Hockey Performance Intelligence
Privacy

Privacy Policy

Effective July 17, 2026

This Privacy Policy explains how Epitome PD (“we”, “us”, “our”) collects, uses, discloses, and protects your personal information when you use our website and services. We handle personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial law. This policy works together with our Terms and Conditions, which include the consent you provide.

1. Who we are and who is accountable

Epitome PD is responsible for the personal information in our care. If you have questions, want to access or correct your information, or want to withdraw consent or request deletion, contact our privacy contact at epitomehockey@gmail.com or by mail at:

5614 Burbank Rd SE
Calgary, AB T2H 1Z4
Canada

2. Who the Services are for — adults and minor athletes (14–17)

Accounts may be created by anyone 14 years of age and older. Adults 18 and older have full access. Athletes aged 14–17 may use the Services in one of two ways: through an account owned and managed by their parent or legal guardian, or through their own account, in which case their assessment answers are processed only after their parent or legal guardian consents by email (see below). Genetic testing for athletes aged 14–17 is available only through a guardian-managed account. We never knowingly collect personal information from a child under 14; if we learn that we have, we will delete it. The Services are currently not offered to residents of Quebec.

For an athlete aged 14–17 on a guardian-managed account:

  • The guardian gives each consent on the athlete’s behalf at purchase, and attests to their parental authority or guardianship.
  • Before starting the assessment, the athlete confirms a plain-language assent notice explaining what is asked, what happens with their answers, and that the guardian sees their results. We record this assent.
  • The guardian sees all of the athlete’s data in the account: scores, reports, genetic results, and wellbeing indicators. If the athlete’s answers suggest a risk of self-harm, we notify the guardian directly, and we show youth crisis resources (including Kids Help Phone) on every report.
  • Where we believe in good faith that a minor is at risk of serious harm, we may notify the guardian and, where the law requires it, the appropriate child-welfare authorities.
  • The guardian may access, correct, and delete the athlete’s data at any time (see Section 10). When the athlete reaches the age of majority, they may request deletion or transfer of their data to their own account.

For an athlete aged 14–17 using their own account with emailed parental consent:

  • Before submitting the assessment, the athlete provides their parent or legal guardian’s email address and confirms a plain-language assent notice (which we record) explaining what is asked, that nothing is scored without parental consent, and that the parent or guardian will be contacted.
  • The athlete’s answers are stored securely but are not scored, analyzed, or turned into any report until the named parent or guardian grants consent through a secure emailed link, on a page where they attest to their parental authority. We record the consent evidence: the time of the grant, the terms version, and technical details (IP address and browser information).
  • If consent is not granted after about 7 days we send one reminder (with a fresh link that replaces earlier ones). If consent is not granted within 14 days, the athlete’s answers are permanently deleted and are never scored. Each new attempt requires a fresh consent.
  • If the athlete’s answers suggest a risk of self-harm, we send a wellbeing notice to the named parent or guardian immediately at submission, regardless of whether consent has been granted. This is disclosed to the athlete in their assent notice, and youth crisis resources are shown in the questionnaire and on every report.
  • Once consent is granted, results are released to the athlete’s own account. The athlete may exercise the rights in Section 10 themselves.

3. What we collect

  • Account information — your name, email address, phone number (if provided), and date of birth (used to confirm eligibility and to calibrate your report to your age). For each athlete aged 14–17 added to a guardian account: the athlete’s name, date of birth, and relationship to the account holder.
  • Parental-consent information — for an athlete aged 14–17 using their own account: the parent or guardian email address the athlete provides, and, when consent is granted, the evidence of the grant (time, terms version, IP address, and browser information).
  • Assessment responses and scores (health information) — the answers to the questionnaire and the derived scores for hockey attitude, anxiety, depression, general psychological performance, and overall mindset. Some questions ask about mental health and personal history; these responses are sensitive and we treat them accordingly. The most sensitive questions include an “I prefer not to answer” option, and declining them never blocks the assessment.
  • Genetic information — if you purchase a genetic kit, the cheek-swab sample you return, the genotype results produced by our laboratory partner, and the report derived from them. Genetic information is sensitive and receives our highest level of protection.
  • Purchase and shipping information — products purchased, and, for physical kits, the shipping name, address, and phone number. Payment card details are entered on our payment processor’s hosted page and are never seen or stored by us.

