Privacy and data use.

Information used

• Account identity: name, email address, authentication identifiers and security events. Passwords are handled by Supabase Auth and are not visible to Athlinq practitioners.
• Player profile: date of birth, sport, position, dominant side, height, body mass and optional profile image.
• Club performance record: squads, assigned sessions and tasks, completion results, RPE, feedback, physical measurements, body-composition estimates and their protocol inputs, status tags and private completion photos.
• Practitioner record: name, job role, club access and attributed workspace actions.

Public club enquiries

The demo-request form records the requester’s name, professional email, organisation, role, sport, approximate athlete range, preferred timing and operational message. Athlinq uses this information only to assess and respond to the enquiry. It does not create a club workspace, subscribe the requester to general marketing or permit access to athlete information.

Why it is used

Athlinq uses this information to authenticate accounts, connect a person to the correct club role, deliver and record practitioner-assigned work, maintain an access and activity history, support account security and operate the supervised pilot. Athlete and health-related information is not used for advertising or sold.

Who can see it

• A player can access only their own connected club record.
• Approved practitioners can access athletes inside their own club workspace. The club owner approves and removes staff access.
• Club videos and athlete records are private. The public exercise catalogue excludes club videos and athlete data.
• Supabase provides account authentication. Cloudflare provides hosted application, database and private file infrastructure.
• If the optional AI programme drafter is enabled, Athlinq sends only the practitioner’s general goal and selected exercise catalogue fields; athlete identities, records, feedback and private exercise instructions are excluded.

Control, retention and rights

The person creating a club workspace confirms they are authorised to administer it and controls practitioner and player access for that organisation. Club owners can revoke access and permanently delete archived club athlete records. Players retain their transferable profile when a club connection ends. Expired connection requests are removed automatically; used or revoked invitation records are removed after 30 days. Formal retention periods and the lawful basis for any health information must be agreed between Athlinq and each club before wider production use.

To request access, correction, restriction, portability or erasure, contact the club for its club-controlled record and email admin@athlinq.co.uk for the Athlinq account. Some records may need to be retained where the law or an overriding legitimate requirement applies.

Academy players

Children’s information requires additional protection. Academy use must follow the club-approved age, parent or guardian, transparency and safeguarding process. The pilot should not onboard under-18 players until that process and a data protection impact assessment have been approved.