Privacy Policy

1. What we collect

We collect the following categories of information:

• Account details — name, email address, password hash, role (carer, provider, administrator), and location.
• Participant intake information — child’s name, date of birth, pronouns, emergency contact, carer relationship.
• Health-related information — diagnoses, allergies, therapy goals, triggers, support preferences, NDIS plan details, payment type.
• Consent records — injury waiver, participation consent, media consent, financial waiver, and the signed name and date of each.
• Communications — messages exchanged between carers, providers and Sense HQ via the in-app inbox; survey responses; feedback submitted through forms.
• Audio recordings (providers only) — short voice debriefs that providers record after a session. The audio is sent to OpenAI’s Whisper service for transcription, then immediately discarded. We never store the audio file — only the resulting encrypted transcription text.
• Course progress — which lessons each provider has completed within the in-app training courses.
• Technical data — IP address, user-agent and session cookie for authentication and security purposes only.

2. Why we collect it

• To deliver the Sense Rugby program safely — coaches and allied health professionals need to understand each participant’s individual sensory, emotional, physical and medical context to adapt sessions appropriately.
• To enable communication between carers and providers (group updates, session feedback, scheduling).
• To process NDIS funding claims and other payment arrangements.
• To train and certify providers via the in-app courses and quizzes.
• To help providers reflect on sessions (the voice-debrief feature) so they can improve programs and identify support gaps.
• To respond to feedback, support requests and contact form submissions.

3. How we store and protect it

• Encryption at rest: all health-related fields (diagnoses, allergies, NDIS details, therapy goals, triggers, support preferences, transcribed debriefs) are encrypted using AES-256-GCM before being written to the database.
• Encryption in transit: all traffic between your device and our servers, and between our servers and any third-party processor, is encrypted with TLS 1.2+.
• Access control: health information is only visible to (a) the participant’s assigned provider team, (b) Sense Team Sports head office staff. Other providers cannot see other providers’ participants.
• Hosting region: our database and application servers are hosted in Sydney, Australia (Neon Postgres + Fly.io Sydney region). Data does not leave Australia for storage purposes.
• Passwords: never stored in plain text. We use bcrypt hashing with industry-standard work factors.

4. Third-party processors

We use a small number of carefully selected service providers to run the platform. Each operates under their own published privacy policies and security commitments:

• Fly.io — application hosting (Sydney region).
• Neon — Postgres database hosting (Sydney region).
• Resend — transactional email delivery (welcome, password reset, contact form).
• OpenAI — used only for transcription of provider voice debriefs via the Whisper API. Audio is transmitted for transcription and is discarded immediately afterwards; OpenAI does not train models on our API traffic.
• Vimeo, Wistia, YouTube — host the training videos embedded inside the in-app courses (no participant data is sent to them).
• Google Play / Apple App Store — distribute the mobile apps. They receive standard install/crash telemetry per their policies; no app-specific personal data is shared.

We do not sell, rent or trade your information to advertisers, marketers or any other third party.

5. Audio recordings

The Sense Sports app includes a microphone-powered voice-debrief feature for providers. When a provider taps Start recording, the captured audio is sent securely to OpenAI Whisper for transcription and is then permanently discarded. We never store the audio file on our servers. Only the resulting text is saved, encrypted at rest, and visible only to the provider who recorded it and Sense HQ.

Carers and participants do not use the recording feature; it is for provider note-taking only.

6. How long we keep your data

We retain account, participant and health information for as long as you have an active enrolment with a Sense Sports provider, plus a period of up to seven years afterwards to meet NDIS, accounting and duty-of-care record-keeping obligations. Voice-debrief transcriptions are retained for as long as the recording provider keeps them; they can be deleted by the provider at any time from within the app.

7. Your rights

You have the right to:

• Access the personal information we hold about you.
• Correct anything that is inaccurate or out of date.
• Request deletion of your account and the data associated with it (subject to legal record-keeping requirements above).
• Withdraw media consent at any time.
• Make a complaint about how we handle your information.

To exercise any of these rights, email hello@senseteamsports.com.au. We aim to respond to all access and deletion requests within 30 days. You can also complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

8. Children’s privacy

Because Sense Sports works with children, much of the personal information we hold is about minors. Participant accounts are managed by a carer (parent or legal guardian). Children do not log into the app directly. Carers consent to data collection on the participant’s behalf during the intake process.

9. Cookies

The web version of the app uses a single, essential cookie to keep you signed in. We do not use third-party analytics, advertising cookies, or tracking pixels.

10. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top will always reflect the most recent version. For significant changes that affect how we use your data, we will notify active users by email before the changes take effect.