Minors' health data. Taken seriously.
Nex AMS stores wellness questionnaires, injuries, assessments and maturation. That's health data, almost always about minors. GDPR treats it as a special category, and so do we.
What this means in practice.
Who is responsible for what.
The club is the controller of its athletes' data. Nex Performance is the processor and handles the data only on the club's instructions. No data goes into the platform without a signed Article 28 GDPR data processing agreement, including during a trial. The agreement is being prepared with legal support and is sent to the club before any trial begins.
Where the data lives.
Hosting and the database are in the United Kingdom, in London. The UK is not an EU Member State, but the European Commission has recognised its level of data protection as adequate, in a decision renewed in December 2025. In practice, data can move between the EU and the UK without additional safeguards, as it does between Member States. If that adequacy decision lapses or is withdrawn, the data processing agreement obliges us to put standard contractual clauses in place or to move the hosting into the European Union, at no cost to the club.
What's in place.
Role-based access: each user sees only what concerns them. Each club's data isolated at the database level. Authentication with signed sessions. Encryption in transit and at rest.
Data subject rights.
We help the club answer requests for access, rectification, erasure and portability, within the legal deadlines.
If there's a data breach.
We notify the club without undue delay, with the information it needs to meet its own notification obligations within the 72 hours of Article 33.
End of contract.
The data is the club's. You can export everything in a structured format during the contract and for 30 days after it ends. After that it is deleted, with a certificate of deletion on request.
Subprocessors.
Vercel (application hosting, London), Supabase (database, London), Resend (transactional email), Formspree (this site's forms, United States) and Calendly (meeting scheduling, United States). Formspree and Calendly never handle athlete data.
Support channel.
During onboarding you have a direct channel to us for questions about using it. It's not for sharing identifiable athlete data or health information.
Questions about your athletes' data?
In a 30 minute call we answer whatever the club needs to know before deciding, and go through what the data processing agreement will say.