Privacy Policy

The Hub Multisport Limited, trading as HubSport, provides online athlete development resources including training programmes, nutrition and mental skills content, an Athlete Assessment, a Training Centre for logging and monitoring training, a Maturation Monitor for tracking youth growth and development, and a shop.

This policy explains what personal information we collect, why, what we do with it, who sees it, how long we keep it, and what rights you have. We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this alongside our Cookie Policy, our Terms and Conditions, our Safeguarding Policy, and the disclaimers that apply to the Strength and Conditioning, Nutrition and Mind Power 4 Success programmes.

• Data Controller: The Hub Multisport Limited
• Company number: 13523641
• Registered office: 186 Rushmere Road, Ipswich, England, IP4 3LP
• ICO registration: ZB266122
• Data Protection Lead: Carmelo Severino
• Contact: info@hubsportonline.co.uk

The Data Controller decides how and why your personal information is processed. The Data Protection Lead is your point of contact for any question about this policy.

Anyone can register for an account. We ask for your date of birth when you sign up, and we use it to determine whether you are under 18.

If your date of birth shows you are under 18, you must give us the email address of your parent or legal guardian as part of creating the account. We send your parent or guardian an email containing an approval link. Your account is not fully active until they have used that link to confirm they consent to you using HubSport and to the processing described in this policy.

We record the date and time consent was confirmed, and the method by which it was given. This means the account is yours, and your parent or guardian has verified that they agree to it.

Thirty days after you turn 18, we redact your parent or guardian's name and email address from our consent records, because we no longer need them. The record that consent was given, and when, is kept.

An adult account holder may also create athlete profiles within their own account, for example a parent tracking more than one child in the Maturation Monitor. Each profile has its own date of birth and can be viewed, corrected and deleted independently of the others and of the account itself.

An account is always held by the athlete, or by the parent or guardian of the athlete. Coaches, clubs, schools, academies and other third parties cannot hold accounts containing another person's information and cannot create profiles for athletes they work with.

We collect the following categories of information.

• Full name and email address
• Date of birth
• Contact details
• Account credentials
• Parent or guardian name and email, where you are under 18
• Membership tier and Athlete Level
• Sport or sports

Your answers to the Athlete Assessment across its nine areas, and the red, amber or green rating calculated from them.

• Date, session type and duration
• Rating of perceived exertion and calculated session load
• Sleep quality, fatigue, stress and muscle soreness ratings

• Readiness Index and its Green, Amber or Red band
• Acute to chronic workload ratio and its risk band
• Hooper Index and its label
• Athlete Assessment red, amber or green rating
• Recommended modules and shop products

• Date of birth of the athlete profile
• Sex at birth (optional, see section 5.2)
• Standing height, sitting height and body mass
• Calculated peak height velocity timing, maturity status, growth velocity and bio-banding classification
• Your confirmations at the consent gate (see section 9)

• Experience points and trophies
• Completion of onboarding, modules and resources
• Login and usage activity
• Push notification device tokens, where you have allowed notifications

If you are signed in, our support chat provider receives your name, email address and user ID when a page loads, so that any conversation you start can be linked to your account. Anything you type into the chat, and the replies, are stored by that provider. See section 10.4.

• Device and browser information
• IP address
• Cookie information, including your cookie preferences (see our Cookie Policy)
• Activity, security and access logs

Any enquiry, support request or other message you send us by email, and our reply.

Some of the information we hold is health information. Under UK GDPR, this is special category data and receives additional protection. We would rather be over-inclusive than under-inclusive, so we treat the following as health information.

• Your Readiness Index and its band. This is a composite score describing your recovery state, and it produces guidance on whether to train.
• Your acute to chronic workload ratio and its risk band. This is an assessment of injury risk.
• Your Hooper Index and its label. This is an inference about your current physical state.
• Your muscle soreness rating.
• Your sleep quality, fatigue and stress ratings. Individually, these are subjective wellbeing ratings. Because the platform combines them over time to produce health inferences, we treat them as health information throughout.
• Peak height velocity timing, maturity status, growth velocity and bio-banding classification from the Maturation Monitor.

Your rating of perceived exertion and session load are training metrics rather than health information in themselves. Because they feed directly into the calculations above, we protect them to the same standard.

