Privacy Policy

Headstrong is operated by a sole trader in Victoria, Australia (ABN 41 051 775 916) (“we”, “us”). Contact us at support@headstrong.live.

Each club decides who to invite and uses Headstrong to run its concussion education. We look after that information for the club, use it only to provide Headstrong, and are responsible for keeping it secure and for our own accounts and billing. Questions about why you’re on a club’s roster are best asked of the club first.

• Club administrators and coaches who sign in to the website to run a club’s education program.
• Players, including players under 18, who use the Headstrong app or website to complete modules.
• Parents and guardians who give consent for a player under 18.
• Visitors to headstrong.live, including people who request a demo.

• Players: full name, email address, date of birth, club and team, the modules completed, and quiz attempts (score and pass or fail, not which answer was picked for each question). We use the date of birth only to work out whether a guardian’s consent is needed.
• Parents and guardians: full name, email address, which player they’re linked to, and a dated record that they gave consent.
• Club administrators and coaches: full name, email address, role, and the club details you enter, such as teams, season dates and training sessions (team-level drill types and durations, not information about individual players).
• Payments: handled by Stripe. We never see or store card numbers. We keep only Stripe’s customer and subscription references and the club’s plan status.
• Push notifications: if a player allows notifications in the app, we store a device token so we can send reminders. Turning notifications off in the phone’s settings stops them.
• Feedback and demo requests: what you send us through the feedback form, or the details you give when you ask for a demo (such as your name, email, club and how you heard about us).
• Sign-in security: to slow down repeated sign-in, sign-up and password-reset attempts, we briefly record the email address used and the time. These records are deleted within minutes.
• Website analytics: we count page visits with Vercel Web Analytics, which doesn’t use cookies and doesn’t identify you.
• Technical data: our hosting providers keep short-lived server logs (such as IP address, browser type and the page requested) to run and secure the service.

A player under 18 can’t open a module or take a quiz until a parent or guardian has given consent through Headstrong. A guardian can see the modules their child has completed. We don’t collect more about a minor than is needed to deliver the education and give their club a completion record, and we never use a minor’s information for marketing.

• To create and manage accounts, and let players complete the modules their club has assigned.
• To create completion records, which clubs use as evidence that a player has done the required education.
• To send the emails and reminders described below.
• To take club subscription payments and answer support requests and demo requests.
• To keep the service secure and working, and to improve it using counts that don’t identify anyone.

Headstrong doesn’t diagnose concussion, and we don’t collect information about injuries or symptoms.

• A club’s administrators can see their own club’s players, teams, consent status and completion records. Coaches can see the players in their teams.
• A guardian can see the records of the player they’re linked to.
• Other clubs can’t see your club’s information.
• Our service providers, below, process data only to provide their part of Headstrong.

We don’t sell or rent personal information.

We use these providers. Some are based overseas, so information may be stored or processed outside Australia:

• Supabase hosts our database and sign-in in Sydney, Australia.
• Vercel (United States) runs the website and provides the visit counts above.
• Resend (United States) sends our emails.
• Stripe (United States and Australia) processes subscription payments.
• Expo (United States), with Apple and Google, delivers push notifications to the app.
• Cloudflare (United States) provides our domain name service.
• Microsoft (United States) hosts the inbox where we receive and answer support emails.

We choose providers with strong security practices and take reasonable steps to make sure they protect personal information.

• To players and guardians: invitations to join a club, requests for a guardian’s consent, and reminders to complete modules (by email or push notification), sent on behalf of the player’s club.
• To club administrators: sign-in and password emails, a welcome email, payment receipts and notices about the club’s subscription. Stripe may also send receipts.
• These are about using Headstrong. We don’t send marketing to players or guardians.

• We keep a club’s information while its account is open, so its completion records stay available as evidence.
• If you delete your account, we close it, remove your email address and date of birth, and stop reminders. The club’s record that you completed the education (and any consent given) is kept with your name, because the club may need that record later as evidence.
• If a club closes its account, we delete its information on request, except records we must keep by law, such as payment records for tax.

You can ask to see the personal information we hold about you, correct it, or have it deleted. A guardian can do this for a player under 18. You can delete your own account in the app (Profile, then Delete my account) or from your account page on the website; see Deleting your account. Or email support@headstrong.live and we’ll respond within 30 days.

• The website uses a sign-in cookie to keep you logged in. It’s needed for the service to work.
• The app keeps your sign-in on your device instead of using cookies.
• We don’t use advertising, analytics or tracking cookies.

Data is encrypted in transit, and access is restricted so each club, coach and guardian can see only what they’re allowed to. No system is perfectly secure. If a data breach is likely to cause you serious harm, we’ll tell you and the Office of the Australian Information Commissioner as the law requires.

If you have a privacy concern, email us first and we’ll try to resolve it within 30 days. If you’re not satisfied, you can contact the Office of the Australian Information Commissioner.

If we make a significant change, we’ll update the date above and tell club administrators by email.