Privacy Policy

Effective date: 7 June 2026  ·  Version 3.0 (English)

1. Data Controller

The data controller responsible for the processing of your personal data through the VolleyScreen platform is:

Data Protection Officer (DPO):
Miguel Ambrósio Neto
Email: privacy@volleyscreen.com

For users located in the European Union or the European Economic Area, Physio Education acts as data controller in the meaning of Article 4(7) of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"). For users located in Brazil, Physio Education acts as the "controlador" in the meaning of Article 5(VI) of the Lei Geral de Proteção de Dados Pessoais (Law 13.709/2018, "LGPD").

2. What is VolleyScreen

VolleyScreen is a software-as-a-service platform for sports performance and clinical monitoring of volleyball athletes. It is intended for use by qualified clinical professionals (physiotherapists, sports physicians, sports scientists) employed by or contracted with sports organisations (clubs, federations, academic institutions). Athletes whose data is processed by the platform do so with the knowledge and informed consent of those professionals, mediated by this Policy.

3. Categories of Personal Data Processed

The platform processes the following categories of personal data, organised by purpose:

(a) Identification data: full name, date of birth, sex assigned at birth, nationality, photograph (optional), contact telephone or email if provided by the athlete.

(b) Anthropometric data: height, weight, body composition.

(c) Sport-specific data: position, dominance (limb), competitive category, years of experience.

(d) Training load data: subjective effort scores (RPE), session duration, training type, jump counts and characteristics.

(e) Wellness data (subjective): self-reported fatigue, muscle soreness, sleep quality, stress, mood (Hooper-Mackinnon scale and equivalents).

(f) Clinical data — health-sensitive: injuries (typology, location, mechanism, severity, recovery, OSIICS clinical coding), pain episodes (onset, duration, chronicity, biopsychosocial follow-up), pain complaints, medical treatments received, applied clinical and psychometric questionnaires (such as OSTRC-H2 and the Athlete Burnout Questionnaire, ABQ), and — for female athletes who choose to record it — menstrual cycle data; clinical notes by the responsible professional.

(g) Wearable device data: when the athlete authorises connection of a wearable device (Polar, Oura, Garmin), data may include resting heart rate, heart rate variability (RMSSD), total sleep duration, sleep efficiency, blood oxygen saturation (SpO2), step count.

(g-bis) Push notification tokens: device push tokens, when the athlete enables reminders in the app (PWA).

(h) Authentication data: email address, password (stored as a one-way hash), session tokens.

(i) Usage data: pages accessed, features used, IP address, browser fingerprint, language and timezone preferences.

(j) Consent records: evidence of consent given, date, version of the policy accepted, IP address at the moment of acceptance.

Categories (e), (f) and (g) are classified as sensitive personal data under Article 9 GDPR and Article 11 LGPD and are subject to additional safeguards.

4. Purposes of Processing

The personal data described in Section 3 is processed exclusively for the following purposes:

Primary purposes (always active when an athlete is registered):

• Clinical documentation and continuity of care
• Athletic performance monitoring at the individual level
• Detection of deviations from each athlete's personal baseline (not predictive classification — see Section 8)
• Communication between qualified clinical professionals supporting the same athlete
• Compliance with legal obligations applicable to the controller

Secondary purposes (subject to separate, explicit consent):

• Anonymous statistical analysis for product improvement
• Pseudonymised scientific research, subject to ethical review
• Communication with sports federations, when applicable

5. Legal Basis for Processing

The processing of personal data described in this Policy is based on:

(a) Explicit consent of the athlete (or legal guardian, when the athlete is a minor), recorded electronically through the consent modal of the platform. The athlete may withdraw consent at any time by emailing the DPO at the address in Section 1, with no impact on the lawfulness of processing prior to withdrawal.

(b) Performance of a contract between the athlete and the sports organisation that uses VolleyScreen, when applicable.

(c) Legitimate interest of the controller for security logs, fraud prevention, and improvement of the platform — limited to non-sensitive data and balanced against the rights of the data subject.

For sensitive data (Section 3.e, 3.f, 3.g), the legal basis is exclusively explicit consent in the meaning of Article 9(2)(a) GDPR and Article 11(I) LGPD.

6. Recipients and Processors

Personal data may be shared with the following categories of recipients, under written data processing agreements:

(a) Infrastructure processors:

• Supabase Inc. (database, authentication, file storage) — region: Brazil (São Paulo).
• Vercel Inc. (frontend and API hosting) — serving the canonical host www.volleyscreen.com.
• Resend (transactional email delivery).

(b) Payment processor:

• Asaas (Brazil) — for annual licence billing. Asaas receives only billing identifiers, never clinical data.