The Maturation Monitor asks for sex at birth so that growth measurements can be compared against the correct normative reference data. Without it the comparison is not meaningful.

Sex is not itself special category data. We recognise that where recorded sex at birth differs from a person's gender identity, the record may reveal information the individual regards as private. For that reason the field is optional, and the Maturation Monitor will function without it, with the limitation that growth comparisons will not be shown.

These are physical measurements. They are not biometric data in the sense used by UK GDPR, because they are not processed to identify you. We protect them as health information because of what they are combined with and what is calculated from them.

We rely on the following lawful bases for what we do (with notes where helpful):

• Create and administer your account and deliver what you have subscribed to: Performance of a contract. Without this we cannot provide the service.
• Obtain and record parental consent for users under 18: Legal obligation, and consent. See section 3.1.
• Collect and process health information (section 5): Consent, and explicit consent under Article 9(2)(a). Optional; other parts of the platform work without it.
• Recommend modules and shop products from your assessment: Consent. Given alongside consent to the assessment. See section 13.
• Take payment and keep financial records: Contract, and legal obligation. Tax and accounting requirements.
• Provide the support chat: Legitimate interests. Our interest in supporting users. See section 10.4.
• Send push notification reminders: Consent. Given through your device or browser permission.
• Keep the platform secure, prevent fraud and misuse, and investigate incidents: Legitimate interests. Our interest in operating a secure service.
• Understand how the platform is used, in order to improve it: Legitimate interests, and consent for analytics cookies. Aggregate and technical information.
• Measure and target advertising: Consent. Marketing cookies only. See section 14.
• Report the number of enrolled seats to an organisation that has bought a group subscription: Legitimate interests. A count only. See section 10.1.
• Comply with legal or regulatory obligations: Legal obligation.

We rely on your explicit consent to collect and use health information. That consent is asked for separately from our Terms and Conditions, requires a positive action, is not bundled with anything else, and is not a condition of holding an account. For users under 18, consent is given by the parent or guardian through the approval process in section 3.1.

You can withdraw it at any time through Account Settings or by email. Withdrawal stops any further use of that information, and you can also ask us to delete what we already hold. It does not affect anything we did lawfully beforehand.

If you withdraw consent, the Training Centre and Maturation Monitor will no longer calculate readiness, workload, wellbeing or growth outputs, because those calculations depend on the information concerned. Every other part of your subscription continues.

We keep a record of the consents you have given, which version of this policy they related to, and when they were given.

Young people can hold their own accounts, with verified consent from a parent or guardian as described in section 3.1. Parents and guardians can also hold profiles for children within their own accounts.

We follow the principles of the Information Commissioner's Age Appropriate Design Code. In practice this means that settings which affect a young person's visibility or which involve tracking are off unless actively turned on, that we collect the minimum information needed for each feature, and that we explain in plain terms what we do. A short version of this policy for young people is at the end of this document.

A parent or guardian may see, correct, export or delete a child's information at any time. For a profile held within their own account they can do this directly. For an account held by the young person, they can do this by contacting us.

The Maturation Monitor tracks growth and development in young athletes. Because it involves physical measurements of a child, additional rules apply.

Measurements of anyone under 18 must be taken by that young person's parent or guardian, or with the parent or guardian present. They must not be taken by another adult without a parent or guardian there.

Before you can create or update a maturation profile, the platform asks whether you are the athlete, or the parent or guardian. If you are neither, it explains the supervision requirement and asks you to confirm that a parent or guardian will be present and that you hold written consent from the person legally responsible for the young person. That written consent is kept by you. Do not upload it to the platform.

These confirmations are recorded against the profile. We rely on them being given honestly, and they do not remove your own responsibility for how measurements are taken. Our Safeguarding Policy sets out how measurements should be taken.

We do not give your personal information to coaches, clubs, schools, academies, foundations, sponsors or any other third party in a form that identifies you. This applies to your assessment, your training data, your health information, your maturation records and your activity on the platform, whether or not an organisation has paid for your subscription.

We do not sell personal information.

Where a club, school, academy or similar organisation buys a number of seats, we tell that organisation one thing: how many of its seats have been taken up by users who have completed onboarding. That is a single number. It does not include names, completion percentages, module breakdowns, engagement statistics, health information, or comparisons between one period and another.

