Privacy Policy

1. Introduction

[COMPANY NAME], a company registered in Dubai, United Arab Emirates ("Company," "we," "us," or "our"), is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the AthleteOSX platform ("Platform).

This Privacy Policy applies to all users of the Platform, including Athletes and Professionals. By using the Platform, you consent to the data practices described in this policy.

Data Controller: [COMPANY NAME], [Company Address], Dubai, UAE (Company Registration Number: [REGISTRATION NUMBER])

2. Information We Collect

2.1 Information You Provide

Account Information

• Name, email address, phone number
• Date of birth, gender, nationality
• Profile photograph
• Username and password
• Payment information (processed by third-party payment processors)

Athlete-Specific Information

• Sport and position/discipline
• Performance metrics and statistics
• Training data and schedules
• Health and medical information (including injuries, medical history)
• Nutrition and dietary information
• Psychological assessments and reports
• Video and photo content related to performance
• Goals and objectives

Professional-Specific Information

• Professional credentials, certifications, and licenses
• Educational background and qualifications
• Professional experience and specializations
• Business information (tax ID, insurance details)
• Background check results (where applicable)
• Client reports and session notes

Communications

• Messages exchanged through the Platform
• Customer support inquiries and correspondence
• Feedback and survey responses

2.2 Information Collected Automatically

Usage Information

• Pages viewed, features used, time spent on Platform
• Search queries and browsing behavior
• Booking and transaction history
• Interactions with other users

Device and Technical Information

• IP address, browser type, operating system
• Device identifiers and mobile network information
• Cookies and similar tracking technologies
• Log files and error reports

Location Information

• Approximate location based on IP address
• Precise location (if you grant permission)

2.3 Information from Third Parties

• Social media profile information (if you connect accounts)
• Payment processor information
• Background check providers (for Professionals)
• Analytics and advertising partners

3. How We Use Your Information

3.1 Primary Purposes

• Provide Services: Operate the Platform, facilitate connections between Athletes and Professionals, process bookings and payments
• Account Management: Create and maintain your account, authenticate users, provide customer support
• Communication: Send transactional emails, notifications, and updates about your account and services
• Personalization: Customize your experience, recommend Professionals or content
• Analytics: Analyze usage patterns, improve Platform functionality, develop new features
• Safety and Security: Detect and prevent fraud, abuse, and security incidents
• Legal Compliance: Comply with legal obligations, enforce our Terms, protect rights and safety

3.2 Marketing and Advertising

With your consent, we may use your information to:

• Send promotional emails and newsletters
• Display targeted advertisements
• Conduct market research and surveys

You can opt out of marketing communications at any time using the unsubscribe link in emails or through your account settings.

3.3 AI and Machine Learning

We use artificial intelligence and machine learning to:

• Analyze performance data and provide insights
• Generate reports and summaries
• Match Athletes with suitable Professionals
• Detect patterns and predict outcomes

AI processing is conducted in accordance with applicable data protection laws, and you maintain control over your data.

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), UK, and Switzerland, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide services you've requested
• Consent: You have given explicit consent for specific processing activities
• Legitimate Interests: Processing necessary for our legitimate business interests (e.g., fraud prevention, analytics) that don't override your rights
• Legal Obligation: Processing required to comply with legal requirements
• Vital Interests: Processing necessary to protect someone's life or physical safety

For sensitive health data, we rely on your explicit consent and, where applicable, the necessity for healthcare purposes.

5. How We Share Your Information

5.1 With Other Users

Athletes: When you grant access to a Professional, they can view the information you've shared with them, including performance data, health information, and reports.

Professionals: Your profile information is visible to Athletes searching for services. You control what information is publicly displayed.

5.2 Service Providers

We share information with third-party service providers who perform services on our behalf:

• Cloud hosting providers (data storage and processing)
• Payment processors (Stripe, PayPal, etc.)
• Email and communication services
• Analytics and monitoring tools
• Customer support platforms
• Background check providers (for Professionals)

Service providers are contractually obligated to protect your data and use it only for specified purposes.

5.3 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information is transferred and becomes subject to a different privacy policy.

5.4 Legal Requirements

We may disclose your information if required by law or in response to:

• Legal processes (subpoenas, court orders)
• Government or regulatory requests
• Protection of our rights, property, or safety
• Investigation of fraud or security issues
• Emergency situations involving danger to persons

5.5 With Your Consent

We may share your information for other purposes with your explicit consent.

5.6 Aggregated and De-identified Data

We may share aggregated or de-identified data that cannot reasonably be used to identify you for research, analytics, or marketing purposes.

6. International Data Transfers

The Platform operates globally, and your information may be transferred to and processed in countries other than your country of residence, including the United Arab Emirates, United States, and European Union.

