Privacy Policy

1. About this policy

VISTA GPS (“VISTA”, “we”, “us”) is a sole trader business based in Perth, Western Australia (ABN 18 935 045 654). We provide an online platform that helps sporting clubs, schools and other organisations turn GPS and training files into performance, training-load and rehabilitation reports.

This policy explains how we handle personal information, including health information, in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). It is written to meet APP 1, which requires us to have a clearly expressed and up-to-date privacy policy.

VISTA chooses to comply with the APPs and the Notifiable Data Breaches scheme as if it were bound by them. Because VISTA handles health information, it may also be covered by the Privacy Act regardless of its size. We do not rely on the small business exemption.

If you have a question about this policy, contact our privacy contact, Jacob Dearle, at jacob@vistagps.com.au.

2. Who is responsible for player information

VISTA is used by organisations such as football clubs and schools (“customers”). The customer decides which players, staff and information are entered into VISTA and why. The customer is the party that collects player information, and VISTA stores and processes that information on the customer’s behalf and on its instructions.

This means:

• The customer is responsible for telling its players (and, for players under 18, their parents or guardians) that their information will be stored and analysed in VISTA, and for obtaining any consent that is needed — including consent to collect health information.
• The customer decides which of its staff can access its programs and what role they have (owner, editor or viewer).
• VISTA does not use player information for its own purposes, and does not sell it or use it for marketing.
• Players with a question about their information should usually contact their club or school first. We will help the customer respond, and you can also contact us directly (see section 11).

3. What information we collect

Account and organisation information

• Names and email addresses of customer staff who are given a VISTA login, and their role in each organisation and program.
• Organisation details, program names and settings, club name, logo and colours.
• Sign-in and security information, such as authentication records, timestamps and audit/security logs.

Player information uploaded by customers

• Player identifiers, such as names or numbers, as they appear in the customer’s files.
• GPS and performance data from CSV or spreadsheet uploads (for example distance, speed, high-speed running, time on ground and quarter-by-quarter data), plus game results and scores.
• Training-load information, such as sessions, weekly loads and related measures.
• Health information, including injury and rehabilitation information (for example injury details, rehabilitation plans and sessions, and estimated return dates) and wellness or screening results.

We do not ask for players’ dates of birth, home addresses or contact details, and customers should not upload them. Our internal Privacy Management Plan requires a documented need and privacy review before any new type of personal information is added.

Payment information

Season Pass payments are made on a secure payment page hosted by Stripe. Stripe collects your card details directly; VISTA does not see or store full card numbers. We receive payment confirmation and the organisation details entered at checkout.

Website and technical information

When you use the site, our hosting and service providers automatically receive technical information such as your IP address, browser type and the time of your request. See section 10 for cookies and browser storage.

4. Health and sensitive information

Injury, rehabilitation, wellness and screening information is “health information”, which is a type of sensitive information under the Privacy Act and needs extra care. We:

• only handle it to provide the VISTA service to the customer that uploaded it;
• rely on the customer to have the player’s consent (or another lawful basis) to collect it and to store it in VISTA;
• restrict access so that only authorised users of that customer’s program can see it;
• keep demonstration data de-identified; and
• do not copy production medical data into development tools, AI services or support channels unless it is specifically authorised and necessary.

5. How we collect information

We collect information:

• from customers, when their authorised staff create accounts, configure programs and upload files;
• from you directly, when you sign up for a demo, sign in, buy a Season Pass or contact us; and
• automatically, through our hosting and service providers, when you use the site.

We generally do not collect player information directly from players. Where a customer gives us information about a player, the customer is responsible for having collected it lawfully and for giving the player the notice required under APP 5.

6. Why we use information

• To provide the VISTA service: storing data, producing dashboards and reports, and managing organisations, programs and user access.
• To verify payments and activate Season Pass access.
• To provide support when a customer asks for it.
• To keep VISTA secure, investigate misuse and respond to incidents.
• To meet our legal obligations.

We do not use personal information for direct marketing to players. We may email customer staff about their account, their Season Pass or important changes to VISTA. We may also send club contacts occasional product updates about VISTA. Every update includes an easy way to opt out, and you can also opt out at any time by emailing jacob@vistagps.com.au.

7. AI-assisted insights

VISTA includes an Insights feature that drafts performance commentary to help staff interpret their data. Live AI insights are available only to clubs with an active VISTA Season Pass. They are not available in the free demo.

What is sent: when a user asks VISTA to generate AI insights, our secure server function (which requires a valid VISTA sign-in) sends a summary of the selected game, training session or week, or player trend to OpenAI. The summary contains GPS and training-load metrics (for example distance, speed, high-speed running, sprint distance, accelerations and decelerations), team averages, and program context such as round numbers, dates, session names and opponent names. Before the summary leaves our server, player names are replaced with codes (for example “Player 01”), and we put the names back into the draft insights only after they return. We do not send injury, rehabilitation, medical or contact information. Because the metrics relate to individual players, we treat the summary as pseudonymised (de-identified for this purpose), not anonymous, information.

