Trust center
Kids first, then everything else
What we do with your players' data, how ClinIQ stays honest, and where our security and compliance work really stands. In-progress items are labeled as in progress. This page describes how we are building the product. The preview runs on demo data.
Preview: describes the product we are building.
Kids-first data
How we handle young players' data
Consent states you can see
Every player shows a consent state: not requested, requested, granted or withdrawn. No data about a player on your roster is shown or used until a parent or guardian agrees. Game film can show opponents and non-consented players; that film stays staff-only.
Parents see only their child
A parent login shows their own child's schedule, assigned plays and messages. Nothing about other players.
No medical detail
Wellness and availability only, like out or limited. No diagnoses, injuries in detail, or clearances. ClinIQ never decides who is cleared to play.
No ad tracking of minors
No ads in the product, no third-party advertising trackers, and no selling or sharing of kids' data.
Export and delete
Coaches and families can export their data and ask for deletion. Withdrawing consent removes a player's film and data from the team's workspace.
Opponents stay anonymous
Players who are not on your roster can appear in film. They stay staff-only, are never named or tracked as individuals, and never appear in shared exports.
Non-consented teammates
A coach can hide this player from player and parent views, so film they appear in stays staff-only. Per-player blur is Coming 2027.
AI transparency
AI that shows its work
ClinIQ is marked with the sparkle and the word ClinIQ wherever it speaks.
ClinIQ
Citations on every claim
ClinIQ answers link to the play, clip time or stat row they came from.
ClinIQ
Suggestions wait for review
Coaches tag the film. ClinIQ's suggested tags (beta) show as “Suggested · needs review” with an illustrative confidence label, and nothing is applied until a coach confirms it.
ClinIQ
You approve what leaves the staff
Messages to players or parents, published plays and schedule changes wait for a person to approve them.
ClinIQ
Agents act as you, never more
An agent has the permissions of the person who started it.
ClinIQ
No training on your film without opt-in
Your film and plays are not used to train models unless you turn that on.
Security
Protecting the workspace
Status as of October 2026
Encryption in transit and at rest
PlannedThe plan is TLS for all traffic, with stored data and film encrypted at rest. The preview stores no real data.
Tenant isolation in the database
PlannedPlanned: each team's data isolated in the database, with every row under an organization and row-level security, not only app code.
Two-factor authentication
PlannedPlanned for every coach and director account.
Audit log
PlannedPlanned: who changed what, and when, for Program owners.
Single sign-on on District
PlannedSAML single sign-on for school districts and large clubs on the District plan.
Compliance
Where we really are
We have not finished any audit yet. This table is the honest state of the work, and we update it when it changes.
Status as of October 2026
| Item | Where it stands | Status |
|---|---|---|
| Children's privacy (COPPA) | Players under 13 join through a verified parental consent step: the guardian signs a consent form and enters a one-time code. In preview (consent flow). A $0.50 card check is Coming 2027. We are designing for the amended COPPA Rule with counsel: a written retention schedule and a published subprocessor list before launch. No data about a player on your roster is shown or used until a parent or guardian agrees. Game film can show opponents and non-consented players; that film stays staff-only. | Planned |
| Player tracking | No face or gait recognition. Players are identified by jersey number and the roster you confirm. No face templates or biometric IDs. | Planned |
| Messaging with minors | Coming 2027. Needs parental consent and moderation before launch. The two-adult rule (a guardian copied on direct messages from staff to a player) is part of that design. | Planned |
| School districts (FERPA, SOPPA) | Many states have student-data privacy laws (130+ in 41 states, per FPF). We plan to sign the SDPC National DPA and state addenda, starting with Illinois (SOPPA). Illinois districts need a signed DPA under SOPPA. No DPA is signed today. Source: Future of Privacy Forum on state student-privacy laws. | Planned |
| Accessibility | Designed toward WCAG 2.1 AA; not yet audited. VPAT planned before district sales. Why it matters to districts: The DOJ's ADA Title II rule sets web and app accessibility dates for public entities, including school districts: April 26, 2027 for larger ones and April 26, 2028 for smaller ones. Source: Reed Smith on the DOJ Title II accessibility dates. | Planned |
| SOC 2 Type I | Planned, target 2027. We have no report to share. | Planned |
| SOC 2 Type II | After Type I. Not started. | Planned |
| Third-party penetration test | Planned before general availability. | Planned |
Subprocessors
Who may touch your data
Categories only for now. We will name each provider here and tell account owners before the list changes.
Status as of October 2026
| Category | Purpose | Region | Status |
|---|---|---|---|
| Cloud hosting and database | Runs the app and stores structured data | United States | Planned: named before launch |
| Object storage and video processing | Stores and transcodes film clips | United States | Planned: named before launch |
| AI model providers | Answers and clip-to-play, under no-training terms | United States | Planned: named before launch |
| Email and notifications | Sends invites, receipts and alerts | United States | Planned: named before launch |
| Payments | Processes subscriptions. We never see card numbers. | United States | Planned: named before launch |
| Error monitoring | Finds crashes, with personal data scrubbed | United States | Planned: named before launch |
Responsible disclosure
Found a problem? Tell us.
We will thank you, not threaten you.
- Email security@hoopscliniq.com with steps to reproduce.
- We acknowledge within two business days and keep you updated until it is fixed.
- Please do not access other people's data, and give us a reasonable time to fix before you publish.
- If you act in good faith under these rules, we will not pursue legal action.
- Never test with real children's data.
Your next game plan starts with your own film.
We load your plays and tag one of your games by hand. Your staff and players use ClinIQ and quizzes for four weeks. Or start with the free play library: no account.