Privacy notice

1. Who we are

PerfHQ is a trading name of PerfHQ LTD, a company registered in England and Wales under company number 17471470.

The data controller is PerfHQ LTD. Our registered office, which is also our address for service, is 167-169 Great Portland Street, 5th Floor, London, W1W 5PF. The way to reach us about anything in this notice — including any request about your own data — is privacy@perfhq.com. We answer to that address, and it is faster than the post. For help with the app rather than your data, use support@perfhq.com.

This notice sits alongside two others: the Data processing addendum, which is the contract term set for organisations that use PerfHQ to coach athletes; and the Safeguarding and media consent policy, which is the one to read if you are a parent or a safeguarding lead. What is stored on your device is section 6a, and how long each kind of record is kept is section 8 — both used to be separate documents and are now here, because the answer to "what do you hold about me, and for how long" should be in one place.

2. Our role, and your organisation's role

PerfHQ is supplied to sports coaching organisations. When your academy or club uses PerfHQ to coach athletes, two different responsibilities apply, and it matters which one is which.

Certain duties stay with us regardless of any contract: keeping the service secure, telling your organisation about a breach, and answering for the providers we rely on. You may also bring a claim directly against us.

One thing does not divide as cleanly as the above suggests, and you should know it. The notes a coach writes about an athlete are currently attached to the athlete rather than to the organisation the coach belongs to. If a person trains at two organisations that both use PerfHQ, coaching staff at either can see notes written at the other. Medical notes and emergency contacts are shared across organisations by design, as described above; coach notes are shared as a consequence of how the data is structured, which is not the same thing. We are naming it rather than letting the paragraph above imply a separation that is not there.

3. What data we handle

Sign-in records. Every sign-in attempt is recorded with the time, whether it succeeded, the IP address it came from, and the device or browser. For an active session we also store an approximate city and a two-letter country code, which our network provider derives from that IP address at the edge. That is an inference from the network rather than a location reading, we do not send your IP address to a geolocation service to obtain it, and the city is often absent: the app itself never asks for location permission and does not collect your device's location.

Device identifier. The app generates its own identifier for your installation and sends it with each request, so that you can see and sign out individual devices. It is created by the app rather than taken from the operating system, and it identifies the installation, not you. It is held in the device keychain, which means it survives the app being deleted and reinstalled.

Error reports from the web application. If something goes wrong in the browser version of PerfHQ at portal.perfhq.com, the page sends us an automatic report containing the error message, the technical stack trace, the address of the page you were on, and your browser's user-agent string. These reports are sent without a sign-in attached and we do not use them to build a profile of you; they exist so that a fault nobody reported still reaches us. The iOS app does not do this — see section 6.

Support requests. When you contact support from within the app we include the platform, the app version and your device model, so that we are not guessing about what you were using.

4. Children

PerfHQ holds health information about children, some of whom are under 13 and many of whom have no email address of their own. We treat a breach of this data as a safeguarding matter rather than a technical one.

Accounts for children are created by the organisation, not by the child signing up. There is no way to register for PerfHQ from the app or from this website. A parent or guardian is linked to the child's record for a specific organisation, which is what allows them to see and manage that child's profile, medical information and emergency contacts. That link ends automatically when the child turns 18.

Your organisation is responsible for obtaining consent from parents and guardians before entering a child's information, and for deciding which of its coaches may see sensitive records.

Two limits of the software, stated plainly. Both matter to a parent or a safeguarding lead, and neither is obvious from using the product.

• Photography and video consent is recorded, but the camera does not enforce it everywhere. PerfHQ stores a media consent decision against each athlete, and the trackside Capture camera refuses to record an athlete whose consent has been withdrawn. That check is not applied at every route by which a photograph or video can reach the system, and an athlete with no consent recorded at all is treated as permitted rather than refused. So the presence of a consent record is a reliable way to stop capture in Capture, and the absence of one is not a guarantee that nothing will be recorded. An organisation that needs consent enforced must still manage it as a policy matter and not rely on the software alone.
• Guardian access cannot be ended early. A guardian link ends automatically on the child's eighteenth birthday, and the software honours a revocation the moment one is recorded — but there is currently no way for an organisation or a parent to record one. If a guardian's access must be removed before the child turns 18, email privacy@perfhq.com and we will do it by hand. If it is a safeguarding matter, use safety@perfhq.com and say so.

The Safeguarding and media consent policy sets out both of these in full, along with who can see what.

5. What we do not do

We do not use your data to train machine learning models. Body-tracking data, video and coaching records are not used to train any model, ours or anyone else's. If that ever changes it will require a new version of this notice, an explicit opt-in that is off by default, and your active agreement. We are not reserving the right to do it quietly.

We do not sell or rent personal data. We do not use it for advertising or profiling. We do not track you across other websites or apps. We run no product analytics: nothing in the app or the web application reports what you tapped, how long you stayed, or which screens you visited.

One word needs care, because it appears in the product in a different sense. PerfHQ has a performance analytics feature — trends, leaderboards and heatmaps built from assessment scores a coach entered. That is coaching data about an athlete's performance. It is not behavioural tracking, and it goes to no one outside your organisation.

6. The app on your device

What the app asks permission for

The iOS app asks for six permissions, each only when you first use the feature that needs it:

Two of those six are for features that are switched off in the current release: signing in with Face ID, and the depth-aware capture that uses the motion sensors. The permissions are declared because the code that needs them ships, but you will not be asked for either until the features are turned on.

What it never asks for

The app does not request your location, your contacts, your calendar, health data from Apple Health, or permission to track you. It does not use push notifications — it has no capability to receive them, so it will never ask.

It contains no third-party code

There is no analytics, advertising, crash-reporting or tracking library in the PerfHQ app. It has no external code dependencies at all. Apple's App Tracking Transparency prompt never appears because there is nothing to ask about.

The app also sends no automatic diagnostic or crash reports. The version and device details support asks for are assembled only when you tap to copy them or to email us, and they go nowhere until you send them. (The web application at portal.perfhq.com does send automatic error reports; that is described in section 3.)

Movement analysis

Movement analysis — extracting skeletal joint positions and depth from a recording, and measuring a golf swing from them — is computed entirely on your device using Apple's Vision and ARKit frameworks. Because the app has no third-party code in it, no body-tracking data is shared with any external analytics or machine learning provider.

The results are stored with the recording they came from. When a coach analyses a video's skeleton or golf swing, the result is uploaded to our storage next to that video, so it does not have to be worked out again every time the video is opened. When a recording is made with the app's depth (LiDAR) recorder, the depth, joint, audio and session files it produces are uploaded alongside its video in the same way. These uploads follow the app's Wi-Fi and mobile-data setting, exactly as the video's own upload does.

These files follow the video they belong to. They can be read only by people who are already allowed to watch that video, they count towards the organisation's storage, and they are moved to the trash, purged and erased with it (section 8). Only the person who uploaded the video, or someone the organisation allows to edit all media, can store or replace them.

6a. What is stored on your device and in your browser

PerfHQ sets no cookies. Not on this website, not in the web application, and not from our API. There is no analytics cookie, no advertising cookie, no third-party pixel and no consent banner, because there is nothing to consent to.

That is unusual enough to be worth being specific about rather than leaving you to take on trust. The regulation that governs this in the UK — the Privacy and Electronic Communications Regulations 2003, regulation 6 — covers anything stored on or read from your device, not only cookies. Every item below is exempt from the consent requirement because it is strictly necessary to provide the service you asked for. We are listing it anyway.

The web application

portal.perfhq.com stores the following in your browser's local storage and session storage. All of it stays in your browser and is readable only by the PerfHQ application itself.

Signing out removes the sign-in items. The appearance and layout preferences are kept, because losing them every time you sign out would be a worse experience and they identify nobody.

A note on service workers. The web application registers a service worker whose only job is to delete any cache left behind by an earlier version of the site and then unregister itself. It stores nothing and does not persist.

