Legal

Privacy Policy

Last updated: 15 October 2026

ProtocolHQ helps sports clubs, coaches, medical staff and athletes plan training, look after athletes' health and run the team. That means we handle personal data, some of it sensitive. This policy explains, in plain words, what we process, why, who can see it, where it is stored, how long we keep it and what rights you have. It covers the ProtocolHQ app (web, iPhone and Android) and this website. We never sell personal data and we don't use it for advertising.

1 Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) for this website, and for the cases in section 2 where we decide what happens to the data, is:

Kenneth Ogbe, ProtocolHQ
Email: overseas.radar@gmail.com

We have not appointed a data protection officer, because the law doesn't require one at our size. For anything about your data, write to the email address above.

2 Clubs decide, we process for them

Most people use ProtocolHQ because their club or coach uses it. In that case:

The club (or the independent coach) is the controller for the data of its athletes and staff: it decides who is added, which roles they have, what is recorded and how long the club keeps it. Medical staff are additionally responsible for their own clinical records under their professional rules.
ProtocolHQ is the club's processor (Art. 28 GDPR). We store and process the data only to run the service for the club and on its instructions, under a data processing agreement.
We are the controller for this website, for your login account itself, for keeping the service secure, for our records of consents and data requests, and for the AI usage counts we bill by.

If you are an athlete or staff member, you can send requests about your data to your club or to us; we pass them on and help the club answer them.

3 This website

Hosting. The website is served by Google Firebase Hosting. When you open a page, your browser sends technical data (IP address, date and time, page, browser and device type). Google uses it to deliver the page and protect it against attacks; we don't keep our own logs or build profiles from it. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
No cookies, no tracking. The website sets no cookies and uses no analytics, tracking pixels, external fonts or social media plug-ins.
Contact. If you email us (for example through "Talk to us"), we use your message and address to answer you and, if you want, to set up your club (Art. 6(1)(b) and (f) GDPR). Our email is provided by Google (Gmail). We delete such emails when they are no longer needed, unless tax or commercial law requires us to keep them.

4 What the app processes, and why

Which of these apply depends on your role and on what your club uses. Legal bases (GDPR): (b) = needed for the contract, i.e. to provide the service you or your club signed up for; (a) = your consent; (c) = legal obligation; (f) = legitimate interest; Art. 9(2)(a) = explicit consent for health data.

Data

What for · legal basis

Account: name, email, password (stored only as a secure hash by Firebase), role, profile photo, date of birth

To sign in, to show who you are to the people you work with, and to apply the age rules in section 7 · (b), photo (a)

Club and team membership: club, teams, squads, staff roles (coach, S&C, physio, doctor, team manager, club admin), invitations

To give each person the right view and the right access · (b)

Training: exercises and workouts (incl. images and videos), programmes, assigned sessions, logged sets, reps, weights, times, RPE, training load, self-logged activities, form-check videos

Planning, doing and reviewing training · (b)

Daily check-ins: sleep, soreness, stress, energy, mood, an optional note

So coaches can adjust training. These can say something about health, so we treat them as health data · Art. 9(2)(a), given in the app

Health and medical data: illness and injury reports (symptoms, body area, pain, body chart, photos), availability, return-to-play stages, rehab, tests and screenings, questionnaires, medical documents, appointments, and, for physios and doctors only, clinical notes such as diagnosis, treatment and medication

Looking after athletes' health and deciding whether they can train · Art. 9(2)(a); medical staff also process under their professional duties and secrecy (Art. 9(2)(h), (3) GDPR)

Bodyweight

Tracking over time; shared with the coach only if the athlete turns sharing on · (a)

Messages: chats, team announcements, team channel, game threads

Communication within the team · (b)

Team operations: trips, packing lists, receipts (with photos), requests, match ticket requests, kit sizes and kit handed out, supplier contacts

Running the team's logistics · (b)

Games: schedule, opponents, plays, game plans, video clips and links

Game preparation · (b)

