Privacy Policy

1. Introduction

VoiceUp Athletics ("we," "us," or "our") is committed to protecting the privacy and confidentiality of student-athletes seeking mental health support. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

We understand the sensitive nature of mental health information and have designed our platform with privacy and anonymity as core principles, in compliance with HIPAA, FERPA, and other applicable privacy laws.

2. Information We Collect

2.1 Account Information

When your university provisions your account, we collect:

• University email address
• First and last name (for administrative purposes only)
• University and team affiliation
• Account role (athlete, counselor, or administrator)

2.2 Anonymous Display Information

Athletes can create an anonymous display name that is visible to counselors during conversations. Your real identity is never disclosed to counselors without your explicit consent.

2.3 Communication Data

We store messages exchanged between athletes and counselors in encrypted format. This includes:

• Message content (encrypted at rest and in transit)
• Timestamps
• Conversation status (active, resolved, flagged)

2.4 Technical Information

We automatically collect certain technical information:

• IP addresses (for security and fraud prevention)
• Browser type and version
• Device information
• Login timestamps
• Access logs (for compliance and security auditing)

3. How We Use Your Information

We use collected information for the following purposes:

• Service Delivery: Facilitate anonymous communication between athletes and mental health counselors
• Account Management: Create, maintain, and secure user accounts
• Safety & Crisis Response: Enable counselors to flag urgent conversations and coordinate appropriate responses
• Platform Improvement: Analyze aggregate, de-identified usage data to improve our services
• Security & Fraud Prevention: Protect against unauthorized access and maintain platform integrity
• Legal Compliance: Meet HIPAA, FERPA, and other regulatory requirements
• University Reporting: Provide universities with aggregate, non-identifiable usage statistics

4. Information Sharing and Disclosure

4.1 No Third-Party Sales

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

4.2 Within Your University

Information sharing within your university is strictly limited:

• Counselors: See only anonymous display names and conversation content
• University Administrators: Can view user lists and aggregate usage statistics but cannot access conversation content or link athletes to their conversations
• Platform Administrators: Have technical access for system maintenance but cannot view unencrypted message content

4.3 Legal Requirements

We may disclose information when required by law:

• In response to valid legal process (subpoena, court order)
• To protect the safety of individuals or the public
• To report suspected child abuse or neglect as required by law
• To prevent imminent harm or criminal activity

4.4 Service Providers

We work with trusted service providers who help us operate our platform:

• Cloud hosting providers (AWS, Google Cloud, or similar HIPAA-compliant services)
• Email delivery services (for account activation and notifications)
• Analytics providers (using only aggregate, de-identified data)

All service providers sign Business Associate Agreements (BAAs) and are contractually obligated to protect your information.

5. Data Security

We implement industry-standard security measures to protect your information:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Role-based access with multi-factor authentication for administrators
• Audit Logging: All access to sensitive data is logged and monitored
• Regular Security Audits: Third-party penetration testing and vulnerability assessments
• Data Isolation: University data is strictly segregated to prevent cross-contamination
• Incident Response: 24/7 security monitoring with defined breach notification procedures

For more details, see our Security page.

6. Your Rights and Choices

6.1 Access and Correction

You have the right to:

• Access your account information
• Update your anonymous display name
• Change your password and notification preferences
• Request a copy of your conversation history

6.2 Account Deletion

You may request account deletion by contacting your university administrator or our support team at privacy@voiceupathletics.com. Please note:

• Deletion requests are processed within 30 days
• Some information may be retained for legal compliance (e.g., audit logs)
• Conversation records may be retained in de-identified form for clinical documentation purposes

6.3 Opt-Out Options

You can opt out of:

• Non-essential email notifications (via account settings)
• Usage analytics (contact support to disable)

7. Data Retention

We retain information for the following periods:

• Account Information: For the duration of your enrollment plus 7 years (FERPA requirement)
• Conversation Records: 7 years from the date of the conversation (standard clinical documentation retention)
• Audit Logs: 7 years for compliance purposes
• De-identified Analytics: Indefinitely for research and platform improvement

8. Children's Privacy

Our services are designed for college and university students aged 18 and older. We do not knowingly collect information from individuals under 18 without parental consent. If we become aware of such collection, we will delete the information promptly.

9. International Users

Our services are hosted in the United States. If you access our platform from outside the U.S., your information will be transferred to, stored, and processed in the United States. By using our services, you consent to this transfer.

10. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify you of material changes by:

• Posting the updated policy with a new "Last Updated" date
• Sending an email notification to your university email address
• Displaying a prominent notice on the platform

Your continued use of the platform after such changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

For HIPAA-related inquiries, please email our Privacy Officer at hipaa@voiceupathletics.com.