The iOS app

The app uses no cookies and no browser storage. It stores:

• Sign-in tokens in the iOS Keychain, marked available only after the device has been unlocked and only on that device — which keeps them out of iCloud Keychain and out of encrypted backups. If you turn on Face ID sign-in, that is held in a separate Keychain entry which is invalidated automatically if the faces or fingerprints enrolled on your device change.
• An installation identifier, generated by the app itself rather than taken from the operating system, in the same Keychain. It is sent with each request so that you can see and sign out individual devices. Because it lives in the Keychain, it survives the app being deleted and reinstalled.
• Captured video and photos, and the drawings and analysis attached to them, on the device until they upload. These are excluded from device backups, and removing the app removes them.
• Appearance and feature preferences, in the app's own settings storage.

None of it is shared with anyone, and the app contains no third-party code that could read it.

Clearing it

You can clear browser storage for portal.perfhq.com from your browser's site settings, usually under "Cookies and site data". Doing so signs you out and resets your appearance preferences; it does not delete anything held on our servers.

On iOS, deleting the app removes everything it stored on the device, including the installation identifier and any captures that had not yet uploaded.

Neither of those deletes your PerfHQ account. To do that, see section 10.

If we ever introduce a cookie, or any storage that is not strictly necessary, we will update this section and ask for your consent before setting it — in that order.

7. Where your data is stored

We use a small number of providers to run the service. We do not use any advertising or analytics networks.

We cannot yet state that all personal data remains within the UK or EEA, because the items above marked as unconfirmed or global are exactly that. We would rather say so than imply a guarantee we have not verified.

The same list, with the detail an organisation's data protection officer will want, is in the Data processing addendum.

8. How long we keep things

Every period below is written against the sweeps the software actually runs, not against an intention, and was taken from the code rather than from a policy document. Each row is marked with how the period is enforced, because that difference matters more than the number:

The retention sweeps run once every 24 hours, so a record is removed within a day of its period expiring rather than at the instant it does.

Accounts and sign-in

Sign-in records are the most privacy-sensitive routine data the service holds, because they contain IP addresses and a record of when you were active. 90 days is long enough to investigate a compromise and short enough that it is not a history of your movements.

Health and emergency information

Deleting an account deletes this data rather than anonymising it. A consent record keeps a frozen copy of the name of the person who gave it, so that a guardian who consented on a child's behalf stays identifiable afterwards; that is deliberate, because a consent decision nobody can attribute is not much of a record.

Coaching records

These are the records erasure cannot always fully remove. Where a coaching record cannot be deleted because performance data depends on it, the internal reference is kept and the identity is detached from it, so the record no longer resolves to a person. Section 10 sets that out.

Photographs, video and audio

The first row is the one to act on. Footage of children does not expire on its own. An organisation that wants media deleted after a season, or after a member leaves, must configure a retention period; nothing will happen until it does. Trashed items still occupy storage and still count towards a quota until the 30-day purge runs. An organisation can set its own media retention period from the organisation settings, and should.

Technical and operational records

The last two rows are worth explaining, because they are the ones that bear on erasure. The change-audit trail records both what changed and who changed it. The previous values are cleared after 13 months, which is a season and the tail of one — long enough for "what did that note say before it was edited" to be a live question. The fact of the change is kept for seven years, which is the ordinary retention period for organisational records about children and the horizon over which a complaint about something that happened in a session can still arrive.

When an account is erased we do not wait for either period. The previous values of every entry about that person are cleared immediately, and the entry's link to them is removed. What survives is that a change happened, by whom and when — deliberately, because a record of who did what to a child's data is the thing an investigation needs and is not information about the erased person. Neither of those periods is settable below 90 days.

Backups

Database backups are taken automatically and stored in separate object storage. A backup is a point-in-time copy of the whole database, so data deleted from the live system persists in backups taken before the deletion until those backups age out.

