Minors' health data. Taken seriously.
Nex AMS processes wellness questionnaires, injury records, physical assessments and maturation data. This is health data, in most cases about minors, and the General Data Protection Regulation treats it as a special category. This page explains what that means in practice.
Who is responsible for what
The club is the controller of its athletes' data. Nex is the processor and handles the data only on the club's instructions. This relationship is formalised in a data processing agreement under Article 28 GDPR, which I sign with every client before any data enters the platform, including during a trial.
Where the data lives
The hosting infrastructure and the database are in the European Union.
Safeguards in place
Role-based access control, so each user sees only what concerns them. Isolation of each organisation's data at the database level. Authentication with signed sessions. Encryption in transit and at rest.
Data subject rights
I support the club in handling data subjects' requests for access, rectification, erasure and portability, within the legal deadlines.
Data breaches
If a data breach occurs, the club is notified without undue delay, with enough information to meet its own notification obligations within the 72 hours set out in Article 33.
End of contract
The data belongs to the club. It can be exported in a structured format during the contract and for 30 days after it ends. After that it is deleted, with a certificate of deletion on request.
Subprocessors
These are the subprocessors involved in the processing:
- Vercel (hosting)
- Supabase (database)
- Resend (email delivery)
- Formspree (this site's forms)
Direct support channel
During onboarding there is a direct messaging channel for questions about using the platform. That channel cannot be used to share identifiable athlete data or health information.
Want to see the agreement before deciding?
I'll send you the data processing agreement for the club to review in its own time, before any data enters the platform.