AI provider: OpenAI (the maker of ChatGPT), through the OpenAI API. We send requests with storage switched off (OpenAI’s “store: false” setting), so OpenAI does not keep the request or the generated insights as stored application data. Under OpenAI’s API data policy, data sent through the API is not used to train or improve OpenAI’s models unless the customer opts in, and VISTA has not opted in. OpenAI may keep API requests and responses in abuse-monitoring logs for a limited period (by default up to 30 days, or longer if required by law or to protect its services or others from harm), and then deletes them.

Overseas disclosure: OpenAI may process and temporarily store this information outside Australia, including in the United States (see section 8).

Insights are decision support only. They are drafts that may be incomplete or wrong, and they must be reviewed, edited and approved by the customer’s appropriately qualified staff before they are used or shared. AI insights are not medical advice. VISTA does not use AI to make decisions about players, such as selection, medical clearance, injury diagnosis or return to play.

If live AI is unavailable (for example, because a club does not have an active Season Pass), VISTA shows insights calculated from the club’s own data inside VISTA. These are labelled “VISTA computed”, and no data is sent to OpenAI to produce them.

8. Who we share information with, and overseas disclosure (APP 8)

We use the following service providers to run VISTA. They process information on our behalf, and only so that they can provide their services:

Customer data in our database is stored in Australia (Supabase, Sydney region). Because some of these providers are based in, or process information in, other countries, some personal information may be disclosed overseas, mainly to the United States. Before using a provider that may receive personal information, we review its security, its data location, its retention and its breach-notification terms, as our Privacy Management Plan requires. We take reasonable steps to ensure overseas recipients handle the information consistently with the APPs.

We do not sell personal information. We will only otherwise disclose personal information if the customer instructs us to, if the law requires or authorises it, or if it is needed to lessen or prevent a serious threat to someone’s life, health or safety.

9. Security, retention and deletion

Security

• Data is stored with Supabase using database access rules (Row Level Security), so that users can only reach the organisations and programs they are authorised for. Permissions are enforced on the server, not only in the app’s screens.
• Each program is separate, with owner, editor and viewer permissions, and archived programs are read-only.
• Secret keys and privileged credentials are kept out of the browser and out of public code.
• Data travels over encrypted (HTTPS) connections.
• We review dependencies, hosting settings and exposed endpoints before major releases, and we keep a Data Breach Response Plan.

No online service can be guaranteed to be completely secure, but we take reasonable steps to protect information from misuse, interference, loss and unauthorised access, modification or disclosure, as APP 11 requires.

Retention and deletion

We keep customer data for as long as the customer has access to VISTA. When a customer’s access ends, we tell them about the retention and deletion window and encourage them to export anything they need. Our target is to delete the customer’s organisation data within 30 days after its access ends, unless the law requires us to keep it. We keep only a minimal record that the deletion took place.

Customers can ask us to delete specific information sooner. Information held in backups is deleted in line with our database provider’s backup cycle.

10. Cookies and browser storage

VISTA does not use advertising or analytics cookies, and we do not use tracking pixels.

The app uses your browser’s local storage for things it needs to work:

• Your sign-in session (Supabase sign-in tokens), so you stay signed in until you sign out.
• Demo program settings and the last demo program you opened.
• In the standalone (offline) version of the app only, a local copy of program data. In the hosted version, program data is saved to our database instead.

If you use a shared computer, sign out when you finish. Clearing your browser’s site data will remove this information from that browser.

Third parties may set their own cookies. For example, Supabase’s network provider may set a security cookie, and Stripe sets cookies on its own payment page. These are covered by those providers’ privacy policies.

11. Access and correction

You can ask for access to the personal information we hold about you, or ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading (APPs 12 and 13).

• Customer staff can view and update most of their organisation’s information directly in VISTA.
• Players should usually ask their club or school, which controls their information in VISTA. You can also email jacob@vistagps.com.au and we will work with your club to respond.
• We will need to confirm your identity before releasing or changing information.
• We aim to respond within 30 days. There is no charge to make a request. If we refuse a request, we will tell you why in writing, as the law allows, and how you can complain.

12. Anonymity and pseudonyms

You can ask general questions about VISTA without identifying yourself. To use the service, customer staff need a named login. Customers may choose to identify players by number or code rather than name.

13. Data breaches

We keep a Data Breach Response Plan for any suspected or confirmed loss of, or unauthorised access to, personal information. If a breach happens, we will act quickly to contain it, assess the risk of harm, and fix the cause.

If a breach is likely to result in serious harm (an “eligible data breach” under the Notifiable Data Breaches scheme), we will notify the affected customers, the affected individuals and the Office of the Australian Information Commissioner (OAIC), as the scheme requires. Where the breach involves a customer’s player information, we will work with that customer on notifying players.

14. Complaints

If you have a concern about how we have handled personal information, please email jacob@vistagps.com.au with details. We will acknowledge your complaint promptly, investigate it, and aim to give you a written response within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC): visit www.oaic.gov.au or phone 1300 363 992.

15. Changes to this policy

We review this policy at least once a year, and whenever we make a significant change to VISTA, its providers or the information it holds. The current version will always be on our website, with its effective date. If we make a significant change, we will let customers know.

Contact: Jacob Dearle, Privacy contact, VISTA GPS — jacob@vistagps.com.au. VISTA does not currently publish a business telephone number or postal address.