Privacy Policy - Elite Football Lab App

1. Data controller & contact

The controller of your personal data is Elite Lab, obrt za usluge, vl. Saša Kanazir (a Croatian sole-proprietor business / obrt), OIB 86072241501, MBO 98752120, registered seat Poljana Josipa Brunšmida 6, 10110 Zagreb, Croatia (referred to as "we", "us" or the "controller"). We operate the Elite Football Lab brand and the elitefootballlab.org domain.

For any question about data protection or to exercise your rights, contact us at [email protected] or via WhatsApp at +385 95 874 1708.

2. Scope & who this covers

This policy applies to the Elite Football Lab mobile app for iOS and Android. The app is a youth-football development tool used in three roles:

• Coach (trainer) - registers with name, e-mail and password; creates a trainer code and manages their players and teams.
• Parent / guardian - signs in with the player's identifier and a PIN set by the coach, to view their child's data.
• Player - typically a minor; signs in with first name, last name and the coach's trainer code, and records profile, wellness and performance data.

The app connects to our own backend server (hosted on Railway) which stores accounts and player data. It also integrates with Apple / Google, Apple Health, optional wearables and the third parties listed in section 9. We do not use any advertising, tracking or marketing-analytics SDKs, and we do not sell your data.

3. Categories of personal data we collect

Several of these categories concern minors and include health data, which is a special category under Article 9 of the GDPR and is treated with particular care.

4. Apple Health / HealthKit & Google Health Connect

With your explicit permission, the app reads the following data from Apple Health (HealthKit) on iOS or Google Health Connect on Android, to help track fitness and recovery:

• Steps, heart rate, resting heart rate, heart-rate variability (HRV), sleep and body weight.

5. Connected wearables (WHOOP, Polar)

Optionally, and only if you choose to connect them, the app can link to wearable services through their official authorisation (OAuth) flows to import training and recovery data:

• WHOOP - recovery, sleep, cycles and workout data (read-only scopes).
• Polar (Accesslink) - training, activity and sleep data.

Access tokens for these services are held on your device; our server acts only as a secure broker for the authorisation exchange and does not store your wearable login. The daily metrics we derive (e.g. resting HR, HRV, sleep, recovery score) are stored with your player record so the app can track trends. Data from other devices (e.g. Garmin) can reach the app only if you first route it into Apple Health / Health Connect. You can disconnect a wearable at any time in the app.

6. Purposes & legal bases

Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

7. Subscriptions & in-app purchases

The app offers auto-renewing subscriptions (Plus and Pro tiers, monthly and yearly). Purchases are processed by Apple (App Store) and, on Android, Google Play. We use RevenueCat to manage entitlements: RevenueCat receives a pseudonymous app user identifier and your purchase / entitlement status so the app can unlock the tier you bought and restore purchases.

8. Automated analysis & AI transparency

To produce a player's report, the app uses automated analysis - an AI system provided by Anthropic PBC, United States, acting as our processor under a data-processing agreement - of the data and media you provide, such as posture photos, sprint-video frames, isokinetic test data and anthropometric values, to assess movement quality, identify physical deficits and generate a training or nutrition plan. Children's health and image data are transmitted to this US processor for that purpose (see sections 9-10).

9. Recipients & processors

We do not sell your data or share it for third-party marketing. Data is processed only by trusted service providers that help us run the app, under Article 28 GDPR data-processing agreements:

Where relevant we also comply with Croatian legal obligations (e.g. accounting for purchases).

10. International transfers

Some processors are located in the United States. We rely on the following safeguards under Chapter V GDPR:

• Data Privacy Framework (Commission adequacy decision (EU) 2023/1795) for DPF-certified recipients - currently Expo (650 Industries, Inc.);
• Standard Contractual Clauses (Commission Decision (EU) 2021/914, Art. 46(2)(c)), with supplementary measures, for the other US recipients - Apple, Anthropic, RevenueCat, Railway and WHOOP.

Sentry (Germany) and Polar (Finland) process within the EEA, so no transfer mechanism is required. You may request a free copy of the Standard Contractual Clauses or other safeguards at [email protected].

11. Data retention

We keep personal data only as long as needed for the purpose it was collected for:

After the applicable period, data is permanently deleted or anonymised.

12. Children's data & parental consent

• Parental consent is specific, informed and demonstrable, and we take reasonable steps to verify the consenting person's parental authority (Art. 8(2) GDPR). [Confirm the exact consent flow with your lawyer.]
• A child's data is used only to provide the service (analysis, plans, progress) and is never published or shared for other purposes.
• A parent can request access to, correction of, or deletion of the child's data at any time (see sections 13-14).

13. Your rights

In relation to your own data, and a child's data, you have the right to:

• Access - be told what we process and receive a copy.
• Rectification of inaccurate or incomplete data.
• Erasure ("right to be forgotten").
• Restriction of processing.
• Objection to processing based on legitimate interest.
• Data portability.
• Withdraw consent at any time, without affecting prior lawful processing.

To exercise any right, contact [email protected]. We respond within the statutory time limit (as a rule one month).

14. Deleting your account & data

You can request deletion of your account and associated data directly in the app, or by e-mailing [email protected]. On deletion we remove your account record, uploaded media and player analyses from our systems (subject to any data we must retain for legal / accounting reasons). This satisfies Apple's account-deletion requirement (App Store Guideline 5.1.1(v)).

15. Security

We apply appropriate technical and organisational measures: data is transmitted over encrypted (TLS) connections; passwords are stored only as salted PBKDF2 hashes; access is restricted and authenticated with signed session tokens; wearable tokens and sensitive on-device data are held in the platform's encrypted secure storage; and our crash-monitoring is configured to strip personal identifiers, IP address and device name before any report is sent - with particular care because our users include minors. We also maintain records of processing and carry out data protection impact assessments where required (Art. 30 and Art. 35 GDPR).

16. Push notifications

If you allow notifications, we register a push token (via Apple / Expo push services) to send training and wellness reminders and coach messages. You can turn notifications off at any time in the app or your device settings.

17. Changes to this policy

We may update this policy as the app evolves. The version number and effective date at the top of this page indicate the current version; material changes will be communicated in the app or by e-mail where appropriate.

18. Contact & supervisory authority

Data-protection contact: [email protected] · WhatsApp +385 95 874 1708

If you believe our processing breaches data-protection law, you have the right to lodge a complaint with the supervisory authority (Art. 77 GDPR):