Privacy Policy
Data Controller: Inovitus 9 d.o.o., Slovenia | Effective Date: March 1, 2026 | Version: 1.0
This Privacy Policy explains how Sport99, operated by Inovitus 9 d.o.o., collects, uses, and protects the personal data of athletes, coaches, club administrators, and other users — including data from connected wearable devices and third-party fitness services. Sport99 is built for GDPR compliance, with special care for health data under Article 9 of the GDPR.
1. Data Controller
The data controller for personal data processed through Sport99 is:
Sport99 is a product of Inovitus 9 d.o.o. and is operated entirely within the European Union. Our supervisory authority is the Information Commissioner of the Republic of Slovenia. ip-rs.si
2. Personal Data We Collect
Account & Profile Data
Name, email address, optional phone number, date of birth, sport type, club affiliation, role, and profile photo.
Usage Data
Log files, anonymised IP address after session, browser type, and actions taken within the platform for security, debugging, and service improvement.
Training & Performance Data
Attendance records, coach training notes, AI-generated performance summaries with consent, injury records, and benchmark results.
Payment & Billing Data
Club billing information including legal entity name, VAT number, and payment method via Stripe. We do not store full card numbers.
3. Wearable & Activity Data
With your explicit consent, Sport99 can connect to third-party fitness platforms and wearable providers to import athlete health and activity data:
No advertising use: We never use wearable or health data for advertising, marketing profiling, or commercial targeting.
No training of AI models: We do not use your wearable data to train AI or machine learning models for other clubs or users outside your club context.
No sale or disclosure: We do not sell, rent, or share wearable data with data brokers, advertisers, insurers, or unauthorized third parties.
Scope-limited AI access: When AI features use wearable data, the AI system is restricted to the requesting athlete’s data only.
Disconnection: You can disconnect any wearable integration from your dashboard. Sport99 revokes the OAuth token and stops ingesting new data.
4. How We Use Personal Data
Providing the Service
To operate athlete profiles, calculate readiness and recovery scores, generate training records, and enable coaching tools.
AI-Assisted Insights (consent required)
With explicit consent, wearable and health data may be processed by AI to generate training insights, injury-risk indicators, and recovery recommendations for authorized coaching staff.
Security & Platform Integrity
To detect abuse, enforce rate limits, prevent unauthorized access, and maintain audit logs.
Communication
To send security alerts, MFA reminders, billing notices, and material policy-change notifications. We do not send marketing email to athletes without a separate opt-in.
Legal & Regulatory Obligations
To comply with EU and Slovenian law, respond to lawful requests, and manage disputes.
5. Legal Basis for Processing
| Processing Activity | Legal Basis (GDPR) |
|---|---|
| Account registration & service delivery | Art. 6(1)(b) — Contract |
| Billing & invoicing | Art. 6(1)(b) — Contract; Art. 6(1)(c) — Legal obligation |
| Security logging & fraud prevention | Art. 6(1)(f) — Legitimate interests |
| Health data, injury records, wearable data & mental wellness | Art. 6(1)(b) — Contract + Art. 9(2)(a) — Explicit consent (required for all health-data processing) |
| Coach notes & training records (non-health) | Art. 6(1)(b) — Contract (club service) |
| MFA & security notifications | Art. 6(1)(f) — Legitimate interests |
| Compliance with legal requests | Art. 6(1)(c) — Legal obligation |
6. Who Can Access Your Data
Within your club
Your data is visible to authorized members of your sports club, according to role-based access controls configured by the club.
18+ Athlete Privacy
Adult athletes who have not opted in to parental access control whether parents or guardians can access training notes or AI summaries.
Sport99 staff
Sport99 engineering and support staff access anonymized platform data for operations only. Access to health and medical records is protected by field-level controls; any such access requires elevated authorisation and is logged for audit purposes.
Wearable API providers
When you connect a wearable, Sport99 receives data from that provider on your behalf. We do not push your personal data back to these providers.
Infrastructure sub-processors
We use vetted infrastructure partners under GDPR-aligned data processing agreements.
7. Data Retention
| Data Category | Retention Period |
|---|---|
| Account & profile data | Duration of account + 30-day recovery window after deletion request |
| Wearable & activity data | Active sync period + 30-day soft-delete window; permanent removal on request |
| Training notes & AI summaries | Duration of club subscription; purged with account on deletion |
| Billing records | 7 years (required by Slovenian and EU accounting law) |
| Security & audit logs | Retained for up to 12 months; anonymised thereafter |
| Revoked consent records | Retained as proof of compliance for 5 years (matching the objective limitation period under applicable law) |
8. Sub-Processors & Data Location
All personal data is stored and processed within the European Union. We use the following sub-processors:
| Provider | Purpose | Location |
|---|---|---|
| Microsoft Azure | Cloud infrastructure, database hosting, AI inference | European Union |
| Stripe | Payment processing & invoicing | EU servers (data residency enabled); Standard Contractual Clauses and/or EU-US Data Privacy Framework for any non-EU transfers |
| Azure Communication Services | MFA email code delivery | European Union |
No personal data is transferred outside the European Economic Area without appropriate safeguards (Standard Contractual Clauses or an equivalent approved transfer mechanism under Chapter V GDPR).
9. Your Privacy Rights
As a data subject under the GDPR, you have rights that you can exercise from dashboard settings or by contacting us.
Request a full export of all personal data we hold about you.
Correct inaccurate personal data in your profile at any time.
Request permanent deletion of your account and all associated data.
Ask us to pause processing your data while a dispute is resolved.
Receive your data in a machine-readable format such as CSV or JSON.
Object to processing based on legitimate interests at any time.
Revoke health data or wearable consent at any time with immediate effect.
We aim to respond to all rights requests within 30 days. You also have the right to lodge a complaint with the Slovenian Information Commissioner. ip-rs.si
10. Children & Minors
Sport99 is used by athletes of all ages within organised sports clubs. When an athlete is under 18, additional protections apply:
- Club administrators must confirm parental or guardian consent during minor athlete registration.
- Parents or guardians linked to the athlete profile may access training and attendance records according to club configuration.
- AI processing of health data for minors requires parental consent in addition to platform consent.
- Wearable integrations for athletes under 15 require explicit parental authorisation under Slovenian law (ZVOP-2, implementing GDPR Art. 8). We apply a stricter age gate of 16 for all optional consent-based features as an additional safeguard.
Sport99 does not knowingly collect data from children under 13 outside an organised club context with explicit guardian consent.
11. Automated Processing & Profiling
Sport99 uses automated processing to calculate athlete readiness scores, recovery indicators, and injury-risk signals. These outputs are provided for informational purposes to coaches and authorised staff — they are not used to make fully automated decisions with legal or similarly significant effects on individuals (GDPR Art. 22 does not apply). All AI-generated insights must be reviewed by a qualified human before any action is taken. You have the right to request human review of any AI-generated assessment that affects you by contacting us at privacy@sport99.ai.
12. Policy Updates
We may update this Policy as the platform evolves or legal requirements change. For material changes, we will notify account holders via email and in-app notice at least 14 days before the change takes effect.
13. Contact & Data Protection Officer
For questions about this Policy, to exercise your rights, or to raise a privacy concern, please contact us at: