Platform Privacy Notice

Your club, academy or organisation decides to use Why Not I, decides who is enrolled, and decides what happens as a result of anything the platform shows. In data protection terms it is the controller of your information.

Why Not I Ltd operates the platform on your organisation's instructions. We are the processor.

This matters for a practical reason: if you want to exercise a right over your information, the decision rests with your organisation, not with us. We will pass any request to them and help them answer it. Your organisation will also have its own privacy information, which applies alongside this notice.

Why Not I Ltd
1st Floor Cannon Mill, Gunco Lane, Macclesfield SK11 7JL
Company number 15020809 · ICO registration ZC241339
privacy@whynoti.co.uk

We have not appointed a Data Protection Officer. Our processing is not carried out on a large scale within the meaning of Article 37(1)(c), and we keep this under review.

Which law applies. Where your organisation is in the United Kingdom, the UK GDPR applies. Where it is in the European Union, the EU GDPR applies and your organisation answers to its own national supervisory authority. The protections described here are the same either way.

You complete two short structured check-ins a day, each taking around 60 to 90 seconds. They cover how you are functioning and how your body feels. You can also keep a private journal and raise a request for support.

The platform learns what is normal for you as an individual and highlights when something moves away from it. Staff at your organisation see an indication of state and direction — whether a conversation might be worth having. They do not see numeric scores from your behavioural answers, rankings, or any comparison between athletes.

The platform is not a clinical or mental health service. It does not diagnose, assess, treat or provide care, and it is not a substitute for medical, psychological or safeguarding support. It surfaces signals and routes them to people who already hold responsibility at your organisation. Every decision about you is made by a person, not by the platform.

Account and profile

Name, preferred name, date of birth, email address, mobile number, sport, club or team, role, notification and display preferences, acceptance of terms, account status.

Profile photographs are not enabled and no images are stored.

Security

Password (stored only as a cryptographic hash), records of failed sign-in attempts and lockouts, invitation and password reset tokens, session tokens, two-factor authentication settings.

Behavioural check-in information

Your responses to structured check-in questions, the dates and times you submit them, situational context you choose to record, requests for support and how they were resolved, your individual baselines, derived measures and trends, and completion rates.

Physical information

As part of the same check-in: soreness and the area affected, how long you slept, the quality of that sleep, and how physically fresh you feel.

This is held separately from your behavioural responses. The two are never combined, never averaged together and never presented as a single figure.

Journal entries

The text of entries, whether an entry is private or has been shared, and timestamps. See the section on your journal below.

Records created by the platform

Records of support requests and signals and where they were routed, notification records, organisation settings, and audit logs.

Staff cannot record free-text notes about athletes within the platform. This functionality does not exist.

Technical information

When the platform is used we automatically record the requested route and method, response status, response time, database query and error counts, and network metadata. Our hosting providers record IP addresses, request headers and access logs.

What is not collected

Location or GPS data, advertising identifiers, device fingerprints. No tracking for advertising. Nothing is sold to anyone.

Information about how you are feeling and your psychological state is health information, which is treated as special category data under Article 9 and given additional protection in law. So is information about your sleep, soreness and physical condition.

We recognise this. The fact that the platform is not a clinical service does not change how the information is classified. Check-in responses, physical readings, journal entries and support records are treated as special category information throughout.

This describes a deliberate design decision and is stated in full because you are entitled to rely on it.

No member of staff can read your private journal entries. Not your coach, not medical staff, not player care, not anyone at your organisation.

Private entries are inert. They are excluded from every trend, score, measure, insight, monitoring process and signal. Nothing you write changes anything a member of staff sees, directly or indirectly.

There is no monitoring of journal content. No automated flagging, no distress detection, no scanning for words or themes. This applies equally to adults and to athletes under 18.

Staff are shown nothing journal-related at all — not the content, not whether an entry exists, not when it was written, not whether you keep a journal.

The journal is optional. Nobody is required to use it, and no member of staff can see whether you do.

You may share an individual entry if you choose. That is always an explicit, entry-by-entry decision. Nothing is shared automatically. A shared entry can be read by staff, but still feeds no trend, score or measure.

You can delete any of your own entries at any time, and that takes effect immediately.

You can see your own journalling streak. It counts only whether an entry was written, never what it says, and it is visible to you alone.

Because journal entries are not monitored, the journal is not a route for raising something urgent. If you need help, the platform provides a support request on every screen, and your organisation's own support and safeguarding routes remain available at all times.

Your organisation decides this, not us. As controller, it determines and documents the basis on which it relies, and it will tell you what that is. If you want to know, ask your organisation.

What we can tell you is how the arrangement generally works.

Participation in the platform is normally set by the organisation as part of its performance programme, in the same way as GPS tracking, load monitoring and medical screening. Where that is the case, the organisation does not rely on your consent for the operational use of the platform, because consent must be freely given and capable of being withdrawn, and a squad requirement is neither. Presenting it as consent would misdescribe what is actually happening.

The basis may differ depending on your situation. An athlete on a professional contract of employment, an athlete on a scholarship agreement, and a member of staff are in different positions, and your organisation may rely on a different basis for each. Its own privacy information will set this out.

In an emergency. Where there is a genuine risk to someone's life, information may be shared with emergency services or other appropriate authorities. The platform does not monitor for emergencies and is not designed to detect them — this covers the situation where a person at your organisation already holds information and needs to act on it.

Where consent genuinely applies, it is asked for separately. Research and improvement of the behavioural model are our own purposes as controller, and we carry them out only where an athlete has separately and specifically agreed. That agreement is never bundled with anything else, refusing it has no effect on anything, and it can be withdrawn at any time. Your organisation is never told who agreed and who did not.

What remains yours regardless. Whatever your organisation requires, you may always turn off AI-generated observations, delete your own journal entries, choose never to use the journal, and refuse or withdraw research agreement.

You see everything held about you, including the full numeric detail of your own responses, measures and trends, and your own journal.

Staff see information only for athletes at their own organisation, and only within their role. There are three roles — coaching, medical and performance, and player care — and each sees different things.

Staff never see:

• Any numeric value derived from behavioural check-in responses, for any athlete or team, including on chart axes
• Individual responses to behavioural questions
• Any single combined or composite score — none is calculated or stored anywhere in the platform
• Rankings or comparisons between athletes
• The structure of the underlying behavioural model
• Private journal entries, in any form

Staff do see indications of state and direction, check-in completion, situational context you have recorded, journal entries you have expressly chosen to share, and support requests where their role receives them.

Physical information is treated differently. Staff in a medical and performance role see physical readings in full, including numeric values, the body area you recorded, and a count of how many athletes in the squad have reported soreness in a given area. This is the only place any numeric value is shown to a member of staff, it never includes behavioural information, and it exists because medical staff cannot do their job with a direction of travel alone. Coaching and player care roles see only that a physical flag has been raised, without values.

Organisation administrators manage users and settings for their own organisation only.

Why Not I administrators have technical access for support, security and maintenance. This is limited to named individuals, recorded in audit logs, and used only where necessary to operate the service.

Where your check-in responses indicate you may benefit from support, the platform routes an indication to the appropriate staff. It does not appear on a coaching dashboard.

• Performance signals — readiness, self-belief, response to challenge — reach coaching and performance staff.
• Support signals — how you are feeling, whether you feel supported, or a support request you have raised — do not reach coaching staff. They go to player care and, where your organisation's process requires it, its designated safeguarding lead.
• Physical flags reach medical and performance staff with the detail, and coaching and player care with the flag only. Thresholds are set deliberately high, because soreness and fatigue are normal in daily training, and they are configurable by your organisation.
• Journal content routes nowhere.

Staff are never told what you answered. They are told that a conversation is advised.

Every route ends with your organisation, acting under its own support and safeguarding policies. Why Not I does not assess risk, does not make decisions about any athlete, and does not hold a duty of care towards athletes.

The platform processes information automatically to produce what you and your staff see. It calculates measures from your check-in responses, builds an individual rolling baseline from your own history, and identifies where current responses differ from that baseline.

This is profiling under data protection law, and we describe it plainly because you are entitled to understand it:

• Baselines are individual. You are compared against your own normal pattern and never against other athletes.
• No indication is produced until the platform has enough of your own history to be meaningful, so there is a period at the start during which no signal is produced at all.
• No indication is ever produced from a single response.
• No combined score is calculated at any point.
• The platform applies fixed thresholds to physical readings and raises a flag where a reading reaches the defined level. Unlike behavioural signals, these do not depend on a baseline and can be raised from a single response.
• The platform runs internal checks on data quality — for example, identifying where responses appear to have been submitted without being considered. These affect how much weight the platform gives the information internally. They are never shown to staff and are not a judgement about you.

No decision about you is made by the platform. Every output is a prompt for a human being to have a conversation. Decisions about selection, participation, medical care, support and safeguarding are made by people at your organisation, using their own judgement. There is no automated decision-making producing legal or similarly significant effects within the meaning of Article 22.

The platform uses an AI service provided by Anthropic to generate a short written reflection back to you on your own check-in responses.

What is sent. A constructed summary containing labelled check-in values and recent trends from the last fourteen days.

What is not sent. Names, athlete identifiers, dates of birth and organisation details are not sent. The information is pseudonymised.

Journal entries are never sent. Journal text does not leave the platform. This is enforced in the platform's own database logic rather than by a setting.

The reflection is stored alongside the check-in and kept for the same period. You can turn reflections off for yourself at any time.

We use Anthropic's standard commercial terms, under which the information we send is not used to train AI models and is retained only for a limited period for operational and safety purposes. A data processing agreement, including standard contractual clauses, forms part of those terms.

If we later introduce any feature involving AI processing of journal content, it will require fresh, specific agreement and an update to this notice. It will not be introduced by changing a setting.

We do not sell personal information and we do not share it for advertising.

Information is shared with your own organisation, as set out above, and with the service providers we rely on to operate the platform:

Each is bound by a written contract requiring them to process information only on our instructions and to keep it secure. Your organisation is given at least 30 days' notice before a provider is added or replaced.

Push notifications contain only a device token and generic text such as a reminder to complete a check-in. No personal, behavioural or physical detail is sent to Apple or Google. Any detail is retrieved from our own systems after the app is opened.

We may also disclose information where required by law, or where necessary to protect someone's vital interests.

Our primary hosting is in the Netherlands.

For athletes at a UK organisation, the Netherlands is covered by UK adequacy regulations. Where information is transferred to a country without adequacy, we rely on the International Data Transfer Addendum to the European Commission's standard contractual clauses.

For athletes at an EU organisation, hosting in the Netherlands is not a transfer at all. Our web application hosting is in the United Kingdom, which is covered by the European Commission's adequacy decision for the UK. For providers in the United States we rely on standard contractual clauses.

We treat information generated at pilot scale as pseudonymised rather than anonymised, and therefore as still within the scope of data protection law. A small squad at a single named organisation, with dates attached, is plausibly re-identifiable to anyone holding a team sheet, and we do not claim otherwise. We do not describe information as anonymised unless a dataset is large enough that the claim genuinely holds.

• All information is encrypted in transit using HTTPS/TLS
• Stored information is encrypted at rest by our hosting provider
• Passwords are stored using bcrypt hashing and are never stored in readable form
• Session tokens on mobile devices are held in the device's secure storage
• Two-factor authentication is required for all staff accounts and available to athletes
• Access is restricted by role and enforced by our systems, not merely hidden in the interface
• Administrative access is recorded in audit logs

No system can be guaranteed completely secure, but we take these measures seriously and review them as the platform develops.

Under data protection law you have the right to be informed about how your information is used, to access it, to have inaccurate information corrected, to have information erased in certain circumstances, to restrict how it is used, to object to certain processing, to receive it in a portable format, to withdraw agreement where processing relies on it, and not to be subject to decisions made solely by automated means with legal or similarly significant effects.

Because your organisation is the controller, requests are decided by them. You can raise a request with your organisation directly, or with us at privacy@whynoti.co.uk — we will acknowledge within five working days and pass it to your organisation, and help them respond.

You can see all of your own information within the app at any time. That is not a formal response to an access request, and it does not limit your rights or your organisation's obligations.

Some things do not require anyone's agreement. You may delete individual journal entries, turn off AI-generated reflections, choose never to use the journal, and refuse or withdraw research agreement. These take effect immediately.

Deleting your account. Accounts are created by your organisation, not by you. You can request deletion from within the app in account settings, or at whynoti.co.uk/delete-account if you no longer have the app installed. We acknowledge within five working days and pass the request to your organisation's administrator, because it is the controller and decides what may be deleted while you remain part of its programme. Where deletion is agreed, it is completed within 30 days.

When you leave the organisation, your information is deleted twelve months later as set out above, whether or not a request has been made.

The platform is used by athletes aged 16 and over. It is not offered to anyone under 16.

Under data protection law a young person of 13 or over can generally exercise their own rights over their information. Your organisation may nevertheless decide to involve a parent or guardian before a young person takes part, and many do. Where that is the case:

• A parent or guardian receives an information sheet explaining what the platform does in plain terms
• The young person receives their own version of that explanation and acknowledges it themselves
• Concerns about participation are raised with the organisation, which sets the requirement and is the party able to vary it
• The journal protections above apply in full, and do not change because an athlete is under 18

We have regard to the Information Commissioner's Age Appropriate Design Code, including keeping settings private by default, collecting no more information than is needed, avoiding reward loops and peer comparison, and explaining what happens in language a young person can understand.

We will update this notice when the platform changes. Where a change is significant — particularly any change affecting journal entries, signal routing or AI processing — we will tell athletes and organisations directly and, where the change requires it, seek fresh agreement. We will not make a material change by adjusting a setting.

The date of the current version appears at the top.

Ask us directly at privacy@whynoti.co.uk, or raise it with your organisation.

If you are unhappy with how your information has been handled, you can complain to the data protection regulator. In the United Kingdom that is the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk. If your organisation is in the European Union, you can complain to the supervisory authority in your own country.

Why Not I Ltd. For information about our own website and business contacts, see our company privacy policy.