Staff of The Hub Multisport Limited can see your information where they need to in order to run the platform and support you. In particular:

• Platform administrators can view your Athlete Assessment answers and rating through the administration portal, and can export the assessment as a PDF.
• When you complete an Athlete Assessment, an automated alert is sent to a small number of authorised HubSport email addresses.
• Administrators can export a platform-wide file of assessment answers and ratings for the purpose of reviewing and improving the assessment.
• HubSport support staff can see the conversation if you use the support chat.

Access to the databases holding user information is limited to HubSport staff. No coach, club or external organisation has access.

We use third parties to host the platform, store and stream video, process payments, send emails, deliver push notifications, provide the support chat, and measure use of the site and advertising. They act on our instructions, may only use the information to provide their service to us, and are bound by written contracts requiring them to keep it secure.

• Application hosting, database and file storage: Amazon Web Services. London, United Kingdom. Files delivered through a content delivery network may be cached at other locations.
• Video hosting and streaming: Bunny. Germany, with edge caching across UK and EU locations.
• Payment processing: Stripe. United States and other Stripe locations. We never see or store your full card number.
• Service emails: Resend. United States.
• Push notifications: Google Firebase, Expo. United States and global.
• Support chat: Chatello. United States.
• Site analytics, with your consent: Google Analytics. United States.
• Advertising measurement, with your consent: Meta. United States.

We also use an AI service to generate captions and summaries for our own instructional videos. That service processes the audio of our instructors only. It does not receive any user information.

The chat widget in the corner of the site is provided by Chatello. You can type a message and receive an automated reply, or a reply from a member of the HubSport support team. If you are signed in, your name, email address and user ID are sent to Chatello when the page loads, so that any conversation can be linked to your account. Conversations, timestamps and your details are stored on Chatello's servers in the United States and are not held in our own database.

Please do not type health information, measurements or anything you would not want stored by a third party into the chat. Use it for questions about the platform and your account.

We may share information where the law requires it, where we need to establish or defend a legal claim, or where there is a serious concern about the safety of a child or vulnerable person. In the last of these, we would normally tell you, unless doing so would increase the risk to the person concerned.

Our application, database and file storage are in the United Kingdom. Some of the service providers listed in section 10.3 process information in the United States or elsewhere. Where they do, we rely on one or more of the following safeguards recognised under UK GDPR:

• The provider's certification under the UK Extension to the EU-US Data Privacy Framework, known as the UK-US Data Bridge
• The UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK International Data Transfer Agreement, included in our contract with the provider
• For providers in the European Economic Area, the adequacy regulations that apply to those countries

You can ask us which safeguard applies to a particular provider by contacting the Data Protection Lead.

HubSport does not collect or store photographs of users. There is no profile image feature and no facility to upload an image to an account or an athlete profile. Where the platform needs to represent you visually, it uses your initials.

The platform analyses information you enter and produces scores, bands, labels and recommendations from it. Under UK GDPR this counts as profiling. This section sets out exactly what is calculated, what it is used for, and what it is not.

• Athlete Assessment: produces a red, amber or green rating across nine areas, and recommended modules and shop products. Profiling: yes. Significant decision about you: no (see 13.2).
• Acute to chronic workload ratio: produces a risk band: Low, Optimal, Moderate Risk or High Risk. Profiling: yes. Significant decision about you: no.
• Readiness Index: produces a Green, Amber or Red band with guidance. Profiling: yes. Significant decision about you: no.
• Hooper Index and wellness banding: produces a total score and a descriptive label. Profiling: yes. Significant decision about you: no.
• Maturation Monitor: produces growth velocity, peak height velocity timing, maturity status and bio-banding classification. Profiling: yes. Significant decision about you: no (see 13.3).
• Experience points and trophies: produce a running total and awards. Profiling: limited. Significant decision about you: no.
• Athlete Level 1 to 7: a level you select yourself from written definitions. Profiling: no, you choose it. Significant decision about you: no.

Every output is advisory. None produces a legal effect for you, and none has a similarly significant effect on you. Nobody is accepted, rejected, selected, deselected, graded or assessed by us on the basis of any of them. They are generated from what you entered, delivered to you, and you decide what to do about them.

