Privacy Policy

Effective 23 September 2026

botthms.Ready (“the app”, “the service”) is an athlete wellness and readiness platform for schools, clubs, coaching groups and individual athletes across sports. It is operated by botthms Ready (Pty) Ltd(“botthms”, “we”, “us”), a company registered in South Africa, which is the responsible party under the Protection of Personal Information Act, 2013 (“POPIA”). This policy explains what personal information we collect, why, who can see it, how long we keep it, and the choices available to athletes, parents and guardians, and school or club staff.

Responsible party and Information Officer

botthms Ready (Pty) Ltd, Randpark Golf Club, Randburg, Johannesburg, South Africa. Our Information Officer is the director, Renaldo Bothma, who can be reached at info@botthms.co.za. Please use this address for any question, request or complaint about your personal information.

Who the app is for

The service is used in two ways. Through a school, club or coaching group: a parent or guardian submits a signup request on the organisation’s own signup page; the organisation’s staff approve it; the athlete and the parent each receive their own account. As an individual athlete: an athlete (or their parent) registers directly at botthmsready.co.za/signup.

Many of our users are children. Where an athlete is under 18, we collect and process their information only on the basis of consent given by a parent or legal guardian (a “competent person” under section 35 of POPIA). That consent is captured on the signup form, and the parent or guardian is given their own linked account so they can see what their child logs. We do not advertise in the app and we never sell personal information.

Information we collect

Athlete account details— name, date of birth, email address, sport, school or club, team and position where relevant, and an optional profile photo.
Parent or guardian details— name, email address and phone number, the consent given, and the link between the parent and the athlete.
Daily wellness check-ins— short self-ratings of sleep quality and hours, energy, mood, stress, muscle soreness, recovery and motivation, whether the athlete feels unwell that day, an optional note, and the readiness score and trend the app calculates from them against the athlete’s own history.
Body and injury information— areas of soreness, niggles or injury an athlete chooses to flag, how those reports change over time, injury records that the organisation’s staff enter, and, where the organisation enables it, concussion event records including the date, mechanism, status and the practitioner who cleared the athlete.
Body weight— where the organisation enables weigh-ins, the athlete’s weight on each occasion and the trend over time.
Training information— sessions programmed by a coach, the athlete’s effort rating and duration for each session, distance run where the sport tracks it, rest days, gym programmes and logged sets and weights, and the training-load measures calculated from these.
GPS unit data— where the organisation uses GPS tracking units in training or matches, the per-session summaries its staff import from the unit maker’s software (distance, speed, high-intensity running, accelerations, minutes) and the comparisons we draw against the athlete’s own history. We do not receive positional tracks. This is a separate layer and does not change readiness or load.
Match statistics— where the organisation enables it, the athlete’s performance statistics for each match (minutes, tackles, carries, rucks and similar counts) as entered by the organisation’s staff from a scoresheet or their analyst’s report, the team’s match statistics, and the contact-work summaries we calculate from them. This is a separate layer and does not change readiness or load.
Coach notes— notes a coach writes about an athlete and shares with the athlete’s parent or guardian through the app.
Wearables— which wearable devices, if any, the athlete uses (self-reported), and, only where an athlete chooses to connect a supported device such as a Garmin, the daily health and activity summaries described under “Connected wearables and Garmin data” below. Connecting a device is optional and can be undone at any time.
Device and notification information— a push-notification token and platform (iOS or Android) so reminders and coach updates can be delivered, and whether a notification was delivered.
Basic usage events— which screens are used in the app, to keep it working well. These are not used for advertising or sold to anyone.
Payments (individual athletes only)— subscription status and payment reference. Payments are taken by our payment provider; we never see or store card numbers.

Why we use it

To show athletes their own readiness, wellbeing and training-load trends.
To give the coaching, medical and administrative staff of the athlete’s own organisation a view of individual and squad readiness, and to alert them when an athlete flags pain or a possible injury — so training can be adjusted and duty of care met.
To keep parents and guardians informed about their own child, including notes from the coach and when a coach has seen and responded to something their child flagged.
To send check-in reminders (including on the two mornings after a match), coach updates and safety-related notifications.
Where an organisation enables them, to show its staff match statistics, GPS summaries and weigh-in trends beside the readiness picture, each read against the athlete’s own history.
To create accounts, respond to support requests and keep the service secure.

