OneClub OS Children’s Privacy Notice

What changed

• Staff and player users aged 13 to 17 accept their own account terms without parent onboarding for basic access. The parent-operated player flow remains for children under 13. Adult-only responsibilities and separate optional permissions remain protected.

1. Before a child uses an account

For children under 13, the parent or legal guardian operates their own account with a separate child profile. The parent overview uses the player dashboard’s presentation with parent-specific wording. It currently shows authorized teams, upcoming team events and completed shared development plans; it does not yet provide every player-portal feature. The child must not use the parent’s credentials. A parent confirmation records the statement but does not establish identity, parental authority or required permission.

Direct accounts for children under 13 remain unavailable even after a guardian form is received. A future direct-child pathway requires a legally sufficient method of verified parental consent, complete delivered parent notice including a verified public operator telephone number, age-appropriate account controls and a separately approved launch. The public operator telephone is N/A for the current version. Contact legal@oneclubos.com or support@oneclubos.com. The current version does not complete a telephone requirement in an applicable child notice and does not complete that future launch.

Players aged 13 to 17 may accept these Terms for basic access to their own account, subject to current club membership, recorded age information and applicable restrictions. Their acceptance is not parental permission. Each optional health, media, messaging and external-delivery purpose retains its separate applicable guardian permission and other controls; this account acceptance does not enable player-data AI. Staff members aged 13 to 17 may accept for basic access to their own authorized staff account. Staff do not complete player birthdate setup or parent onboarding. Their acceptance does not establish adulthood or authorize guardian verification, independent privacy review, or any function that requires an eligible adult. Ordinary club, team, role and safeguarding controls still apply. Player account setup uses the player’s birthdate already recorded by the club. If it is missing, the person setting up the player profile is asked for the player’s birthdate before age-based player routing can be completed. The birthdate remains separate from the parent’s own identity and age. We retain the supplied information, its source and time; supplying it is not independent age or guardian verification. Existing authoritative age information and contradictions cannot be bypassed by a new entry. The server evaluates eligibility from the recorded player birthdate and current restrictions; staff do not complete this player setup. A player’s acceptance or age correction cannot override a verified parent’s withdrawal, an account restriction, an unresolved age or safeguarding hold, or inactive club membership. Verified guardians retain their available supervision, privacy-request and withdrawal rights. A missing optional permission restricts the affected purpose; it does not by itself require a new signature for an already permitted purpose. Additional restrictions apply where required by law or an applicable club safeguarding policy.

For a use requiring guardian authority, the reviewer must establish the adult’s identity and relationship to the particular child with evidence appropriate to the approved verification method. The record includes the method, evidence reference, child and club, permissions, notice version and delivery evidence, expiry, and an independent reviewer who is not the submitting guardian. A failed notice delivery or insufficient evidence leaves that use pending. Possession of an email address, a staff attestation or two reviewers alone does not establish parental identity or legal authority. Do not send identity documents in ordinary email.

An adult parent or legal guardian may sign in under their own identity and confirm their own account use to enter a limited workspace. This current-package confirmation is remembered; it does not verify the relationship or grant access to child records. Access by that adult to a child’s records requires the relevant verified relationship and current purpose permission. A portal claim is not required for staff-managed child records supported by an approved assessment of valid existing guardian permission. Guardians may also contact us or their club to review or withdraw permission. They must never use or share the child’s credentials. Transfer to another club requires its own assessment of applicable authority; it does not automatically transfer the old club’s evidence. On turning 18, the user accepts for themselves.

You may request correction of your own inaccurate birthdate. Routine corrections may pass an automated review without a club administrator when the change does not override conflicting authoritative evidence or make a current or future access restriction less protective. We preserve the original information, its source and the correction decision. An accepted routine correction updates your own recorded birthdate and any player record already securely linked to your account, with a correction receipt. It cannot move an eligibility date earlier, extend a permission, override conflicting club age information or establish guardian authority. Conflicts and changes that would increase access need appropriate additional review or verification.

The planned handover will be available only after its account and permission controls have been implemented and verified. When the server establishes that the player has reached 13 and meets the current account requirements, a popup will offer the verified parent a handover to the player’s own email and account. The player must verify their own email and accept the current terms before the new player access is activated. The parent’s identity and personal account, the player’s history and original evidence remain intact. Handover grants no optional permissions. Valid guardian-controlled permissions remain subject to their original scope, expiry and withdrawal. A pending, expired or canceled handover does not change existing account control.

2. Information collected and how it is used

• Account and roster: name, login email, recorded or supplied player birthdate for player account routing, team, profile details, guardians and access permissions. A basic roster record outside that routing may omit the birthdate. These support club membership, age checks, schedules and access to the player’s records. A basic roster record does not itself authorize sign-in, health processing, messaging or access by a parent.
• Development and participation: training and match information, goals, evaluations, self-reviews, attendance and performance information entered by the club or player.
• Optional health information: wellness responses, availability, injuries, restrictions, load and fitness information. This requires separate permission and is used to support training and player care, not medical diagnosis.
• Optional media: profile photos, match or training video, clips and player tags. Media can identify a child even when their name is omitted.
• Optional communication: messages, replies and related service notifications. Authorized club administrators can audit club messages for safety. Parents can request review through their club or us.
• Security and consent: access and activity records, acceptance versions and timestamps, signed forms and review evidence. Technical providers may receive network identifiers needed to deliver and secure the service.

We do not require optional health information, media or external sharing as a condition of basic player-account access. Clubs must collect only information needed for the selected features. Free-text and uploaded content must not contain unnecessary sensitive information.

3. Who receives information

Authorized club staff receive information according to their roles and teams. Players have limited access to their own records and permitted team functions. Service providers host, authenticate, store, deliver and protect information on our behalf; the current provider list is in Section 3 of the Privacy Notice. These necessary service functions are explained in the parental notice. Optional delivery of identifiable clips outside the platform requires its own permission.

We do not sell children’s information, use it for targeted advertising, or train AI models on it. Current AI assistance is for staff. Children’s personal information, health records, photos, video and messages must not be submitted to external AI tools through staff prompts. Future AI or machine-learning features involving player data require a separate review of purpose, consent, provider terms, retention and access before activation; agreeing to this notice does not authorize future training.

4. Your choices and rights

• Review or obtain a copy of your child’s information and correct inaccurate details.
• Decline optional health, media, messaging or external-delivery purposes, or withdraw a specific permission without opening an under-13 direct account.
• Withdraw account permission and stop further use requiring that permission.
• Request deletion, including relevant originals, copies, reports and processors; receive an explanation of any narrowly scoped lawful hold.

Use the separate guardian channel where your relationship is verified, or contact legal@oneclubos.com or the club. Requests and withdrawal must remain available without accepting revised terms. We verify authority before disclosure. A previously issued playback link can remain usable until expiry and downloaded copies cannot be recalled automatically; affected recipients must comply with applicable deletion duties. Withdrawal restricts further permitted use and is distinct from deletion.

5. Retention and security

Every child-data category needs a specific purpose and bounded retention schedule. Review permissions when notice, purpose, relationship or scope changes and at expiry, and review continuing necessity at least annually. An open club account is not a reason to keep every child record. New uses with unresolved retention remain restricted.

Consent evidence and player media are private. The Privacy Notice states the approved video and new wellness, GPS, clinical/status and sanitized-import periods. Existing records remain restricted pending review, with no automatic deletion under the new schedule. Shorter source permissions and valid erasure requirements take priority. Verified deletion includes relevant copies and recipients. Backup limits must be verified and deletions and withdrawals reapplied before restored data becomes accessible.