Your Athlete Assessment rating is used to suggest modules on the platform and products in our shop that may be relevant to you. These are suggestions. You are never required to buy anything, the suggestions do not affect your access to any part of the platform, and you can ignore them entirely. Some products in our shop are sold through third-party retailers, and we may earn a commission if you buy through our links. See our Terms and Conditions.

These outputs stay advisory because they come to you and you act on them. That changes if someone else acts on them instead.

If a coach, academy or selector saw a Red readiness band or a maturity classification and used it to deselect an athlete, restrict their participation or withdraw a place, that would be a decision with a similarly significant effect. Applying a band mechanically is not meaningful human involvement, so such a decision would be treated as solely automated. Because readiness bands and maturity classifications are health data, Article 22B of the UK GDPR permits solely automated significant decisions of that kind only in narrow circumstances.

We do not manage that risk. We remove it, by not providing these outputs to anyone other than you. This is a second and independent reason for the position in section 10.

You can ask us how any figure was arrived at and what it is based on. You can correct any input that is wrong, which will change the output. You can delete the underlying entries, and you can withdraw consent for health information, which stops these calculations being produced.

We use three categories of cookie and similar technology.

• Essential: needed to keep you signed in securely and to remember your choices, including your cookie preferences. Always on.
• Analytics: help us understand how the site is used, using Google Analytics. Only set if you accept them.
• Marketing: allow us to measure whether our advertising on Facebook and Instagram leads to sign-ups and purchases, and to show our advertising to people who have visited the site. This uses the Meta Pixel and sends page visits, device information and events such as registration and purchase to Meta. Only set if you accept them.

When you first visit, the cookie banner lets you accept all, reject non-essential, or manage your preferences. Your choice is stored in your browser until you change it or clear your browser data. You can change it at any time through the banner or your browser settings. Full details are in our Cookie Policy at hubsportonline.co.uk/cookie-policy.

If you allow notifications on your device or browser, we send reminders to log training, complete a wellness check-in, update maturation measurements, and alerts when new content is published. Notifications contain only fixed reminder text. They never include your scores, ratings, measurements or any other personal or health information.

Notifications are off unless you allow them. You can turn them off at any time through your browser or device settings, and when you do, we deactivate the device token on our side.

• Secure authentication and encrypted transmission of data
• Role-based access controls, with access limited to staff who need it
• Secure cloud infrastructure in the United Kingdom
• Activity and security logging
• Ongoing monitoring and periodic security review

No online service can promise absolute security, and we do not claim to.

If a personal data breach occurs, we assess it against the risk to the people affected. Where it is likely to result in a risk to your rights and freedoms, we report it to the Information Commissioner's Office within 72 hours of becoming aware. Where it is likely to result in a high risk to you, we contact you directly without undue delay, and tell you what happened, what information was involved, the likely consequences, what we are doing, what you can do, and who to contact. We keep an internal record of all breaches, including those we are not required to report. Because much of what we hold relates to children and to health, we apply a lower threshold for deciding that a breach is serious enough to report.

We keep information for the following periods and reasons:

• Your account, profiles and everything within them, while your account is open: kept for as long as your account is open. Needed to provide the service. Your training, assessment and maturation records are longitudinal, so you control how long they are kept.
• Deactivated accounts: 90 days, with a warning email at 60 days, then permanently deleted. Allows you to come back without us holding your data for longer than needed.
• Accounts you ask us to delete: 14 days, then permanently deleted. A short window in case the request was a mistake.
• Dormant accounts with no sign-in: 24 months, with a warning email at around 23 months. We do not keep accounts open indefinitely.
• Parent or guardian name and email in consent records: redacted 30 days after the user turns 18. No longer needed once the user is an adult. The record that consent was given is kept.
• Record that your account was deleted, and any deletion request: 7 years. To show we complied with your request.
• Payment and transaction records: 6 years from the end of the relevant accounting period. Tax and accounting requirements. These are held by our payment processor; billing records in our own system are deleted or anonymised when your account is erased.
• Organisational subscription agreements: 6 years from the end of the agreement. Limitation period for contractual claims. Held in our company records.
• Consent and policy acceptance records: for as long as your account exists, then deleted with it. To show what was agreed and when.
• Platform activity logs: 24 months. Operational.
• Security and audit logs: 7 years, then anonymised. To investigate security incidents and to evidence how the platform has been administered.
• Cookie preferences: in your browser until you change or clear them. Cookie lifetimes set by third parties are controlled by those providers.
• Support chat conversations: held by Chatello. See section 10.4.
• Email correspondence with us: 24 months. Operational.
• Records of a safeguarding concern: until the individual's 25th birthday. See section 18.1.
• Backups: deletion completes within 30 days. Deleted data persists briefly in rolling backups before being overwritten.

