Student Data Privacy Agreement

This page explains how Horsepower Solutions, LLC, d/b/a Coachlytics ("Coachlytics," "we," or "us") protects student-athlete data for schools and districts ("School" or "you") that use Coachlytics at www.coachlytics.app and my.coachlytics.app.

Our signed agreement

Coachlytics has signed the Student Data Privacy Consortium (SDPC) multi-state National Data Privacy Agreement (NDPA), Standard Version 1.0, covering Massachusetts, Maine, Colorado, Idaho, Illinois, Iowa, Kentucky, Missouri, Nebraska, New Hampshire, New Jersey, New York, Ohio, Rhode Island, Tennessee, Vermont, Virginia, and Washington. The originating district is an Iowa district, and the agreement was fully executed on October 1, 2026.

We have also signed the General Offer of Privacy Terms (Exhibit E). Any district in a participating state can adopt the same signed protections by signing Exhibit E and sending it to preston@coachlytics.app. If your district uses a different state or district agreement, contact support@coachlytics.app and we will work with you on it.

How this page relates to a signed agreement: The commitments below apply to every School that uses Coachlytics, whether or not a signed agreement is in place. Where a School has a signed DPA with us, that signed DPA controls if it conflicts with this page.

1. Who owns the data

Student data belongs to the School and stays under the School's control. Coachlytics acts as a school official with a legitimate educational interest under FERPA (34 CFR § 99.31). That means we:

• Perform a service the School would otherwise do itself
• Are under the School's direct control for how student data is used and kept
• Use student data only to provide Coachlytics to the School, and never re-disclose it except as described here

Coaches who create an account confirm that they are authorized by their School to use Coachlytics with student data.

2. Student data we process

Depending on how the School sets up Coachlytics, we may process:

• Identity: student name, local (district) student ID, and a Coachlytics-assigned student ID
• Enrollment and demographics: grade level, graduation year, date of birth, and gender
• Program membership: sport, position, roster and group membership, coach-applied tags, and teacher or coach names
• Athletic testing inputs: bodyweight, height, reps, load, time, and distance
• Derived values: 1–99 scores, 0–5 levels, badges, and projected one-rep maxes. These are calculated when viewed from the raw testing inputs and are not stored as separate records.
• Attendance: session date and type, status (present, absent, excused, late, modified, makeup completed), check-in method, and check-in timestamp
• Notes: free-text coach notes on a session or attendance record
• Records of activity: audit records of coach actions, IP addresses, cookies, and basic app usage data

We do not collect student addresses, student or parent contact information, Social Security numbers, medical or health records, disability or IEP/504 information, or race and ethnicity. Coaches should not enter injury or health details in free-text notes.

We also process coach account information (name, school email, and login credentials) to run the service and handle billing.

3. How we use student data

We use student data only to provide, support, and secure Coachlytics for the School.

We will never:

• Sell or rent student data
• Use student data for targeted advertising, or to build a profile of a student for any purpose other than providing the service to the School
• Use student data to train artificial intelligence models

4. De-identified data

We may use data that has been fully de-identified, so that it cannot reasonably identify any student, to improve Coachlytics and show how well the service works. We will not attempt to re-identify it. We will not share de-identified data with anyone outside our subprocessors without the School's prior written consent and a written promise from the recipient not to re-identify it. Before publishing anything that names a School, we will get that School's written approval.

5. Parent and student requests

Parents, guardians, and eligible students make requests through their School, which follows its own FERPA procedures. If a parent or student contacts us directly, we will refer them to the School.

When a School asks us to access or correct a student's records, we will respond within 45 days, or sooner if state law or a signed agreement requires it.

6. Requests from law enforcement

If law enforcement or another government agency asks us for student data, we will notify the School before any required disclosure, unless we are legally prohibited from doing so.

7. Deletion and return of data

• On request: When a School asks in writing, we will delete student data or provide it to the School in a readable format (such as CSV) within 60 days, or sooner if state law or a signed agreement requires it.
• When service ends: After the School's service ends, we will give the School reasonable notice and then delete its student data, unless the School asks us to return it first.
• Backups: Backups are encrypted and expire automatically within 7 days. Deleted data is not restored from backups.
• Confirmation: On request, we will confirm in writing when deletion is complete.

Schools may use the SDPC "Directive for Disposition of Data" form (Exhibit D) for these requests.

8. Where data is stored

All student data is stored in the United States. Our database, authentication, and file storage run on Supabase (AWS US East, Ohio). Our application runs on Vercel in US regions. Backups stay in the same US region as the primary database. No student data is stored or copied outside the United States.

9. Security

We use administrative, technical, and physical safeguards aligned with the NIST Cybersecurity Framework, including:

• Strict separation between organizations at the database level, so one School can never see another School's data
• Role-based access for coaches within a School
• Encryption in transit and at rest
• Access to production data limited to the Coachlytics owners who need it to run and support the service, all bound by confidentiality obligations
• Error and monitoring tools configured so they do not receive student names, scores, or report contents

Coachlytics staff do not have direct contact with students. If that changes, staff with direct contact will pass criminal background checks where state terms require them.

Once a year, or after a security incident, a School may request a review of our security and privacy practices with at least 10 business days' notice.

Security contact: Preston Pedersen, preston@coachlytics.app

10. Security incidents

We maintain a written incident response plan and will share a summary of it with any School on request.

If student data we hold for a School is accessed or disclosed without authorization, we will notify the School within 72 hours of confirming the incident, or sooner where state law or a signed agreement requires it. The notice will include, as soon as we know them:

• The types of student data involved
• When the incident happened, or the best estimate
• A general description of what happened and what we have done to contain it
• Whether a law enforcement investigation delayed the notice
• A contact person at Coachlytics

Where a School's state terms require it, we will also provide the list of affected students and other required details. The School notifies affected students and families, and we will work with the School throughout.

11. Subprocessors

We use a small number of service providers to run Coachlytics, such as hosting, database, email, and payment processing for coach billing. Each one is bound by a written agreement to protect student data at least as strictly as this page. Payment processors handle coach billing information only, never student data.

A current list of subprocessors is in our Privacy Policy.

12. Changes to this page

We will give Schools at least 15 days' notice before making material changes to how we handle student data. Changes will never reduce protections for data we already hold.

13. If Coachlytics is sold

If Coachlytics is sold or merges with another company, these obligations go with it. We will notify Schools in writing within 60 days and provide a signed assurance that the new owner will honor them. A School may end its agreement if it does not approve of the new owner.

14. Governing law

Any dispute about student data is governed by the laws of the School's state, in the courts of the School's county.