Medical privacy assessment
The short version. A team's doctor or physiotherapist can keep a file on an injured player in Hashmark and tell the coaches when the player should be back. The details (diagnosis, treatment) are health data: only the medical staff and the player see them, and the coaches only once the player says yes. It is off until a head coach turns it on, and a closed file is deleted after 12 months.
This is the data protection impact assessment (DPIA, GDPR Article 35) for Hashmark's medical files. Vantry LLC, which runs Hashmark, wrote it for the clubs and teams that use the feature. When a head coach or team owner turns medical files on, they accept it for their team. A club may adapt it to its own situation.
1. Who is responsible
- The club or team decides to use medical files and who is on its medical staff. It is the "controller".
- The medical staff (a doctor, physiotherapist or other health professional the team adds with the Medical staff role) decide what goes in a file and stay bound by their own professional secrecy.
- Vantry LLC (Hashmark, 2524 Van Beek Road, Green Bay, WI 54311, USA) stores and processes the files for the team. It is the "processor", under section 14 of our terms.
- Questions: the team's head coach first, or support@usehashmark.com.
2. What it is for
To let the medical staff follow an injured player and tell the coaches when the player can train and play again, inside Hashmark rather than in text messages or group chats. Hashmark makes no diagnosis and decides nothing on its own. It is not a medical record system and doesn't replace the professional's own records.
3. What is collected
| In a file | Written by |
|---|---|
| The player (name and number as the roster has them) | The medical staff |
| The details: diagnosis, treatment, what to watch (up to 1500 characters) | The medical staff |
| The expected return date, and whether the file is open or closed | The medical staff |
| Messages about the file (up to 1000 characters each) | The medical staff and the coaches |
| The player's yes or no to sharing the details, with its date | The player |
With each change: who made it and when. The injury report itself (out, limited, expected back, a short note, never a diagnosis) works as it already did and goes to the coaches.
Never collected by Hashmark: scans, prescriptions, test results as files, insurance or social security numbers.
4. On what basis
- The medical staff's file: kept by a health professional bound by secrecy, to care for the player (GDPR Article 9(2)(h)).
- The expected return date and the messages go to the coaches so the player comes back safely. The club tells its players about medical files before using them, and a player can ask the medical staff to keep a detail out of the messages.
- The details for the coaches: only with the player's explicit consent (GDPR Article 9(2)(a)), given on the player's own phone in Hashmark. Taking it back is one tap.
- Under 18: a player with a 13 to 15 account or linked to a parent can't say yes, so the details stay with the medical staff.
5. Who sees what
| Who | Sees |
|---|---|
| The medical staff | Every file of the team, with the details and the messages |
| The player | Their own file, with the details and the expected return date (not the messages) |
| The coaches: head coach, coordinators, position coaches and trainer | The player, the expected return date and the messages; the details only once the player says yes |
| Everyone else | Nothing: the team manager, the mental preparation coach, statisticians, the booth analyst, the broadcaster, team owners who aren't coaches, the club office, parents and other players |
The database itself checks these rules on every request; they don't depend on what the app chooses to show. Notifications say only the player's name and that the file changed, never the details, and no email is sent.
6. How long it is kept
- 12 months after the file is closed, or 24 months after its last change if it is never closed. Deleted automatically every night.
- At once, every file and message of the team, when the head coach turns medical files off.
- The medical staff keep their own professional records outside Hashmark, under their own rules.
7. Where it is kept and how it is protected
- Stored with Supabase in Ireland (EU), on Amazon Web Services, encrypted in transit (HTTPS) and at rest.
- The files can't be read directly from the app's side. They are only reachable through server functions that check the reader's role each time.
- Vantry LLC is a US company. Its staff can reach the database to keep the service running, and they open a medical file only to answer a request from the club or the player. Transfers to the US are covered by the European Commission's Standard Contractual Clauses.
- If a breach touches medical files, Vantry LLC tells the club without delay so it can tell the players and the authority as the law requires.
8. Is it necessary and proportionate?
- Off by default, team by team. A team that doesn't want it never collects anything.
- The details stay with the medical staff unless the player says yes; the coaches get what they need to plan: when the player is back.
- Short texts only: no files, scans or documents.
- A limited time: 12 months after the injury is over covers a season and a re-injury.
9. Risks and what limits them
| Risk to the player | What limits it | What's left |
|---|---|---|
| A diagnosis seen by coaches without the player's agreement | Details hidden from coaches until the player says yes, checked by the database; the medical staff are reminded in the app not to write the diagnosis in the messages before that | Low |
| Health information seen by people who shouldn't | Medical staff, the player and the coaches only; the team manager, the office, parents and teammates see nothing | Low |
| Feeling pushed to share | Sharing is the player's own tap, can be taken back at any time, and the coaches always get the return date without it | Low |
| A minor's health data reaching coaches | 13 to 15 accounts and players linked to a parent can't share the details | Low |
| A leak or breach | EU hosting, encryption, no direct table access, short texts only, deletion after 12 months | Low |
| Used to drop a player or in a contract talk | Hashmark decides nothing; the club's commitment (section 10) | Low, and in the club's hands |
10. What the club commits to
By turning medical files on, the head coach or owner accepts for the team that:
- Only health professionals get the Medical staff role.
- Files are used only to care for players and plan their safe return.
- Players are told about medical files before they are used, and sharing the details stays the player's choice.
- The coaches keep what they read confidential.
- The club answers players' requests (see, correct, delete) with Hashmark's help.
11. The player's rights
A player can see their own file in Hashmark, share the details with the coaches or stop sharing them at any time, and ask the club, the medical staff or support@usehashmark.com for a full copy, a correction or deletion. They can also complain to their data protection authority (in France, the CNIL).
12. Conclusion
With these measures, the remaining risk to players is low, so no prior consultation with a data protection authority is needed (GDPR Article 36). This assessment is reviewed every season and whenever the medical files change. A change that matters gets a new version, and head coaches accept it again.