Privacy policy

The short version

Strong is a performance intelligence platform used by sports organisations to manage their athletes' data. Athlete injury histories, medication records, and availability status are health information, which the Privacy Act 1988 (Cth) classes as sensitive information. We built the product around that fact: access is restricted by role at the database itself, clinical records are never hard-deleted into ambiguity, integration credentials are encrypted at rest, and we do not sell personal information to anyone, ever.

Who this policy covers

Strong is sold to organisations: academies, clubs, and high-performance programs. The organisation that opens an account decides which athletes and staff are on the platform and remains responsible for having the authority and consent to put them there (see the terms of service). This policy covers everyone whose personal information ends up in Strong as a result: staff who sign in, athletes whose data is recorded, and visitors who contact us through this website.

What we collect

From staff and account holders:

• Name, work email, and role within the organisation, used for sign-in and for deciding what each person may see.
• The records staff create in the course of their work: training sessions, injury and medication entries, availability decisions, report notes.

From athletes, as recorded by their organisation or logged by the athlete themselves:

• Profile information: name, date of birth, sport, position, squad.
• Training and recovery telemetry from connected devices such as Polar and Whoop, once the organisation connects those integrations.
• Wellness check-ins, nutrition and hydration logs, and body composition measurements.
• Performance medicine records: injuries, allergies, medications, and availability status. This is health information and is handled as sensitive information under the Act.

From website visitors:

• If you request a demo, the details you type into the form: your name, email, organisation, and what you tell us about your program. Nothing else; this website runs no advertising or analytics trackers.

How we use it

Data in Strong is used for exactly one purpose: showing the people who run a sports program the state of their own athletes. Recovery scores sit next to training load and availability so a director, coach, or physio can make a better decision. We do not use athlete data for advertising, we do not build profiles for third parties, and we do not sell personal information. Demo request details are used to reply to you and for nothing else.

Who can see what

Access inside Strong is decided by role, and the walls are enforced by the database itself, not just by the interface:

• An organisation's data is invisible to every other organisation. This isolation is enforced on every row of every table.
• A coach sees an athlete's availability status, but never the clinical detail behind it: diagnoses and medication records are readable only by medical staff and, in defined cases, the director.
• Administrative staff are walled out of clinical data entirely.
• Every write to a medication, injury, or availability record is logged in an audit trail that cannot be edited or deleted.

The technical detail of these walls is on the security page.

Device integrations

When an organisation connects Polar or Whoop, the athlete authorises the connection through the provider's own consent screen. The access credentials Strong receives are encrypted at rest with AES-256 and are only ever handled on our servers; they never reach a browser and never appear in logs. Disconnecting an integration stops the flow of new data immediately.

Storage and processors

Strong stores all data in a single managed Postgres database operated by Supabase, and serves the application from Vercel. Both act as processors of the data on our behalf and neither is permitted to use it for their own purposes. Secrets and credentials live in encrypted environment configuration, never in the codebase. The hosting regions for the production database and any resulting cross-border disclosure obligations under APP 8 will be stated precisely in the legally reviewed version of this policy rather than approximated here.

Deletion and de-identification

Health records in Strong are never silently hard-deleted, because a clinical record that vanishes without trace is its own governance failure. Instead, the platform is built for APP 11.2 destruction and de-identification requests:

• Personal identifiers on the athlete record are redacted.
• Clinical child records (injuries, medications, availability history) are soft-deleted so they no longer surface anywhere in the product.
• The audit trail keeps the fact that each action happened (who acted, what kind of action, when) with the personal content of those entries redacted, so accountability survives the erasure of identity.

An athlete or organisation can raise a deletion or de-identification request through the contact route below, or through their organisation's account holder.

Access and correction

You may ask us what personal information we hold about you, and ask us to correct it. For athletes, the fastest route is usually through your own organisation, since they control the account; either way, we will respond to requests sent to the contact address below.

Contact

Privacy questions, access requests, and deletion requests go to hello@strong.app. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC).