Privacy Policy
Last updated: 28 July 2026
1. Who is responsible for your data
Pivot ("we", "us") operates the Pivot platform. For platform account data, we act as data controller. For player and squad data processed on behalf of a club (for example a club's session records), the club is the controller and Pivot is a processor acting on the club's instructions. Contact us about anything in this policy at support@pivot-app.co.uk.
2. What we collect
| Category | Examples |
|---|---|
| Account data | Name, email address, role (coach, player, parent), club, date of birth, jersey number, position |
| Health & wellness data | Workout logs, sleep diary, nutrition and hydration logs, daily wellness check-ins (mood, energy, soreness, stress, hydration), injury flags, head impact assessments (HIA), medical conditions and emergency contact details |
| Activity data | Session RSVPs, attendance, messages, feed posts, coach notes and annotations |
| Technical data | Device type, browser, IP address, log and diagnostic information |
Health and medical information is special category data under UK GDPR. We process it only with explicit consent, gathered per data type during sign-up and changeable at any time in your consent settings.
3. How we use your data
- To provide the Service: squad dashboards, wellness baselines, session scheduling, messaging and coaching-content delivery.
- To surface safety alerts: injury flags, HIA protocol notifications and missed check-ins, sent to consented coaches, physios and — for under-18s — linked parents or guardians.
- To operate, secure and improve the platform, including aggregated and de-identified analytics.
- To communicate with you about your account, and (with your permission) about product updates.
We do not sell personal data, and we do not use athlete health data for advertising.
4. Consent — how visibility works
- Players choose exactly what each category of staff can see, per data type. For example, a player can share workout and sleep data but keep medical information private.
- Revoking consent takes effect immediately and is enforced at the database layer (row-level security), not just in the interface.
- For players under 18, a parent or guardian provides co-consent, and parent account links must be approved by the club coach. The player retains control over what a linked parent can see.
- Every consent change and data access event is recorded in an audit log.
5. Legal bases
- Contract — to provide the Service you or your club signed up for.
- Explicit consent — for all health and wellness (special category) data.
- Legitimate interests — service security, fraud prevention and product improvement using aggregated data.
- Legal obligation — where we must retain or disclose information by law, or where clubs must maintain safeguarding and duty-of-care records.
6. Who we share data with
- Your club— the staff members you've consented to, according to your settings.
- Linked parents / guardians — for under-18s, per the consent flow above.
- Service providers — hosting and infrastructure providers (including our database provider), email delivery and error monitoring, under data processing agreements.
- Video platforms — if your club embeds Veo or Hudl footage, those platforms process video under their own policies; Pivot stores only the embed reference and annotations.
7. Security
All data is encrypted with AES-256 at rest and TLS 1.3 in transit. Data visibility is enforced server-side with row-level security. Coaching content is served via expiring signed URLs with export, copy and share disabled at the API level. Access to production systems is restricted and logged.
8. Deleting your account and data
We keep personal data while your account is active. You can close your account yourself at any time, from any device: go to Settings → Privacy & access → Delete my account. It takes effect immediately — your sign-in is closed permanently and your name, photo, profile, club memberships and device notification tokens are removed.
There is one exception, and the app tells you if it applies to you: if you are the only administrator of a club, you need to make someone else an administrator first, otherwise that club would be left with nobody able to manage its players or respond to a safeguarding matter.
You can also email support@pivot-app.co.uk from the address on your account if you would rather we did it, or if you want a copy of your data first.
Whether you delete the account yourself or ask us to, we delete or anonymise your profile, contact details, health and wellness logs, activity data, messages and uploaded media within 90 days. Some records — safeguarding concerns, injury and head-impact-assessment (HIA) entries, and the consent and access audit log — may be retained for longer where a club or Pivot must meet a legal, safeguarding or governing-body obligation, or must retain records to defend a legal claim. Where this applies, we keep only what that obligation requires.
9. Your rights
Under UK GDPR you can ask us to access, correct, export, delete or restrict the processing of your personal data, and you can object to processing based on legitimate interests. Players can export the data they've logged at any time. To exercise any right, email support@pivot-app.co.uk. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
10. International transfers
We aim to store data in the UK/EEA. Where a service provider processes data outside the UK, we rely on adequacy decisions or the UK International Data Transfer Agreement / EU Standard Contractual Clauses.
11. Children
Pivot supports under-18 players only through club-managed sign-up with parent or guardian co-consent. We do not knowingly allow children to create standalone accounts outside this flow.
12. Changes to this policy
We'll notify account holders of material changes by email or in-app notice before they take effect.
← Back to homepage