Trust & Security

Privacy & security documentation

Privacy and security documentation for individual users and institutions. Includes review materials commonly requested by school districts, colleges, and universities evaluating software vendors.

FERPA-alignedSOPIPA-alignedUS-based infrastructureRole-based access controlsWCAG 2.1 A/AA target standard

Documents

Review documents

Commonly requested documents for district, school, college, and university privacy and security review. Click any to download the PDF.

Also see planning resources →

Privacy

Data privacy

For institutional accounts, APEX processes data at the direction of the contracting organization. For individual users, APEX is the data controller and our Privacy Policy governs data handling.

  • Your data is not sold.

    APEX does not sell personal data or use it for advertising purposes under any circumstances — whether you are an individual user or part of an institution.

  • Athletes control their own data.

    Athletes can grant or revoke data-sharing consent with coaching staff at any time. Athlete performance data stays with the athlete — even if they leave a program. Institutions retain ownership of coaching content (programs, configurations, targets).

  • Not a medical system.

    APEX is a coach workflow platform. It does not provide medical advice, diagnosis, or treatment.

Governance

Responsible use in athletics

APEX is a coach workflow and accountability platform. Institutions remain in control of how it is applied.

  • APEX supports training operations and team visibility — it does not make medical decisions.
  • For institutional accounts, the organization controls which data is collected, who can access it, and how platform workflows are applied. Individual users manage their own settings.
  • APEX does not replace sports medicine judgment, institutional policy, or athlete notice and consent processes.
  • Institutions adopting APEX should maintain written policies, stakeholder education, and periodic review practices for performance technologies.

Security

Technical security

Infrastructure and access controls designed for institutional athletics environments.

  • Supabase Auth for authentication and session management.
  • Row-level security (RLS) policies enforce data isolation at the database layer.
  • Role-based access controls and tenancy scoping across school, team, coach, and athlete access paths.
  • Data encrypted in transit (TLS) and at rest (AES-256).
  • Consent-gated access — coaching staff can only view athlete-generated data when the athlete has granted sharing consent.
  • Operational logging supports reliability and auditability.
  • Administrative write paths use controlled server-side service-role access.

Infrastructure

Subprocessors

All subprocessors are US-based. Institutional customers receive thirty (30) days' notice before any new subprocessor is added.

Full subprocessor list →
VendorPurposeLocation
SupabaseDatabase, Authentication & File StorageUnited States
VercelHosting & DeploymentUnited States
AnthropicNutrition estimation (Claude Haiku); coaching analytics chat (Claude Sonnet); AI authoring for alerts and dashboards (Claude Sonnet); program import (Claude Opus/Sonnet); dining-menu classification (Claude Haiku/Sonnet)United States
OpenAIWeekly report summaries (gpt-4o-mini) onlyUnited States
StripePayment ProcessingUnited States
PostHogProduct Analytics & Usage MonitoringUnited States
ResendEmail DeliveryUnited States

Meal plans are generated by deterministic, rule-based pipelines (meal-bank-v1 and catalog-grounded-v1); no AI model generates them.

Compliance

Regulatory alignment

Designed to support privacy reviews under FERPA and state student data privacy laws when APEX is used by educational institutions under contract. For individual users, APEX complies with applicable consumer privacy laws including the CCPA.

  • FERPAFamily Educational Rights and Privacy Act
  • NY §2-dNew York Education Law §2-d
  • SOPIPACalifornia Student Online Personal Information Protection Act
  • MAMassachusetts Student Data Privacy Regulations
  • TXTexas Student Privacy Protections (Education Code)

Accessibility

Accessibility

APEX uses WCAG 2.1 Levels A and AA as its target standard, with accessibility treated as a core product and engineering requirement.

Read the accessibility statement →
  • Substantial platform-wide internal evaluation and remediation completed across the Coach, Athlete, and Live applications and the shared component library.
  • Automated accessibility testing and regression guardrails run as a gate on every build.
  • Representative critical workflows tested using keyboard-only operation and assistive technology, with Live workflows tested on a physical iPad.
  • Formal independent conformance assessment is pending. APEX does not claim formal WCAG 2.1 AA conformance and has not issued a VPAT.
  • Known limitations are published in full on the accessibility statement, along with a contact for reporting barriers.

Planning Resources

Institutional guidance resources

Article-style resources to support athletics, sports medicine, IT, and compliance stakeholders as institutions define their own internal policies and implementation practices.

Governance

Responsible Use of Athlete Performance Data

Practical principles for transparency, governance, role-based access, and multidisciplinary oversight.

Read article→

Data

Data Categories Collected

Plain-language summary of data categories, operational purpose, and typical access context.

Read article→

Policy

Sample Institutional Policy Template

Adaptable policy framework institutions can use for planning stakeholder roles and oversight boundaries.

Read article→

FAQ

Institutional FAQ

Quick answers for coaches, sports medicine, IT, and compliance reviewers evaluating platform use.

Read article→

Privacy & Security Contact

Questions about privacy or security?

For individual users, institutional reviews, or IT and compliance teams.

hello@apexcoachai.com
Trust & Security | APEX Coach AI