Privacy Policy

1. Scope and Who We Are

This Privacy Policy explains how BASE Performance Technologies, LLC ("BASE," "we," "us," or "our") collects, uses, discloses, protects, retains, and otherwise processes personal information through baseperformancetech.com, the BASE web platform, the BASE mobile application, and related support and services (collectively, the "Services").

BASE is a Georgia-based provider of behavioral performance assessment, monitoring, reporting, and decision-support technology for athletic, educational, and coaching organizations.

This Policy applies to website visitors, prospective and current customers, administrators, coaches, staff, athletes, student-athletes, participants, and other authorized users of the Services.

2. BASE's Role and Customer-Directed Data

Most Platform accounts are created, sponsored, or managed by a school, university, athletic program, club, team, league, or other organization (a "Customer"). When BASE processes personal information on a Customer's behalf, the Customer generally determines why the information is collected, which individuals may use the Services, which assessments are assigned, and which authorized users may view results. BASE processes that Customer-directed information to provide the contracted Services and acts as a service provider, contractor, or processor as applicable.

BASE separately determines how it processes information collected through its public website, business communications, account administration, security operations, and its own legal and business functions. In those contexts, BASE may act as the business or controller under applicable law.

If your account is managed by a Customer, that Customer's notices, policies, contracts, and instructions may also apply. Questions about a Customer's use of your information should ordinarily be directed to the Customer first. BASE will reasonably assist the Customer with verified privacy requests as required by law and contract.

3. Information We Collect

3.1 Account, identity, and organization information

We may collect names, email addresses, usernames, authentication information, contact details, role or permission level, organization, team, sport, roster or group assignment, account status, and related administrative information.

3.2 Assessment, daily check-in, and performance information

The Services may collect and generate assessment responses, including free-text responses; daily check-in responses; completion and participation records; timestamps; behavioral-performance indicators; score patterns; trends; monitoring data; assigned interventions and related participation or completion information; team comparisons; reports; recommendations; dashboards; and other analytics derived from submitted information. We refer to information of this nature as "Sensitive Behavioral Performance Data."

3.3 Customer and roster information

Customers and their authorized personnel may provide team names, rosters, staff assignments, assessment schedules, season or program information, user status, permissions, and other information needed to configure and administer the Services.

3.4 Communications and support

We collect information you provide when you request a demonstration, communicate with us, submit feedback, report a problem or security concern, request support, or otherwise interact with BASE. This may include the content of messages and information needed to investigate and resolve the request.

3.5 Website, device, usage, and security information

When you use the Services, we may automatically collect IP addresses, browser and operating system information, device or application identifiers, access times, pages or features used, authentication events, error and diagnostic information, log data, and security or audit events. We use this information to operate, secure, troubleshoot, and improve the Services.

3.6 Information we do not request for ordinary Platform use

Unless BASE expressly authorizes otherwise in a separate written agreement, the Platform is not intended to collect medical records, clinical diagnoses, psychotherapy notes, treatment records, HIPAA-regulated protected health information, Social Security numbers, government identification numbers, payment-card numbers, biometric identifiers used for identity verification, or precise geolocation.

Customers and users must not enter those categories of information into free-text fields, assessment responses, uploads, support messages, or other Platform areas unless BASE has expressly approved that use in writing and appropriate safeguards and agreements are in place.

4. Sources of Information

We collect personal information from the following sources:

• You, when you create or use an account, complete an assessment or daily check-in, communicate with BASE, or otherwise use the Services.
• Customers and their authorized administrators, coaches, staff members, or other representatives.
• The Services and devices automatically, through essential cookies, logs, authentication processes, and similar technologies.
• Service providers that support hosting, security, communications, account administration, diagnostics, and related operations.
• Publicly available or business sources, when reasonably necessary for customer development, contracting, or legal and security purposes.

5. How We Use Information

BASE may use personal information to:

• Create, authenticate, maintain, and administer accounts and permissions.
• Deliver assessments, daily check-ins, dashboards, reports, monitoring, analytics, recommendations, and other requested Services.
• Display information to authorized Customer users according to assigned roles and permissions.
• Provide support, investigate problems, maintain records of requests, and communicate about the Services.
• Operate, maintain, test, troubleshoot, update, and improve the Services.
• Detect, prevent, investigate, and respond to fraud, misuse, security incidents, unauthorized access, and violations of agreements or policies.
• Maintain logs, backups, audit records, business records, and evidence needed for security, reliability, compliance, dispute resolution, or legal obligations.
• Create and use aggregated or de-identified information for product improvement, quality assurance, benchmarking, research, validation, security, and reporting, but only where permitted by the applicable Customer agreement and law.
• Comply with law, court orders, lawful requests, insurance obligations, and professional advice, and protect the rights, safety, and property of BASE, Customers, users, and others.

6. Analytics, Automated Processing, and Human Review

The Services use scoring rules, algorithms, and analytics to transform responses and monitoring information into scores, patterns, reports, trends, comparisons, flags, and recommendations. These outputs are decision-support information. BASE does not make clinical diagnoses, treatment decisions, emergency determinations, roster decisions, scholarship decisions, disciplinary decisions, eligibility decisions, or other decisions that produce legal or similarly significant effects for an individual.

