Privacy policy | Match Ready: Rugby

The short version

Your training and health data is stored on your phone. It only leaves your phone if you create an account, and then it’s synced to our database hosted in London.
We process health data (such as wellness, mood, sleep, pain and head injury reports) only with your explicit consent, only to run your training plan, and you can withdraw consent at any time.
The optional cycle log, monthly period answers and mood checks during a head injury return stay on your phone and are never sent to us.
We don’t sell your data, show ads, or share your data with clubs, coaches or insurers.
You can export or delete your data in the app at any time.

1. Who we are

Match Ready: Rugby (“the app”, on the stores as “Match Ready: Rugby Training”) and this website are provided by ARX Algorithms Ltd, a company registered in England and Wales (company number 17511371), registered office Office 21751, 182-184 High Street North, East Ham, London, E6 2JA (“we”, “us”).

We are the data controller for the personal data described in this policy. Contact us about anything in this policy at [email protected] or by post at the address above, marked “Data protection”. We are a small company and have not appointed a data protection officer; requests are handled by the company’s director.

2. Who this policy applies to

This policy covers the app and matchreadyrugby.com. The app is for adults aged 18 and over only. We ask for your date of birth at sign-up and don’t allow anyone under 18 to create a plan. If we learn that we hold data about someone under 18, we will delete it.

3. The data we collect

Data you give us in the app

Profile and training details: date of birth, sex, bodyweight, playing positions, lineout role, years of lifting, main-lift numbers or test results, equipment available, preferred session length, club training days, fixtures and season dates.
Training logs: sets, weights, reps and reps in reserve, session ratings and minutes, club training and match logs (including minutes played), full-contact minutes, jump heights you enter, and test results.
Health and wellness data (special category data): daily wellness scores (sleep, soreness, energy, mood and stress), weekly mood and sleep answers, illness answers, pain reports (area, severity and how it felt the next morning), injury reports and any restrictions you record, head injury reports, daily symptom checks and return stage, concussion history, and your answers to the health screening questions (PAR-Q+), including any conditions or medicines you choose to tell us about.
Optional cycle log and period answers: if you choose to turn on the private cycle log (off by default), the first day of each period; if you don’t use the log, an optional monthly question about whether your periods were regular. This data stays on your phone and is never synced to our servers.
Mood checks during a head injury return: kept on your phone only.

If you create an account

Account details: your email address, or the identifier provided by Sign in with Apple or Google (if you use Apple’s “Hide my email”, we only see the relay address), and a user ID.
Synced app data: a copy of your profile, training logs and health and wellness data listed above (except the private on-phone data), so you can use the app on another phone and restore it if you lose yours.

Subscription data

Purchases are made through Apple’s App Store or Google Play. We don’t see or store your card details. Through our subscription provider, RevenueCat, we receive an anonymous app user ID, the product you bought, purchase and renewal dates, trial status, country or store region, and whether the subscription is active.

Support and the launch list

Support emails: your email address and whatever you include in your message.
Launch list: if you ask us to email you when the app launches, your email address and the date you asked.

Website

This website uses no cookies, no analytics and no advertising or tracking scripts. Our host, Cloudflare, processes technical data such as IP addresses and request logs to deliver the site and protect it from attacks.

What we don’t collect

We don’t collect your location, contacts, photos, microphone or camera data. We don’t use advertising identifiers.

4. How we use your data and our lawful bases

Purpose	Data	Lawful basis (UK GDPR)
Building and adjusting your training plan and sessions	Profile, training logs	Contract: to provide the app you asked for (Article 6(1)(b))
Adjusting sessions for readiness, pain, illness and head injury; showing safety and support guidance	Health and wellness data	Contract (Article 6(1)(b)) and your explicit consent for special category data (Article 9(2)(a))
Syncing and restoring your data across devices	Account details, synced app data	Contract (Article 6(1)(b)); explicit consent for health data (Article 9(2)(a))
Managing subscriptions and free trials	Subscription data	Contract (Article 6(1)(b))
Keeping records for tax and accounting	Subscription and transaction records	Legal obligation (Article 6(1)(c))
Answering support requests	Support emails	Legitimate interests in helping you (Article 6(1)(f)); explicit consent if you choose to send us health information
Security, preventing misuse and fixing faults	Account details, technical logs	Legitimate interests in keeping the service secure and working (Article 6(1)(f))
Improving the coaching rules (for example reviewing readiness cut-offs after the first season)	Aggregated or de-identified training data only	Legitimate interests (Article 6(1)(f)); health data only with your explicit consent (Article 9(2)(a))
Telling you when the app launches	Launch-list email	Consent (Article 6(1)(a))

We don’t use your data for advertising, and we don’t sell or rent it to anyone.