That is normal, and it is also the honest answer to "is it really gone". Erasure is applied to the live system immediately; backups are not rewritten, because a rewritable backup is not a backup. We do not restore a backup in order to recover data a person asked us to delete. A full restore from backup has not yet been rehearsed.

When an account or an organisation ends

When you delete your account, the data marked On request above is deleted, subject to the limits in the coaching-records and technical-records tables. Section 10 sets out exactly what goes and what stays.

When you leave one organisation, that organisation's data about you is removed and your account and any other membership are untouched.

When an organisation stops using PerfHQ, its data is dealt with under section 10 of the Data processing addendum. Ask for a copy before terminating — deletion is not reversible and support cannot restore it.

9. Your rights

Under UK GDPR you have the right to access your data, correct it, ask for it to be erased, restrict or object to how it is used, and ask for a copy in a portable format. You can also complain to the Information Commissioner's Office at ico.org.uk, and we would ask that you raise it with us first so we have a chance to fix it.

For coaching records, ask your organisation first — it decides what is held. For your account, identity and health information, contact us at privacy@perfhq.com. A parent or guardian linked to a child may exercise these rights on the child's behalf.

We will respond within one month. Some of these requests currently need manual work on our side rather than a button in the app, and the next section explains where that is the case.

10. Deleting your account, or getting a copy of your data

You can delete your account from within the app, under Account settings. You can also email privacy@perfhq.com from the address on your account and we will action it. If you are a parent asking on behalf of a child, tell us which child and which organisation.

There are three separate things you can do, and they are not the same:

• Leave one organisation — removes that organisation's data about you, and leaves your account and any other organisation intact.
• Delete your account — removes your account and your data at every organisation.
• Delete a child you look after — available to a linked guardian, and confirmed with your own password.

If you are the only administrator of an organisation we will refuse the request and tell you which organisations are blocking it, so that you can hand over first. That is deliberate: the alternative is an organisation nobody can administer.

10a. Reporting content, and moderation

Anything in PerfHQ can be reported, by anyone who can see it, from the menu on that content. Reporting takes a few seconds and needs no permission. When you report something it is hidden from you immediately — you do not have to keep looking at it while it is reviewed.

Reports of objectionable content are acted on within 24 hours. Administrators at the relevant organisation are notified when a report is filed; PerfHQ staff see every organisation's outstanding reports and step in where an organisation does not act.

Free text is checked automatically against a prohibited-terms list before it is stored. Administrators and coaches can block a member from their organisation, which removes that person's access to it and hides everything they posted there.

The rules are set out in the Acceptable Use Policy. For safeguarding concerns, email safety@perfhq.com; if a child is at immediate risk, contact the police first.

11. Security

Passwords are stored using Argon2id and are never recoverable in readable form. Session and reset tokens are stored only as cryptographic digests, so a copy of our database yields no usable session. Two-factor secrets are encrypted with AES-256-GCM. Access to sensitive records is controlled by permissions, so a coach sees only what their role allows, and medical and emergency information is restricted further. All traffic is encrypted in transit. Access to the servers themselves is restricted to a private network.

We do not currently apply our own encryption at rest on top of what our hosting provider offers. We think it is more useful to tell you that than to describe our security in general terms that sound stronger than they are. In the same spirit: our database backups are taken automatically, and a full restore from them has not yet been rehearsed.

If a breach occurs that is likely to result in a risk to people, we will notify the ICO within 72 hours and tell affected organisations without undue delay.

12. Changes to this notice

If we change this notice materially we will update the date at the top and tell organisation administrators. If a change affects how we use data you have already given us — rather than simply describing something more clearly — we will ask you to agree to it rather than relying on your continued use of the service.

13. Contact

PerfHQ LTD (company number 17471470), 167-169 Great Portland Street, 5th Floor, London, W1W 5PF. Email privacy@perfhq.com. This is the contact point for access, correction, erasure and any other request under this notice, and it is monitored. For help with the app rather than your data, email support@perfhq.com. For safeguarding and abuse, email safety@perfhq.com.

You can also complain to the Information Commissioner's Office at ico.org.uk.