Privacy policy.

What we collect.

On this site

This site has no forms and does not ask you for personal information. It uses PostHog analytics to see which pages are visited and how the site performs (no screen recording on this site), and Cloudflare, which serves the site, keeps short-lived request logs (IP address, browser, pages requested) to run and protect it.

In the app

Your account: your name, email address, and password (stored by our sign-in provider, never readable by APX), your mobile number and whether you agree to texts, your role (parent or guardian, or adult athlete), and an adult athlete's date of birth.

Each athlete: name, date of birth, sex, sport and position, emergency contacts, the people allowed to pick them up, a check-in photo, and the answers to the health questions in their profile (such as allergies, conditions, medications, and concussion or heart history).

Testing: results from the VALD systems at the lab (ForceDecks force plates, ForceFrame isometric strength, HumanTrak markerless motion capture, and SmartSpeed sprint timing gates), height, weight, and sitting height, and the reports we write from them. Motion capture records video only to produce movement measurements. We do not use any of this, or the check-in photo, to recognize people automatically.

Program history: bookings, attendance, plans, payments, and signed agreements. A signature records the signer's name, the time, and the IP address and browser it was signed from.

Payments: card and bank details go straight to Stripe, our payment processor. APX sees the payment, the card brand, and its last four digits, never the full number.

Use of the app: PostHog records which pages are used and replays sessions with every piece of text and every form entry masked, so a replay shows the layout and clicks, not names, health answers, or results. Clicks are not recorded on athlete, health, and signing pages, and private link codes are removed from page addresses. Vercel, which hosts the app, measures page visits and loading speed without cookies. Sentry records app errors, with health fields and payer details removed.

How we use it.

Only to run assessments and write reports; design and adjust training; track progress and share results with you; keep the lab safe and respond to emergencies; schedule, book, and bill; send the emails the app sends (sign-in links, booking and payment receipts, agreement copies, and reports); fix and improve the site and app; and meet legal, insurance, and safety obligations. We may combine results with names and identifying details removed to improve our programs and age-group comparisons, and we will not try to re-identify them.

We do not sell personal information, do not share it for cross-context behavioral advertising, and do not use an athlete's information to advertise to or profile them.

Who sees it.

APX staff and coaches who need it to work with the athlete.

Service providers, under contract, only to provide their service to us:

• Supabase: database, sign-in, and file storage, hosted in Canada.
• VALD: testing systems and results storage.
• Vercel: app hosting and cookieless visit and speed measurement.
• Cloudflare: site hosting and security, and the bot check on the sign-up and sign-in forms.
• Stripe: payments.
• Resend: email delivery.
• Sentry: error monitoring.
• PostHog: analytics on the site and the app.
• Anthropic: AI writing assistance. It drafts the written analysis of test results from the results and body measurements (including height, weight, and growth), test dates, age, sex, sport, position, dominant arm and leg, sport packs, years of training, the planned retest week, and which tests were not done and, for some, a short reason. It never receives names, dates of birth, contact details, or medical answers, and a coach reviews every page before it is shared.

Apart from the database, our providers store data in the United States.

You. An athlete's report is a private page, not a public one. Its link, including the QR code on the one-page take-home sheet a coach may print after testing, opens it only for the athlete's parents and guardians (and the athlete, once they have their own login) and APX coaches and admins, after signing in. A family can read it once every current agreement is signed.

Emergency personnel, as described in the emergency medical authorization you sign, and others when the law requires it.

Cookies and analytics.

The app uses cookies to keep you signed in; it cannot work without them. PostHog's analytics cookie is shared by this site and the app, so a visit here and later use of the app count as the same visitor. PostHog receives your IP address and uses it to estimate your general location. Analytics are not linked to your name or account.

On this site, analytics are on unless you decline them in the banner; your choice is saved in this browser, and clearing this site's data brings the banner back. The app does not have its own analytics choice yet, and declining on this site does not turn off analytics in the app. To block them there, block cookies for apxathletelab.com or use a tracker blocker in your browser; the app will still work.

How long we keep it.

• Performance, health, and program data: while the athlete is active and for 3 years after their last session, then deleted or de-identified.
• Signed agreements and incident records: 4 years after the athlete's last session, or until a minor athlete turns 22 if that is later.
• Payment records: as long as tax law requires.
• Check-in photo: deleted with the athlete's other data, or sooner on request.
• Account details: while the account is open, then with the data above.
• Analytics, error reports, and hosting logs: for the limited period each provider keeps them under our account settings.

We keep information longer only when the law, an insurer, or an open claim requires it.

Children.

This site is meant for parents, guardians, and adult athletes, and we do not knowingly collect personal information from children through it. In the app, a parent or guardian creates the family account, adds each athlete under 18, and consents to the athlete's data notice. Athletes under 13 never have their own sign-in; their information comes from a parent or guardian, or from APX staff during sessions. When an athlete turns 18, we ask them to agree to the data notice for themselves.

Security.

Information is stored with access controls and encrypted in transit, and only the people who need it to serve the athlete can see it. If a breach affects your information, we will notify you as California law requires.

Your rights.

You (and, for athletes 13 and older, the athlete) may ask APX to give you a copy of the information we hold, correct it, delete it (except what we must keep, above), limit its use to what is needed to provide our services, or withdraw consent for the future. California residents have these rights under the California Consumer Privacy Act; we do not sell or share personal information as that law defines those terms.

Email privacy@apxathletelab.com or ask at the front desk. We may need to confirm your identity, and we will respond within 45 days. APX will not treat you or the athlete differently for making a request. Withdrawing consent to testing data ends testing, because the data is needed to provide it; it does not affect what was collected before.

Questions.

Email hello@apxathletelab.com, call (858) 899-0098, or write to Athletic Performance Index Partners, LLC, 165 Denny Way, El Cajon, CA 92020. If this policy changes, we will update the effective date at the top of this page; a change to an athlete's data notice that matters is asked for in the app before the next session.