Uploads: documents you import (spreadsheets, PDFs, research papers), your research library

Turning documents into workouts, exercises, protocols and lists · (b)

Ask HQ (the assistant): your requests, what it did (activity log), standing rules you set, workout habits it learns, multi-day jobs, usage counts

Doing the busywork you ask for; see section 6 · (b); usage counts (f) for fair use and billing

Notifications and push tokens (a device identifier)

Telling you about new sessions, messages and requests · (b); push needs your device permission

Consents and data requests: which consent was given, by whom (athlete, parent or club), when and in which version; exports and deletions

Proving consents and handling your rights · (c)

Security data: sign-in events, app integrity checks (Firebase App Check with reCAPTCHA Enterprise on the web and Apple App Attest on iPhone)

Protecting accounts and the service against misuse · (f)

Device permissions. The app asks before it uses your camera, photos or microphone. Voice input and read-aloud use your phone's or browser's own speech service (Apple or Google). On your device the app keeps a cache so it works offline, today's Ask HQ conversation and your settings; on the web these are kept in the browser's storage. Signing out removes the cached data.

You don't have to give health data or consents to use the app; without them, the features that need them stay off. Some data is needed for the service to work at all (for example your name and email).

5 Who can see what

Access is enforced by tested security rules on our servers, not just hidden in the app.

Athletes see their own data, the training their coaches assign and their team's messages.
Coaches and S&C staff of the athlete's teams see training, check-ins and whether an athlete is available. Sessions a coach plans are private to that coach unless shared with the team staff.
Coaches outside the club (for example a national team or a private coach) see only what the athlete allows; by default just that a day is busy, without details.
Medical staff: the medical layer is visible to physios, doctors and, with the athlete's consent, S&C staff. Clinical notes are visible only to physios, doctors and confirmed trainers, and only with the athlete's medical-records consent. Coaches see a status (for example "modified training"), never the clinical details.
Team managers and club admins see what their job needs (logistics, members, roles). Coaches' notes about an athlete are visible to that athlete's coaches, and club staff notes to the club's staff, not to the athlete (the athlete can ask for them under section 11).
ProtocolHQ accesses data only when needed for support you ask for, for security, or when the law requires it.

6 The AI assistant (Ask HQ)

Off until switched on. AI is off for every club and coach until it is switched on for them.
Which AI. We use Google's Gemini models through Google Cloud Vertex AI in the EU (the EU region, or the Netherlands as a back-up). The request, together with the app data needed to answer it (for example the roster or the week's sessions; medical details only for medical staff), is sent there and the answer comes back. Under Google Cloud's terms, Google does not use this data to train its models and processes it on our behalf.
Photos are only passed to the AI if the athlete (or parent) has consented to that.
Looking things up. When you ask for something outside the app (restaurants near the gym, an opponent's results, the route to a game), the assistant asks Google Search or Google Maps. Only the search words go there, and the app refuses searches that contain an athlete's name or health details. Google processes these searches as its own controller under its privacy policy. Weather forecasts come from Open-Meteo (Switzerland), which receives only the place and your device's IP address.
It asks before it acts. The assistant proposes; you decide. You choose per area whether it asks first, acts and tells you, or never acts. Everything it does is logged and can be undone. It makes no decisions about people that have legal or similarly significant effects (Art. 22 GDPR). Anything addressed to people outside the club is only ever a draft for you to send.
AI can be wrong. Check what it suggests, especially for training and health.

7 Children and young athletes

You must be at least 16 to create your own account.
Athletes under 16 can only be added by their club, as part of a team, without an account of their own. The club must have the consent of a parent or guardian. Parents give or refuse consent through a personal link, for training data, health data and AI use of photos separately, and can withdraw it at any time.
For athletes under 18 and in youth teams, direct chat and form-check videos are switched off.
If we learn that a child's data was added without the required consent, we delete it or ask the club to.