(c) Wearable device APIs (when authorised by the athlete):

• Polar Electro Oy (Finland) — Polar Accesslink API for synchronisation of Polar device data.
• Ouraring Inc. (United States) — Oura API v2 for synchronisation of Oura Ring data. Data transferred under Standard Contractual Clauses (Article 46 GDPR and Article 33 LGPD).

(d) AI processor (limited use):

• Anthropic PBC (United States) — for natural language processing features (clinical note summarisation, translation). Personal identifiers are pseudonymised before transmission. Anthropic's data retention is contractually limited to 30 days. Data transferred under Standard Contractual Clauses (Article 46 GDPR and Article 33 LGPD).

(e) Other recipients: sports organisations and clinical professionals explicitly designated by the athlete during onboarding.

VolleyScreen does not sell personal data to third parties under any circumstances.

7. International Data Transfers

Personal data is primarily stored in Brazil (São Paulo). Certain processors operate outside Brazil — the United States (Anthropic, Oura) and Finland (Polar). Payment processing is domestic (Asaas, Brazil). Transfers to these processors are based on:

• Standard Contractual Clauses (SCCs) under Article 46 GDPR and Article 33 LGPD;
• The athlete's explicit consent for the specific transfer of health-sensitive data;
• Pseudonymisation of direct identifiers before any transmission to the AI processor.

8. Automated Decision-Making

VolleyScreen presents visual signals (coloured indicators on the dashboard) that result from processing of the categories of data described in Section 3.

The athlete may at any time request that the responsible professional explain in detail any signal generated by the platform, and may request human review of any decision in which the platform's output played a role.

9. Data Retention

Personal data is retained for the following periods:

• Active athletes: for the duration of the athlete's relationship with the controlling sports organisation, plus 10 years after the last interaction — to comply with clinical record-keeping obligations applicable in Brazil (CFM Resolution 1.821/2007) and Europe.
• Withdrawn consent: within 30 days of consent withdrawal, all sensitive clinical data is anonymised or deleted, except where retention is required by law (in which case it is locked, no longer used, and deleted at the legal expiry).
• Wearable tokens (OAuth): retained while the athlete is active and the connection is authorised; deleted within 7 days of disconnection.
• Authentication and usage logs: 24 months for security purposes.

10. Data Subject Rights

Under GDPR (Articles 15–22) and LGPD (Article 18), the athlete has the right to:

1. Confirm the existence of processing
2. Access the personal data being processed
3. Rectify incomplete, inaccurate, or outdated data
4. Anonymise, block, or delete unnecessary or excessive data
5. Receive a portable copy of the data in a machine-readable format, and carry it to another club — the Career Passport (LGPD Art. 18-V): an export initiated and consented by the athlete, addressed to a named recipient. For minor athletes, issuance is assisted by the club with the legal guardian's authorization (Art. 14).
6. Withdraw consent at any time
7. Object to processing based on legitimate interest
8. Be informed of recipients with whom the data has been shared
9. Lodge a complaint with the supervisory authority (in Brazil: ANPD; in the European Union: the national Data Protection Authority of the athlete's country of residence)

To exercise any of these rights, contact the DPO at the address in Section 1. Response is provided within 15 days for LGPD requests and within 30 days for GDPR requests.

11. Minors

For athletes under the age of 18 (or the age of digital consent in the athlete's country of residence, whichever is higher), processing requires explicit consent from the legal guardian, in addition to age-appropriate information for the athlete. The platform does not process data of athletes under 12 years of age under any circumstances.

12. Security Measures

The controller has implemented the following technical and organisational measures:

• Encryption at rest (AES-256) and in transit (TLS 1.3)
• Row-level security (RLS) on all database tables
• Multi-factor authentication for clinical professionals
• Role-based access control
• Audit logs of access to sensitive clinical data (read-access logging on clinical routes)
• Pseudonymisation when data is sent to AI processors
• Regular vulnerability assessments

In the event of a personal data breach, the controller will notify the supervisory authority within 72 hours of becoming aware of it, and the affected data subjects without undue delay, in accordance with Articles 33–34 GDPR and Article 48 LGPD.

13. Updates to this Policy

This Policy may be updated from time to time. Material changes will be communicated to all active athletes through the platform with at least 30 days of notice. Continued use of the platform after the notice period constitutes acceptance of the updated Policy. Athletes who do not accept may withdraw consent under Section 10(f).

14. Governing Law and Jurisdiction

This Policy is governed by the law of Brazil (Lei Geral de Proteção de Dados Pessoais, Law 13.709/2018) for users in Brazil, and by the General Data Protection Regulation (Regulation (EU) 2016/679) for users in the European Union and European Economic Area.

For disputes arising in Brazil, the competent forum is the District of Jacareí, São Paulo. For disputes arising in the European Union, the forum of the data subject's country of residence applies.