4. Why we collect it

  • To create and manage your account and confirm eligibility (accounts 14+; a minor athlete’s assessment results are processed only with parental consent, via either path in Section 2).
  • To contact the parent or guardian named by a self-account athlete aged 14–17 — to request their consent (with one reminder) and, where the athlete’s answers indicate a possible risk of self-harm, to send the wellbeing notice described in Section 2.
  • To score the assessment and generate the personalized reports.
  • To process the return of the genetic sample and produce the genetic report.
  • To process payment and ship physical kits.
  • To send you service-related email about your orders and reports.
  • To notify the guardian of a minor athlete when the athlete’s answers indicate a possible risk of self-harm (a duty-of-care safeguard that is disclosed to the athlete before they begin).
  • Only if you opt in — to maintain and improve our scoring models using responses in de-identified or aggregated form. This use is optional, declining it never affects the Services, and we never use identifiable genetic data for it.

5. Service providers and disclosure

We do not sell your personal information, and we do not disclose your individual results to insurers, employers, athletic organizations, or other third parties without your specific further consent, except where required by law. We do rely on trusted service providers to operate the Services, and share only what each needs for its function:

  • Supabase — database, authentication, and file storage.
  • Stripe — payment processing (card data is handled entirely by Stripe).
  • SendGrid (Twilio) — sending service email.
  • Google Firebase / Google Cloud — website and application hosting.
  • Google (Gemini API) — we use Google’s generative-AI service to turn your scores (and, for genetic reports, your genotype results) into the written narrative in your report. We do not send your name, email, or other direct identifiers to this service.
  • Personalized Prescribing Inc. — our laboratory partner, which sequences and analyzes the genetic sample you return.

6. Processing outside Canada

Some of our service providers (including Google) process data on servers located in the United States. When personal information is processed in another country, it may be accessible to courts, law enforcement, and authorities in that country under its laws. By using the Services you acknowledge this cross-border processing; for a minor athlete, the guardian’s consent at purchase covers it.

7. How we protect your information

We use row-level security on our database, encryption of data in transit and at rest, private storage with short-lived access links for your reports and genetic files, and a hosted payment page so card data never reaches our servers. No method of storage or transmission is perfectly secure, but we work to protect your information with safeguards appropriate to its sensitivity.

8. No advertising trackers

We do not use third-party advertising cookies, analytics pixels, or cross-site tracking. We use only what is necessary to sign you in and operate the site.

9. How long we keep it

We keep your account information for as long as your account is active and as needed to provide the Services. Questionnaire responses (including individual answers) are kept for up to 3 years to deliver the Services (reports, retakes, and trends); retention for research and scoring-model improvement applies only where you opted in to that use. After the retention period, responses are deleted or de-identified. One exception is shorter: where a self-account athlete aged 14–17 submits the assessment and their parent or guardian does not consent within 14 days, the answers are permanently deleted at that point — they are never scored and never enter the 3-year retention. We keep only a minimal record that a consent request existed (with the parent’s email address removed and only a non-reversible technical fingerprint of the request retained). You may request deletion of your account and data at any time (see Section 10), and a guardian may delete a minor athlete’s data at any time from the dashboard; after a deletion request we remove the personal information, though de-identified or aggregated data already derived from it under an opt-in may be retained.

10. Your rights

You may ask us to access the personal information we hold about you, correct it, withdraw your consent, or delete your account and data. Guardians may exercise these rights on behalf of an athlete aged 14–17 enrolled under their account, and may delete the athlete’s data directly from the dashboard. An athlete aged 14–17 using their own account may exercise these rights themselves, and the parent or guardian they named may also contact us on their behalf. An athlete who reaches the age of majority may exercise these rights themselves, including requesting deletion or transfer of data collected while they were a minor. To make a request, email epitomehockey@gmail.com. We will respond within a reasonable time. Withdrawing consent for essential processing may mean we can no longer provide parts of the Services.

11. Changes to this policy

We may update this policy from time to time. The effective date above shows when it was last revised. Material changes will be reflected here.

12. Contact

Questions or concerns about your privacy? Email epitomehockey@gmail.com. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.