Where a safeguarding or child protection concern is recorded in relation to a child, that record is held by The Hub Multisport Limited outside the platform, in secure company records rather than in the application, with access limited to those who need it. It is retained until the individual's 25th birthday, that is, 25 years from their date of birth.

This is longer than anything else in the table, and it is deliberate. A young person may need the record long after they have stopped using the platform, and deleting it early could remove evidence they later rely on. Retention of this kind reflects established practice for child protection records in youth sport.

You have the right to:

• Ask for a copy of the information we hold about you
• Have inaccurate or incomplete information corrected
• Ask us to delete your information
• Ask us to restrict how we use it
• Object to processing we carry out on the basis of legitimate interests
• Receive your information in a portable format
• Withdraw consent at any time where we rely on it

To exercise any of these, use Account Settings or email info@hubsportonline.co.uk. We will respond within one month. There is no charge. Where you are under 18, your parent or guardian can exercise these rights on your behalf. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk, by calling 0303 123 1113, or by writing to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would ask you to raise it with us first so that we have the chance to put it right.

Account Settings lets you review and change your privacy choices, manage consent, delete an individual athlete profile, export your Athlete Assessment as a PDF, and deactivate or delete your account.

Deactivating suspends access and keeps your information for 90 days.

Go to Account Settings

Deleting removes it permanently after a 14-day grace period, other than anything we are required to keep by law, in which case we will tell you what has been kept and why.

Go to Account Settings

When we make a material change to this policy, we publish the updated version with a new effective date, and the next time you sign in you are shown what has changed and asked to accept it before you continue. We record which version you have accepted and when.

The Hub Multisport Limited, info@hubsportonline.co.uk, marked for the attention of the Data Protection Lead where your query concerns this policy.

This part is for anyone under 18 using HubSport. The rest of the policy still applies, but this explains the main points more simply.

When you sign up we ask for your date of birth. If you are under 18 we also ask for your parent or guardian's email address, and we send them a link. Your account only works properly once they have clicked it to say they are happy for you to use HubSport.

Your name, your date of birth, your email, and your parent or guardian's email. If you do the Athlete Assessment, we know your answers and your red, amber or green result. If you use the Training Centre, we know what training you did and how you said you were feeling. If you use the Maturation Monitor, we know your height and weight and how you are growing.

You, and your parent or guardian if they ask us. A small number of people who work at HubSport can see it, for example to check your assessment or to fix a problem.

Your coach cannot see it. Your club cannot see it. Your school cannot see it. Other people using HubSport cannot see it. We do not send it to anyone else and we do not sell it.

The chat button in the corner is for questions about HubSport. When you are signed in, the chat company knows your name and email so it can find your account. It might be a computer answering or it might be someone from HubSport. What you type is kept by the chat company, so use it for questions about the platform and not for anything private about your health or your body.

After the assessment, HubSport might suggest things to work on and things you could buy in the shop. They are only suggestions. You never have to buy anything, and nothing changes if you do not.

It is a training tool, not a doctor. If it tells you that you look tired or that your training load is high, that is a suggestion to think about, not a medical opinion. If you feel unwell, or you are worried about your body, an injury, your eating or how you are feeling, tell your parent or guardian or another adult you trust, and speak to a doctor.

You can ask to see what we hold about you, ask us to correct it, or ask us to delete it. You can turn off notifications in your phone or browser settings. Email info@hubsportonline.co.uk, or ask your parent or guardian to.

If anything on HubSport worries you, or someone has behaved in a way that makes you uncomfortable, tell your parent or guardian and email info@hubsportonline.co.uk. If you would rather talk to someone outside HubSport, Childline is free and confidential on 0800 1111.