Customers must exercise appropriate human judgment and conduct independent review, and must not use Platform outputs as the sole basis for a material decision affecting an athlete, student, employee, or participant. The Platform is not an emergency alert system and is not designed for real-time crisis monitoring.

7. Cookies and Similar Technologies

BASE currently uses cookies and similar technologies that are necessary to operate and secure the website and Platform. These may support session continuity, authentication, anti-forgery protection, load balancing, preferences, and security. Blocking necessary cookies may prevent parts of the Services from functioning.

BASE does not use assessment responses, daily check-ins, or Sensitive Behavioral Performance Data for targeted advertising or cross-site behavioral advertising. If BASE later introduces non-essential analytics or marketing technologies, BASE will update this Policy and provide any consent or opt-out mechanisms required by applicable law before those technologies are used.

You may manage cookies through your browser or device settings. Because BASE does not sell or share personal information for cross-context behavioral advertising, BASE does not currently provide a separate opt-out for those practices. If BASE's practices change, BASE will provide and honor any privacy choices required by applicable law.

8. When We Disclose Information

BASE may disclose personal information in the following circumstances:

• To Customers and authorized users. Information may be made available to the Customer that sponsored or manages the account and to its authorized administrators, coaches, staff, or other users according to roles, permissions, and Customer instructions.
• To service providers and subprocessors. BASE may use cloud hosting, database, backup, email, security, software, support, and other providers that process information for BASE under contractual and confidentiality restrictions. BASE's core environment currently uses Microsoft Azure. Providers and technical architecture may change as the Services develop.
• For legal, safety, and security purposes. BASE may disclose information when reasonably necessary to comply with law or lawful process, enforce agreements, investigate wrongdoing, respond to security incidents, or protect rights, safety, and property.
• To professional advisers and insurers. BASE may disclose information to attorneys, auditors, accountants, insurers, brokers, security specialists, and other professional advisers when reasonably necessary and subject to appropriate duties of confidentiality.
• For a business transaction. Information may be transferred in connection with a merger, financing, reorganization, sale of assets, acquisition, insolvency, or similar transaction, subject to applicable law and appropriate notice.
• At your or the Customer's direction or with valid consent. BASE may disclose information for another purpose when the appropriate person or Customer directs or authorizes the disclosure.
• In aggregated or de-identified form. BASE may disclose information that does not reasonably identify an individual or Customer, subject to applicable contracts and student-data laws. BASE will not attempt to re-identify properly de-identified information.

9. No Sale of Personal Information or Targeted Advertising

BASE does not sell personal information for money. BASE does not sell or share personal information for cross-context behavioral advertising as those terms are defined under applicable U.S. state privacy laws. BASE does not use assessment responses, daily check-ins, or Sensitive Behavioral Performance Data to advertise to users or to build advertising profiles.

Disclosing information to contracted service providers that process it only to provide and secure the Services is not treated by BASE as a sale. If BASE's practices materially change, BASE will update this Policy and provide any legally required notice and choices before applying the changed practice to personal information.

10. Student Data, FERPA, PPRA, and Educational Customers

When a school, district, college, or university uses the Services and designates BASE as a school official, contractor, or service provider under the Family Educational Rights and Privacy Act (FERPA), BASE will use personally identifiable information from education records only for the purposes authorized by the educational institution and the applicable agreement. BASE will remain under the institution's direct control regarding the use and maintenance of those records and will not re-disclose them except as authorized by the institution and permitted by law.

The educational institution retains control over education records and is responsible for determining whether FERPA, the Protection of Pupil Rights Amendment (PPRA), state student-privacy laws, parent or eligible-student notice requirements, consent or opt-out requirements, school-board policies, and other rules apply to its use of a particular assessment or daily check-in. BASE will provide commercially reasonable assistance with these obligations as required by contract and law.

BASE does not use student personal information for targeted advertising or for commercial purposes unrelated to providing, securing, supporting, and lawfully improving the contracted Services. Where the law restricts the use of de-identified or aggregated student information, BASE will comply with those restrictions.

11. Children's Privacy

BASE does not offer the Platform directly to children for independent personal or family use. A person under 13 may use the Platform only through a Customer-approved program and only after BASE and the Customer establish a legally valid authorization and consent pathway under the Children's Online Privacy Protection Act (COPPA) and other applicable law.

Where a school is legally permitted to authorize collection on a parent's behalf for an educational purpose, BASE will provide the school with the required notice of its collection, use, and disclosure practices. BASE remains responsible for its own obligations under COPPA and does not require a school, coach, teacher, or parent to waive a child's privacy rights.

BASE does not condition a child's participation on providing more personal information than is reasonably necessary for the authorized activity. BASE does not use a child's personal information for targeted advertising or unrelated commercial profiling. A parent or guardian who believes BASE collected a child's information without proper authorization should contact support@baseperformancetech.com.