8 Service providers and recipients

Google Ireland Limited (Dublin, Ireland), with Google LLC (USA) as sub-processor: Firebase Authentication, Cloud Firestore database, Cloud Storage, Cloud Functions, Firebase Cloud Messaging, Firebase Hosting, App Check and reCAPTCHA Enterprise, and Vertex AI. Under Google's data processing terms (Art. 28 GDPR).
Apple and Google deliver push notifications to your phone (Apple Push Notification service, Firebase Cloud Messaging). They receive the notification text and your device token.
YouTube (Google): if a coach adds a YouTube video, it is loaded from YouTube when you play it, and YouTube receives your IP address and may set cookies under its own privacy policy.
Open-Meteo (Switzerland) for weather, see section 6.
Exports and emails you send yourself (Excel lists, PDFs, mail drafts, WhatsApp links) go wherever you send them; the app doesn't send them for you.
Authorities, only where we are legally obliged to.

9 Where the data is stored

The database, files and the server code that works on them run in Germany (Google Cloud regions Berlin, europe-west10, and Frankfurt, europe-west3). The AI runs in the EU (see section 6).

A few account functions (finding a person by email to connect, creating and deleting accounts, a few team settings) also still run in the USA (Iowa, us-central1), for older versions of the app. When an older app uses them, the email address or the account concerned is processed there. We are removing these once everyone is on the current app. Transfers to Google LLC in the USA are covered by the EU–US Data Privacy Framework (Google LLC is certified) and the EU Standard Contractual Clauses in Google's terms. As a US company, Google can in principle be subject to US authorities' requests; the Framework limits this.

10 How long we keep data

While you use ProtocolHQ, your data is kept so you and your coaches can look back at it.
Deleting your account (in the app, or by emailing us) deletes your profile, sign-in, your own training data, check-ins, health reports you made, messages you are part of, notifications, photos and videos, and hands over club work (for example workouts you built for the club) to your colleagues. Content you published to a club, such as a shared exercise, stays with the club without your personal details.
When you leave a club, the club keeps its copy of your data (availability, reports, staff notes, statistics) for up to 12 months, then it is deleted. We are switching on automatic deletion for this; until then we delete on request and at the latest after 12 months.
Clinical records written by physios or doctors may have to be kept longer under their professional rules (in Germany usually 10 years, § 630f BGB). That is decided by the club and its medical staff.
Data exports you download are deleted from our servers after 7 days.
Backups: we keep database backups for up to 30 days (daily for 7 days, weekly for 30 days) to recover from mistakes or attacks. Deleted data disappears from them within 30 days.
Records of consents and data requests are kept for 3 years to prove them, then deleted.

11 Your rights

Under the GDPR you have the right to:

Access your data and get a copy (Art. 15); in the app, "Download my data" (in your profile settings) gives you a copy yourself.
Correct wrong data (Art. 16) and delete it (Art. 17).
Restrict processing (Art. 18) and take your data with you in a machine-readable format (Art. 20).
Object to processing based on our legitimate interest (Art. 21).
Withdraw consent at any time, for the future (Art. 7(3)), in the app or by email. Processing before the withdrawal stays lawful.
Complain to a data protection supervisory authority (Art. 77), for example the one where you live or work.

Write to overseas.radar@gmail.com. We answer within one month. Where your club is the controller, we forward your request to it and help it answer.

12 Security

Data is encrypted in transit (HTTPS/TLS) and at rest. Access rules are enforced on the server and covered by automated tests; health data is kept in separate layers with their own rules. Only genuine copies of our apps can use the AI and other protected functions (App Check). Passwords are never stored in readable form. Access by our own people is limited to what support and security need. No system is perfectly secure; if a breach puts your data at risk, we and the club will inform the authorities and you as the law requires.

13 Changes to this policy

When the app or the law changes, we update this policy and the date at the top. If a change affects what you have consented to, we ask you again in the app.

14 Contact

✉️

ProtocolHQ privacy

Email overseas.radar@gmail.com for questions, data requests or to delete your account.