5. Health data and explicit consent

Information about your health is “special category data” under UK GDPR and the Data Protection Act 2018. We only process it with your explicit consent, which the app asks for separately before you first record health information. You can withdraw consent at any time by deleting your data in the app or by emailing us. Withdrawing consent doesn’t affect processing that happened before, but without health data the app can’t personalise sessions to your readiness, pain or recovery, so the plan and sessions may not be available.

We only use health data to run the app for you. We never share it with your club, coach, employer, insurer or anyone else unless you ask us to or the law requires it.

6. Automated adjustments

The app adjusts your sessions automatically (for example, fewer sets on an amber day, or locking training after a head injury report). These adjustments are made by the app’s coaching rules using your data. They don’t produce legal effects or similarly significant effects on you within the meaning of Article 22 UK GDPR: every change shows its reason and, apart from safety locks, you can override it with one tap. The app gives training guidance only; it doesn’t diagnose anything or decide whether you’re fit to play.

7. Where your data is stored and who processes it

On your phone. By default your data is stored on your phone. If you never create an account, it stays there.

In our database, if you create an account. Your account and synced app data are stored with Supabase, our database and authentication provider, in its London region (AWS eu-west-2, United Kingdom). Each user can only access their own data.

We use these service providers (processors), who act only on our instructions under written contracts:

Supabase Inc.: database, authentication and the account deletion function. Data is hosted in London.
RevenueCat Inc.: subscription management. Receives the anonymous app user ID and purchase information described above, not your health data.
Cloudflare Inc.: website hosting and security, and forwarding of emails sent to our support address.
Our email provider: to receive and answer support emails.

Apple and Google process payments and, if you use them, Sign in with Apple or Google. They act as independent controllers under their own privacy policies.

Some of these providers are based in the United States or may access data from outside the UK (for example for support). Where personal data is transferred outside the UK, we rely on UK adequacy regulations (including the UK-US Data Bridge for certified companies) or the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, with additional safeguards where needed. Contact us for more detail.

Apart from the processors above, we only share personal data if you ask us to, if we are required to by law or a court, to protect someone’s vital interests in an emergency, or as part of a sale or restructuring of our business (in which case your data would remain protected by this policy). We never sell personal data.

9. How long we keep it

Data on your phone: until you delete it in the app or uninstall the app.
Account and synced data: for as long as you have an account. When you delete your account in the app, your account and synced data are deleted from our live database straight away and removed from backups within 30 days.
Inactive accounts: if you don’t open the app for 3 years, we may delete your account after emailing you first.
Subscription records: kept for 6 years after the transaction for tax and accounting.
Support emails: up to 2 years after we last reply, unless needed longer for a legal claim.
Launch list: until we’ve sent the launch email, or until you ask us to remove you, whichever comes first.

10. Your rights

Under UK data protection law you have the right to:

Access the personal data we hold about you.
Rectification: correct inaccurate data (most of it you can edit in the app).
Erasure: have your data deleted (you can do this in the app: Profile tab, “Delete account and data”).
Restriction of processing in some circumstances.
Data portability: receive your data in a reusable format (use the export option in the Profile tab, free for everyone).
Object to processing based on legitimate interests.
Withdraw consent at any time, for health data or the launch list.

To use any of these rights, email [email protected]. We may need to confirm your identity. We’ll reply within one month (we can extend this by two further months for complex requests and will tell you if so). There’s normally no charge.

11. Complaints

If you’re unhappy with how we’ve handled your data, please contact us first so we can try to put it right. You also have the right to complain to the UK regulator, the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, helpline 0303 123 1113.

12. Security

Data is encrypted in transit (HTTPS/TLS) and access to our database is restricted by row-level security so each user can only reach their own data. Sign-in tokens are kept in your phone’s secure storage. Only the company’s director can access production systems, and only when needed to run or support the service. No system is completely secure, so please keep your phone locked and your sign-in details private. If a data breach is likely to put you at high risk, we will tell you and the ICO as the law requires.

13. Children

The app is for adults aged 18 and over. We don’t knowingly collect data from children. A separate version for under-18s may follow, with its own safeguards and an updated policy written so younger players can understand it.

14. Not medical advice

The app and this website provide general training guidance, not medical advice, diagnosis or treatment. See our terms of use.

15. Changes to this policy

We may update this policy, for example if we add a feature or a new provider. We’ll change the date at the top, and if the changes are significant we’ll tell you in the app or by email before they take effect.

16. Contact

ARX Algorithms Ltd, Office 21751, 182-184 High Street North, East Ham, London, E6 2JA. Email: [email protected].