When a child under 13 uses BASE through an authorized Customer program, the information collected may include the child's name, username or email address if provided, organization and team information, assessment and daily check-in responses, completion records, calculated scores and recommendations, and device, authentication, and security information. BASE uses and discloses this information only as described in this Policy and the applicable Customer agreement. The Platform does not provide a feature through which children may make their personal information publicly available.

A parent or legal guardian may request to review the personal information BASE has collected from their child, request deletion of that information, or refuse further collection or use of the child's information. BASE may coordinate a request with the school, team, or other Customer that manages the child's account. BASE will verify the requesting person's identity and authority before providing access to or deleting a child's information. Requests may be submitted using the contact information in Section 19.

12. Data Security

BASE uses authentication controls, assigned roles and permissions, and cloud-service security features intended to reduce the risk of unauthorized access, use, alteration, disclosure, or destruction of personal information. The security measures used vary by system and may change as the Services develop.

Access to Customer Data is limited to personnel, contractors, Customers, and authorized users who have a legitimate need for access. Customers are responsible for managing their users and permissions, safeguarding credentials, disabling users who have departed, supervising minor users, and promptly reporting any suspected unauthorized access.

No method of electronic transmission or storage is completely secure. BASE cannot guarantee absolute security or that every incident will be prevented. If BASE confirms unauthorized access that requires notification, BASE will notify the affected Customer and other persons as required by applicable law and contract, taking into account containment, investigation, restoration, and lawful requests by authorities.

13. Data Retention, Archival, and Deletion

BASE retains personal information only for as long as reasonably necessary for the purposes described in this Policy, the applicable Customer agreement, Customer instructions, security and backup needs, legal obligations, dispute resolution, and legitimate business records.

Retention periods vary by category and context:

• Customer Data is generally retained during the Customer's subscription and for the export, transition, archival, or deletion period stated in the Customer agreement or written instructions.
• Account, role, and permission information is generally retained while an account remains active and afterward as reasonably necessary for security, audit, support, or legal purposes.
• Logs, diagnostic information, security records, and support communications are retained for periods reasonably necessary to investigate events, maintain the Services, and meet legal or contractual requirements.
• Backup copies remain until overwritten or deleted through applicable backup cycles, unless preservation is required by law, contract, or an active investigation.
• Properly de-identified information may be retained for product improvement, validation, research, benchmarking, security, and quality assurance where permitted by law and contract.

An action described in the interface as archive, remove, deactivate, or delete may remove information from active website or application views without immediately erasing underlying archival, audit, or backup copies. BASE will use retained copies only for authorized recordkeeping, security, recovery, legal, or contractual purposes and will restrict access appropriately.

When deletion is required, and no exception applies, BASE will delete, de-identify, or place information beyond ordinary use in accordance with applicable procedures and backup cycles.

14. Your Privacy Rights and Choices

Depending on your location, relationship with BASE, and applicable law, you may have rights to request access to, correction of, deletion of, restriction of, or a portable copy of personal information; to object to certain processing; to withdraw consent where processing depends on consent; and to appeal a denied request. You will not be unlawfully discriminated against for exercising a privacy right.

If your information is controlled by a school, university, team, club, employer, or other Customer, submit your request to that Customer. BASE may refer the request to the Customer and will assist the Customer as required. For information BASE controls directly, or if you are unsure where to direct a request, email support@baseperformancetech.com with the subject line "Privacy Request."

BASE may verify your identity and authority before acting on a request. Rights may be limited by applicable exceptions, including security, fraud prevention, legal obligations, educational-record requirements, litigation holds, and the rights of others. If BASE cannot fulfill a request, BASE will explain the reason when required by law.

15. U.S. State Privacy Disclosures

Where a U.S. state comprehensive privacy law applies to BASE's processing, this Policy provides notice of the categories of personal information collected, sources, purposes, retention criteria, and disclosure practices. During the preceding 12 months, BASE may have collected the categories described in Section 3 and disclosed them to the categories of recipients described in Section 8 for the business purposes described in Section 5.

BASE does not sell personal information or share it for cross-context behavioral advertising. BASE does not use or disclose Sensitive Behavioral Performance Data for purposes that are incompatible with providing, securing, supporting, and lawfully improving the Services. Where applicable law provides additional rights, BASE will process verified requests in accordance with the procedure in Section 14.

16. International Processing

BASE operates from the United States. Personal information may be stored and processed in the United States and Canada and may be accessed or processed in other locations where BASE's contracted service providers operate. Those locations may have data-protection laws that differ from those where you live. Where applicable law requires a transfer mechanism or additional safeguard, BASE and the relevant Customer will address those requirements through appropriate contractual or legal measures.

17. Third-Party Services and Links

The Services may link to or interoperate with third-party websites, application stores, communication tools, or services that BASE does not control. Their privacy practices are governed by their own notices. BASE is not responsible for the content or privacy practices of an independent third party.

18. Changes to This Policy

BASE may update this Policy to reflect changes in the Services, data practices, contracts, technology, or law. BASE will post the updated Policy and revise the last-updated date. If a change materially affects how BASE uses previously collected personal information, BASE will provide additional notice or obtain consent, as required, before the change applies.