When we transfer data internationally, we implement appropriate safeguards, including:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions by relevant data protection authorities
• Binding Corporate Rules
• Your explicit consent

Data transferred to countries outside the EEA may not have the same level of data protection as EEA countries. We take steps to ensure your data receives adequate protection wherever it is processed.

7. Data Security

We implement comprehensive security measures to protect your information:

7.1 Technical Measures

• End-to-end encryption for sensitive data
• Encryption in transit (TLS/SSL) and at rest (AES-256)
• Secure authentication and access controls
• Regular security audits and penetration testing
• Intrusion detection and prevention systems
• Secure backup and disaster recovery procedures

7.2 Organizational Measures

• Limited employee access to personal data (need-to-know basis)
• Confidentiality agreements with employees and contractors
• Security training for staff
• Data protection impact assessments
• Incident response procedures

7.3 Your Responsibility

You are responsible for:

• Maintaining the confidentiality of your password
• Using strong, unique passwords
• Enabling two-factor authentication (when available)
• Promptly reporting any security breaches

Important: No security system is impenetrable. While we strive to protect your data, we cannot guarantee absolute security. You provide information at your own risk.

8. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

8.1 Retention Periods

• Account Data: Retained while your account is active and for 90 days after deletion (to allow account recovery)
• Transaction Records: Retained for 7 years for tax and accounting purposes
• Health Data: Retained while your account is active and for 2 years after deletion (unless you request earlier deletion)
• Communications: Retained for 3 years for customer support and legal purposes
• Marketing Data: Retained until you opt out or for 3 years of inactivity

8.2 Deletion

After retention periods expire, we securely delete or anonymize your data. Some information may be retained in backup systems for up to 90 days after deletion.

9. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

9.1 GDPR Rights (EEA, UK, Switzerland)

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten)
• Right to Restriction: Limit how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for marketing
• Right to Withdraw Consent: Withdraw consent for processing at any time
• Right to Lodge a Complaint: File a complaint with your data protection authority

9.2 California Privacy Rights (CCPA/CPRA)

California residents have additional rights:

• Right to know what personal information is collected, used, and shared
• Right to delete personal information
• Right to opt-out of sale of personal information (we do not sell personal information)
• Right to non-discrimination for exercising privacy rights
• Right to correct inaccurate personal information
• Right to limit use of sensitive personal information

9.3 UAE Data Protection Rights

Under UAE data protection laws, you have rights to access, correct, and delete your personal data, and to object to certain processing activities.

9.4 Exercising Your Rights

To exercise your rights, contact us at privacy@athleteos.com or through your account settings. We will respond within:

• 30 days for GDPR requests
• 45 days for CCPA requests (with possible 45-day extension)
• 30 days for other requests

We may require verification of your identity before processing requests. Some rights may be limited by law or our legitimate interests.

10. Children's Privacy

The Platform is not intended for children under 18. We do not knowingly collect personal information from children under 18 without parental consent.

If a child under 18 wishes to use the Platform, a parent or legal guardian must:

• Create the account on behalf of the child
• Provide consent for data processing
• Supervise the child's use of the Platform
• Accept responsibility for the child's activities

If we discover we have collected information from a child under 18 without proper consent, we will delete it promptly. Parents may contact us at privacy@athleteos.com to review, modify, or delete their child's information.

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience. For detailed information, see our Cookie Policy.

11.1 Types of Cookies We Use

• Essential Cookies: Required for Platform functionality
• Performance Cookies: Analyze how you use the Platform
• Functional Cookies: Remember your preferences
• Advertising Cookies: Deliver relevant advertisements (with consent)

11.2 Managing Cookies

You can control cookies through:

• Our cookie consent banner
• Your browser settings
• Third-party opt-out tools

Disabling cookies may affect Platform functionality.

12. Third-Party Links and Services

The Platform may contain links to third-party websites, applications, or services. We are not responsible for the privacy practices of third parties. We encourage you to review their privacy policies before providing any information.

Third-party services integrated with the Platform (e.g., payment processors, analytics tools) have their own privacy policies. Your use of these services is subject to their terms and policies.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors.

We will notify you of material changes by:

• Posting the updated policy on the Platform with a new "Last Updated date
• Sending an email notification to your registered email address
• Displaying a prominent notice on the Platform

Your continued use of the Platform after changes become effective constitutes acceptance of the updated Privacy Policy. If you do not agree with changes, you should stop using the Platform and delete your account.

14. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

14.1 EU Representative

For users in the European Economic Area, our EU representative is:

14.2 Supervisory Authority

If you are in the EEA and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority.