Privacy Policy

Why Not I Ltd (“Why Not I”, “we”, “us”) is a company registered in England and Wales. We provide a behavioural performance platform to sporting organisations.

Registered address: 1st Floor Cannon Mill, Gunco Lane, Macclesfield SK11 7JL
Company number: 15020809
ICO registration number: ZC241339
Contact for privacy matters: privacy@whynoti.co.uk

We have not appointed a Data Protection Officer. Our processing is not carried out on a large scale within the meaning of Article 37(1)(c) of the UK GDPR, and we keep this under review as the number of organisations we work with grows.

This policy applies to:

• Athletes who use the platform through their club, academy or organisation
• Staff at those organisations who use the platform in their professional role
• Parents and guardians of athletes under 18
• Visitors to whynoti.co.uk

Where an organisation deploys the platform, that organisation will also have its own policies covering how it handles player information. This policy covers what we do. It does not replace anything your club tells you.

Our role is split.

We act as a processor, on the instructions of the client organisation, for the operational use of the platform — check-ins, journals, trends, staff visibility, support requests and support routing. The organisation decides to deploy the platform, decides who uses it, and decides what to do with what it sees.

We act as a controller for our own purposes — analysis and improvement of the behavioural model, security and service administration, research where separate agreement has been given, and our own business contacts and website.

Where we act as processor, the client organisation is the controller and its own privacy information applies alongside this policy. Where we act as controller, this policy governs.

Athletes complete two short structured check-ins a day, covering both how they are functioning and how their body feels. They can keep a private journal and raise a request for support.

The platform builds a picture of an individual athlete’s normal pattern over time and highlights movement away from it. Staff at the organisation see an indication of state and direction — whether someone might benefit from a conversation. Staff do not see numeric scores derived from behavioural responses, rankings, or any comparison between athletes.

The platform is not a clinical or mental health service. It does not diagnose, assess, treat or provide care, and it is not a substitute for medical, psychological or safeguarding support. It surfaces signals and routes them to people who already hold responsibility within the organisation. Every decision about an athlete is made by a person, not by the platform.

5.1 Account and profile information

Name, preferred name, date of birth, email address, mobile number, sport, club or team, role, notification and display preferences, acceptance of terms, and account status.

Profile photographs are not enabled and no images are stored.

5.2 Security information

Password (stored only as a cryptographic hash), records of failed sign-in attempts and account lockouts, invitation and password reset tokens, session tokens, and two-factor authentication settings.

5.3 Check-in and behavioural information

Responses to structured check-in questions, the dates and times of submissions, situational context an athlete chooses to record, requests for support and how they were resolved, individual baselines, derived measures and trends, and completion rates.

5.4 Physical information

As part of the same check-in, athletes record information about their body: soreness and the area affected, how long they slept, the quality of that sleep, and how physically fresh they feel.

This is held as a separate type of information from behavioural responses. The two are never combined, never averaged together and never presented as a single figure.

5.5 Journal entries

The text of entries, whether an entry is private or has been shared, and timestamps. See Section 7.

5.6 Organisation and system records

Records of support requests and signals and where they were routed, notification records, organisation settings, and audit logs.

Staff cannot record free-text notes about athletes within the platform. This functionality does not exist.

5.7 Technical information

When the platform is used we automatically record the requested route and method, response status, response time, database query and error counts, and network metadata. Our website and hosting providers record IP addresses, request headers and access logs.

5.8 What we do not collect

We do not collect location or GPS data, advertising identifiers, or device fingerprints. We do not use tracking for advertising purposes and we do not sell personal information to anyone.

Information about how someone is feeling and their psychological state is health information, which is treated as special category data under Article 9 of the UK GDPR and given additional protection in law. So is information about a person’s sleep, soreness and physical condition.

We recognise this. The fact that the platform is not a clinical service does not change how the information is classified, and we treat check-in responses, physical readings, journal entries and support-related records as special category information throughout.

This section describes a deliberate design decision and is stated in full because athletes are entitled to rely on it.

Private journal entries are inert. They are not read by staff. They are not read by us in the ordinary course of operating the platform. They are excluded from every trend, score, measure, insight, monitoring process and support signal. Nothing written in a private journal changes anything a member of staff sees, directly or indirectly.

There is no monitoring of journal content. There is no automated flagging, no distress detection, and no scanning of entries for words or themes. This applies equally to adult athletes and to athletes under 18.

Entries are private unless the athlete chooses otherwise. An athlete may choose to share an individual entry with staff. Sharing is always an explicit, entry-by-entry decision. Nothing is shared automatically or by default. A shared entry can be read by staff at the organisation, but even a shared entry does not feed any trend, score or measure.

Private entries do not appear to staff in any form. Staff are not shown the content, the fact that an entry exists, when it was written, or whether an athlete keeps a journal at all. Nothing about a private entry is communicated to staff, directly or indirectly.

The journal is optional. No athlete is required to use it, and no member of staff can see whether an athlete does. An athlete may delete any of their own entries at any time, and that takes effect immediately.

Athletes can see their own journalling streak. This counts only whether an entry was written, never anything about what it says, and it is visible to the athlete alone. It is not shared with staff and it is not compared against other athletes.

Because journal entries are not monitored, the journal must not be relied upon as a route for raising something urgent. If an athlete needs help, the platform provides a support request, and the organisation’s own support and safeguarding routes remain available at all times.

The platform is deployed by a sporting organisation as part of its performance programme. Participation is set by the organisation as a squad requirement, in the same way as GPS tracking, load monitoring and medical screening, and sits within an athlete’s contract or scholarship agreement alongside other performance obligations.

The organisation is the controller for this processing and determines the basis on which it relies. That is ordinarily its legitimate interests under Article 6(1)(f) — supporting the performance, readiness and support of its athletes — together with an Article 9 condition relating to obligations in the field of employment, and the corresponding condition in Schedule 1 of the Data Protection Act 2018.

We do not rely on athlete consent for the operational use of the platform, because consent must be freely given and capable of being withdrawn, and participation in a squad requirement is neither. Presenting it as consent would misdescribe what is actually happening.

Consent is used where it genuinely applies. Research and platform improvement are ours as controller, and are carried out only where an athlete has separately and specifically agreed. That agreement is never bundled with anything else, refusing it has no effect on anything, and it can be withdrawn at any time.

What athletes are told, and what remains theirs. Every athlete receives a written explanation, before use, of what is collected, who sees what, that no member of staff can read their journal, and that check-in responses may result in a member of staff being told a conversation is advised. Regardless of the organisation’s requirements, an athlete may always turn off AI-generated observations, delete their own journal entries, choose never to use the journal, and refuse or withdraw from research.

We do not use personal information for advertising, and we do not use athlete information to train AI models.

Athletes see everything held about them — their own responses, their own patterns and trends over time, and their own journal. Behavioural information is shown as words describing state rather than as numeric scores. This applies to everyone: no numeric value derived from behavioural responses is displayed to anyone, athlete or staff. Physical readings are shown as recorded.

Staff see information only for athletes at their own organisation, and only within their role. There are three roles — coaching, medical and performance, and player care — and each sees different things.

Staff never see:

• Any numeric value derived from behavioural check-in responses, for any athlete or team, including on chart axes
• Individual responses to behavioural questions
• Any single combined or composite score — none is calculated or stored anywhere in the platform
• Rankings or comparisons between athletes
• The structure of the underlying behavioural model
• Private journal entries, in any form — including their existence, their timing, or whether an athlete journals at all

Staff do see indications of state and direction, check-in completion, situational context an athlete has recorded, journal entries the athlete has expressly chosen to share, and support requests where their role receives them.

Physical information is treated differently. Staff in a medical and performance role see physical readings in full, including numeric values, the body area an athlete has recorded, and a count of how many athletes in the squad have reported soreness in a given area. This is the only place any numeric value is shown to a member of staff, it never includes behavioural information, and it exists because medical staff cannot do their job with a direction of travel alone. Coaching and player care roles see only that a physical flag has been raised, without values.

Organisation administrators manage users and settings for their own organisation only.

Why Not I administrators have technical access to the platform for support, security and maintenance. This access is limited to named individuals, is recorded in audit logs, and is used only where necessary to operate the service.

Where check-in responses indicate that an athlete may benefit from support, the platform routes an indication to the appropriate staff at the organisation — player care or the organisation’s safeguarding lead. It does not appear on a coaching dashboard.

Three things follow from this:

• The routing uses check-in responses only. It never uses journal content.
• Signals about how an athlete is feeling, whether they feel supported, or a support request they have raised, do not reach coaching staff. Signals about readiness and performance do.
• It ends with the organisation. A signal is passed to a person at the organisation, who acts under the organisation’s own support and safeguarding policies. Why Not I does not assess risk, does not make decisions about any athlete, and does not hold a duty of care towards athletes.

Physical readings are routed separately. Where soreness, sleep or freshness reaches a defined threshold, a flag is raised to medical and performance staff, who see the underlying detail, and to coaching and player care staff, who see only that a flag exists. These thresholds are set deliberately high, because soreness and fatigue are normal in daily training, and they are configurable by the organisation.

The platform does not use clinical language and does not make clinical statements about anyone.

The platform processes information automatically in order to produce what athletes and staff see. It calculates measures from check-in responses, builds an individual rolling baseline for each athlete from their own history, and identifies where current responses differ from that individual baseline.

This is profiling under data protection law, and we describe it plainly because athletes are entitled to understand it:

• Baselines are individual. An athlete is compared against their own normal pattern and never against other athletes
• No indication is produced until the platform has enough of an athlete’s own history to be meaningful, so there is a period at the start during which the platform produces no signal at all
• No indication is ever produced from a single response
• No combined score is calculated at any point

The platform also applies fixed thresholds to physical readings — soreness, sleep duration, sleep quality and freshness — and raises a flag where a reading reaches the defined level. Unlike behavioural signals, these do not depend on an individual baseline and can be raised from a single response.

The platform also runs internal checks on data quality — for example, identifying where responses appear to have been submitted without being considered. These checks affect how much weight the platform gives to the information internally. They are never shown to staff and are not a judgement about the athlete.

No decision about an athlete is made by the platform. Every output is a prompt for a human being to have a conversation. Decisions about selection, participation, medical care, support and safeguarding are made by people at the organisation, using their own judgement and their own processes. We do not carry out automated decision-making producing legal or similarly significant effects within the meaning of Article 22.

The platform uses an AI service provided by Anthropic to generate short written reflections back to the athlete on their own check-in responses.

What is sent. A constructed summary containing labelled check-in values and recent trends from the last fourteen days.

What is not sent. Names, athlete identifiers, dates of birth and organisation details are not sent. The information sent is pseudonymised.

Journal entries are never sent. Journal text does not leave the platform. This is enforced in the platform’s own database logic rather than by a setting.

The reflection produced is stored alongside the check-in and kept for the same period. Athletes can turn reflections off for themselves at any time.

We use Anthropic’s standard commercial terms, under which the information we send is not used to train AI models and is retained by Anthropic only for a limited period for operational and safety purposes. A data processing agreement, including standard contractual clauses, forms part of those terms.

If we later introduce any feature that involves AI processing of journal content, it will require fresh, specific agreement from athletes and an update to this policy. It will not be introduced by changing a setting.

We do not sell personal information and we do not share it for advertising.

We share information with the athlete’s own organisation, as described in Section 10, and with the service providers we rely on to operate the platform:

Each is bound by a written contract requiring them to process information only on our instructions and to keep it secure.

Push notifications contain only a device token and generic text such as a reminder to complete a check-in. No personal, behavioural or physical detail is sent to Apple or Google. Any detail is retrieved from our own systems after the app is opened.

We may also disclose information where we are required to do so by law, or where it is necessary to protect someone’s vital interests.

Our primary hosting is in the Netherlands. Some of our providers operate in the United States. Where information is transferred outside the UK, we rely on the appropriate safeguards provided for in data protection law, including UK adequacy regulations where they apply and the International Data Transfer Addendum to the European Commission’s standard contractual clauses where they do not.

We treat information generated at pilot scale as pseudonymised rather than anonymised, and therefore as still within the scope of data protection law. A small squad at a single named organisation, with dates attached, is plausibly re-identifiable to anyone holding a team sheet, and we do not claim otherwise. We do not describe information as anonymised — in this policy, in club material, or in any research output — unless a dataset is large enough that the claim genuinely holds.

• All information is encrypted in transit using HTTPS/TLS
• Stored information is encrypted at rest by our hosting provider
• Passwords are stored using bcrypt hashing and are never stored in readable form
• Session tokens on mobile devices are held in the device’s secure storage
• Two-factor authentication is required for all staff accounts and available to athletes
• Access is restricted by role and enforced by our systems, and administrative access is recorded in audit logs

No system can be guaranteed completely secure, but we take these measures seriously and review them as the platform develops.

Accounts are created by the organisation, not by athletes, and are part of the organisation’s performance programme.

An athlete can request deletion of their account from within the app, in account settings, or through whynoti.co.uk/delete-account if they no longer have the app installed. A request is acknowledged within five working days and routed to the organisation’s administrator, because the organisation is the controller of the information and determines what may be deleted while an athlete remains part of its programme. Where deletion is agreed, it is completed within 30 days.

Deletion removes the account and the personal information held in it, including check-ins, physical readings, trends and journal entries.

Some things do not require anyone’s agreement. An athlete may delete individual journal entries at any time, turn off AI-generated observations, and withdraw from research. These take effect immediately.

When an athlete leaves the organisation, their information is deleted twelve months later as set out in Section 16, whether or not a request has been made.

Where we are required by law to retain particular information, we will retain only what is required and only for as long as it is required.

Under UK data protection law you have the right to:

• Be informed about how your information is used — this policy
• Access the information held about you
• Have inaccurate information corrected
• Have information erased in certain circumstances
• Restrict how your information is used
• Object to certain processing
• Receive your information in a portable format
• Withdraw agreement at any time, where processing relies on it
• Not be subject to decisions made solely by automated means with legal or similarly significant effects

Athletes can see all of their own information within the app at any time. To receive a copy of your information in a portable format, contact us at privacy@whynoti.co.uk.

Where we are acting as processor for an organisation, we will pass the request to that organisation and support them in responding. We will acknowledge within five working days and a response will follow within one month.

The platform is used by athletes aged 16 and over. It is not offered to anyone under 16.

Where an athlete is under 18:

• A parent or guardian receives an information sheet explaining what the platform does in plain terms, and acknowledges it before the athlete begins
• The athlete receives their own version of that explanation, written for a young reader, and acknowledges it themselves
• Where a parent or guardian has concerns about their child taking part, those are raised with the organisation, which sets the requirement and is the party able to vary it
• The protections in Section 7 apply in full — journal entries are not monitored, the journal is optional, and neither changes because an athlete is under 18

We have regard to the Information Commissioner’s Age Appropriate Design Code in designing the platform, including keeping settings private by default, collecting no more information than is needed, avoiding reward loops and peer comparison, and explaining what happens in language a young person can understand.

whynoti.co.uk sets no cookies of its own and uses no analytics or tracking of any kind. There are no third-party trackers, advertising scripts or embedded content on the site.

Our hosting provider may set essential security cookies necessary for the site to operate. These are strictly necessary and require no consent under the Privacy and Electronic Communications Regulations.

When you use the enquiry form on our website we store your name, email address, organisation, role and message so that we can respond to you. This information is held in our own systems and is not shared with any third party. We keep it for 24 months from our last contact with you, and you can ask us to delete it sooner at any time.

We will update this policy when the platform changes. Where a change is significant — particularly any change affecting journal entries, support routing or AI processing — we will tell athletes and organisations directly and, where the change requires it, seek fresh agreement. We will not make a material change by adjusting a setting.

The date of the current version appears at the top of this policy.

If you are unhappy with how we have handled your information, please contact us first at privacy@whynoti.co.uk so we can try to put it right.

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF ico.org.uk