing changes. The date at the top always reflects the current version. If a change materially affects how we handle athlete data, we contact affected families directly rather than relying on you to re-read this page.