Privacy Policy — Health Information

1. What information we collect

Through the pre-season baseline tool we collect personal information and sensitive (health) information, which the athlete (or their parent/guardian) self-enters. This includes:

• Identity and background: full name, date of birth, sex, dominant hand, ID/jersey number, sport, team/club, position, years of education, primary language.
• Health history: prior concussion history (number, dates, recovery, symptoms), diagnosed migraines/headaches, medical conditions (e.g. ADHD, learning disability, depression/anxiety, prior brain surgery), and current medications.
• Assessment results: symptom ratings, cognitive screening results (orientation, memory, concentration, delayed recall) and oculomotor (eye-movement) screening responses.
• Consent records: confirmation of consent, the time it was given, the policy version, and — for under-16s — the parent/guardian name and their consent.

2. Why we collect it (purpose)

We collect this information so that the athlete's clinic can establish a concussion baseline and use it to support the management of any future suspected concussion (including comparing a later test against the baseline). We collect sensitive information only with consent and only where it is reasonably necessary for this purpose.

3. Who can access it

• The clinic whose baseline link was used — the completed report is emailed to that clinic's nominated contact.
• Authorised CEA personnel, for the purpose of operating, supporting and securing the service.
• The service providers listed in section 5, strictly to provide hosting, storage, email and payment infrastructure.

4. Storage, location and retention

• Database: baseline records are stored in a PostgreSQL database hosted in Australia (Sydney region) by our database provider (Neon).
• Generated report: a PDF report is produced and emailed to the clinic. Email delivery is handled by a third party (see section 5).
• Retention: baseline records are retained so that future tests can be compared against the baseline. We keep them for as long as needed for that concussion-management purpose, and will delete or de-identify information when it is no longer required or on a valid request, subject to any legal retention obligations.

5. Third parties and cross-border disclosure

We use the following service providers to run the service. Some are located overseas, which means some information may be disclosed or processed outside Australia (APP 8):

• Neon — managed PostgreSQL database hosting (Australia, Sydney region).
• Vercel — application hosting and delivery.
• Upstash — key/value store used for service controls such as rate limiting.
• Resend — transactional email delivery (used to email the report to the clinic); United States.
• Stripe — payment processing for course/product purchases (not used for baseline submissions); United States.

We are working to confirm appropriate data-handling arrangements with these providers. The specific contractual protections (e.g. data processing agreements) are being reviewed.

6. Children and young athletes

Many athletes who use the baseline tool are minors. Where the athlete is under 16, the tool requires a parent or guardian to provide consent on the athlete's behalf before any information is collected. We record that guardian consent alongside the submission. The exact age threshold for consent capacity is being confirmed with legal advice and may be adjusted.

7. Your rights — access, correction, complaints

You can ask us to access or correct the personal/health information we hold about an athlete, or raise a privacy concern, by emailing [email protected]. As the report is provided to the athlete's clinic, you may also need to contact the clinic that holds the clinical record.

If you are not satisfied with how we handle a privacy complaint, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

8. Contact us

For any privacy question or request, email [email protected]. We aim to respond within a reasonable time.