SPLT Club's policy for consumer health data under Washington's My Health My Data Act, Nevada's consumer health data law (SB 370) and Connecticut's consumer health data rules. It supplements the SPLT Club Privacy Notice.
1. About this policy
This policy explains how SPLT Club [Ltd] ("SPLT Club", "we", "us") collects, uses, shares and protects consumer health data. It applies to people in the United States, and in particular to residents of Washington, Nevada and Connecticut, and to consumer health data collected in those states. It supplements our Privacy Notice, which covers everything else.
2. What "consumer health data" means
Consumer health data is personal information linked, or reasonably linkable, to you that identifies your past, present or future physical or mental health status. On SPLT Club, that includes the health and wellbeing information in your athlete profile, data from devices and apps you connect, and anything we work out from that information, such as readiness and training-load measures.
3. Consumer health data we collect, and why
| Category | Examples | Why we collect it |
|---|---|---|
| Injuries and illness | Whether you are fit, limited or out, the reason and notes, and when you expect to return, including injuries a coach records for you | To track recovery and help you and your coaches adjust training |
| Wellbeing and recovery | Sleep hours and quality, fatigue, soreness, stress, mood, motivation and hydration | To monitor how you're coping with training |
| Body and physiology | Resting heart rate, heart rate variability, body weight, blood lactate readings, and heart rate and effort (RPE) during sessions | To measure training load and recovery |
| Device and app data | Workouts and heart rate from Concept2, Strava and Garmin or SpeedCoach files; sleep, heart rate variability and resting heart rate from Whoop | To bring your device data into your profile |
| Derived information | Readiness, training load, fitness and fatigue, and measures such as acute-to-chronic load and heart rate variability against your own baseline | To flag patterns for you and the clubs you share with |
We collect consumer health data only with your consent (section 7), and only to provide the SPLT Club service you asked for.
Coaching notes that club staff write about your sessions are controlled by that club, not by us. We store them for the club, on its instructions, and the club's own privacy notice covers them.
4. Where we get it from
- You, when you enter it in the app
- Your parent or guardian, if you're under 16
- Devices and apps you connect, such as Concept2, Strava, Whoop, and Garmin or SpeedCoach files you upload
- Our own systems, when we calculate measures from your data
- Your coaches, when they record an injury or your availability for you
5. Who we share it with
| Recipient | What they receive | Why | Your consent |
|---|---|---|---|
| Clubs you choose to share with | The profile data you choose to share, from today or including your history | So your coaches can support your training and welfare | Separate consent for each club, which you can withdraw at any time |
| Your parent or guardian (under 16 only) | Your consents, sharing choices, settings and training. Not your health data in the app, but they can ask us for a copy of it (section 8). | To manage your account | Given by the guardian on your behalf |
| Our hosting provider, Railway | All stored data | To host the SPLT Club database and files | Processor acting only on our instructions |
| Anthropic | For the coach assistant: the readiness, recent training, last test, whether you are fit (never the reason for an injury) and check-in notes of athletes a coach asks about, only for clubs you share with | To answer your coach's questions and draft actions for the coach to confirm | Processor acting only on our instructions |
We have no affiliates that receive consumer health data. Our email provider never receives consumer health data: emails tell you something has happened and link to the app. We don't use analytics. The full list of our service providers is at spltclub.com/legal/sub-processors. You can see every club that currently has access to your profile in Settings > Privacy.
6. What we never do
- Sell consumer health data, or exchange it for anything of value
- Use it for targeted advertising, or share it with advertisers or data brokers
- Set up geofences around places where health services are provided
- Use it to train third-party AI models
- Share it with anyone you haven't chosen, except our processors (section 5), or where the law requires us to
7. Your consent
We ask for two separate consents:
- Collection: when you create your account, we ask your consent to collect and use your consumer health data for the purposes in section 3. SPLT Club cannot work without it, so it is needed to use the app.
- Sharing: each time you join a club, we ask your separate consent to share your profile, including health data, with that club.
You can withdraw either at any time in Settings > Privacy. If you withdraw consent to collection, your account is suspended: we stop collecting your consumer health data immediately, your clubs lose access straight away, you can download a copy of your data, and your consumer health data is deleted within 30 days. If you withdraw consent to share with a club, that club's access ends immediately. If we ever wanted to use or share your data for a new purpose, we would ask for your consent first.
8. Your rights
You have the right to:
- Confirm and access: find out whether we collect or share your consumer health data, get a copy of it, and get a list of every third party and affiliate we have shared it with, including their contact details. That list includes every club that has had access to your profile, even if its access has ended.
- Delete: have your consumer health data deleted, including by our processors and from our backups
- Withdraw consent: to collection, or to sharing with any club
- Appeal: if we refuse a request (section 9)
How to make a request: use Settings > Privacy in the app, or email [Privacy Email] with "Health data request" in the subject line. A parent or guardian can make requests for a child under 16, including for a copy of the child's consumer health data; we send it only after verifying who they are and that they are linked to the child's account. Someone you authorise can make a request for you, with your signed permission. We'll verify your identity before acting, using information we already hold.
Timing and cost: we respond within 45 days. If we need more time, we'll tell you why within those 45 days and take up to 45 more. Requests are free, up to twice in any 12-month period. We will never treat you differently for using these rights.
9. Appeals
If we decline your request, our reply will explain why and how to appeal. To appeal, reply to that email or contact [Privacy Email] within [60] days. We'll give you a written decision, with reasons, within 45 days of receiving your appeal. If you're not satisfied, you can contact your state Attorney General:
- Washington: [atg.wa.gov complaint link]
- Nevada: [ag.nv.gov complaint link]
- Connecticut: [portal.ct.gov/ag complaint link]
10. How long we keep it
We keep consumer health data while your account is open and your collection consent is in place. It is deleted within 30 days if you withdraw consent or delete your account, and removed from backups within [35] days after that. A club's access ends immediately when you stop sharing with it, or 60 days after you leave the club. Coaching notes written by club staff are deleted 60 days after you leave the club, stop sharing with it or delete your account, unless the club must keep them by law.
11. Security and access
Only SPLT Club staff and processors who need consumer health data to provide the service can access it. We protect it with encryption in transit [and at rest], role-based access controls, multi-factor authentication available to every account and required for SPLT Club staff with access to production systems, and audit logs of changes.
12. Children
For athletes under 16, a parent or guardian gives every consent and can use every right in section 8 on the child's behalf. [Before any US launch: for children under 13 in the US, we get verifiable parental consent before collecting any information, as COPPA requires.]
13. Changes and contact
We'll tell you about material changes at least [30] days before they take effect, and ask for new consent where the law requires it. Questions or requests: SPLT Club [Ltd], [Registered Address], [Privacy Email].