Our lawful grounds are the consent of the athlete or their parent or guardian, the performance of our agreement with the athlete’s school, club or coaching group, and the legitimate interest of that organisation in the safety and wellbeing of the athletes in its care. We do not use personal information for advertising or for any profiling beyond the wellness and training features described here, and we do not track users across other companies’ apps or websites.

Who can see an athlete’s information

The athlete themselves.
Coaching, medical and administrative staff at the athlete’s own school, club or coaching group — and only theirs. Staff never see athletes from another organisation.
The athlete’s linked parents or guardians.
A small botthms operations team, for support and safety purposes only.

Athletes and parents are shown the athlete’s readiness number and how it is moving. Coaches additionally see the underlying inputs and a readiness category to help them plan training.

Service providers and cross-border transfers

We use a small number of processors, each acting on our instructions and not for their own purposes: Supabase (database, authentication and file hosting, in Ireland), Vercel (hosting of the web dashboard and website, application servers in Frankfurt), Expo (push-notification delivery),Resend (transactional email), Stitch (payments for individual subscriptions), Apple and Google (app distribution and push delivery on their platforms), and, only for athletes who connect a device, Garmin (as the source of the wearable data described below). Some of these providers host data outside South Africa. Where that happens we transfer it under section 72 of POPIA, relying on providers whose contractual and technical safeguards give a level of protection substantially similar to POPIA.

How long we keep it

Wellness, body and training information is kept while the athlete’s account is active, because readiness is measured against the athlete’s own history.
When an account is deleted, the personal information described above is permanently removed from our systems. Schools and clubs may separately keep their own medical or safeguarding records as required of them.
Signup requests that are declined or never approved are deleted after 90 days.
Notification and email delivery records are kept for a short period for troubleshooting and then removed.

Deleting your account

Athletes and parents can delete their own account at any time inside the app (Profile → Delete my account for athletes; Home → Delete my account for parents). This permanently removes the account, check-in history, body reports, training logs, device tokens and profile photo. A parent or guardian may also ask us to delete their child’s account by emailing info@botthms.co.za, and we will do it for you.

Your rights

Under POPIA you may ask what personal information we hold about you or your child, ask for it to be corrected or deleted, object to its processing, or withdraw consent (withdrawing consent means the athlete can no longer use the service). Contact us at info@botthms.co.za. You also have the right to lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.

Athletes and clubs in the European Union (GDPR)

Where the service is provided to a club, team or athlete in the European Union, the EU General Data Protection Regulation (GDPR) applies alongside POPIA. In that case the club or team is the data controllerfor its athletes’ information andbotthms Ready (Pty) Ltd is the data processor, acting on the club’s documented instructions under a written data processing agreement. Adult athletes give their own consent at signup (Article 6(1)(a)) and the processing is also necessary for the agreement between the athlete, the club and us (Article 6(1)(b)). Health-related wellness ratings are special-category data processed on the basis of explicit consent (Article 9(2)(a)). All athlete data is stored in the EU (Ireland) and the web application is served from the EU (Frankfurt); push notifications and transactional email are relayed by Expo and Resend in the United States under standard contractual clauses. EU athletes have the rights of access, rectification, erasure, restriction, portability and objection (Articles 15–22) and may contact us at info@botthms.co.za or their national supervisory authority (in Poland, the UODO).

Connected wearables and Garmin data

An athlete (or, for an athlete under 18, their parent or guardian) may choose to connect a supported wearable account to botthms.Ready. The connection uses the device maker’s own authorisation screen — for Garmin, Garmin Connect — and we never see or store the athlete’s Garmin password. Through the Garmin Connect API we receive only daily summaries: sleep duration and stages, resting heart rate, heart-rate variability, activity and steps, and the training-load, stress and body-battery style measures Garmin computes. We do not receive location or GPS tracks, contacts, payment details or any information about other Garmin users.

We use this data for one purpose: to show the athlete, and the coaching and medical staff of the athlete’s own organisation, the athlete’s own recovery and training picture against the athlete’s own history — the same purpose as the daily check-in. Garmin data is displayed alongside our readiness and training-load measures; it is never sold, never used for advertising, never shared with any other company or service, never combined with data about other people, and never used to train any artificial-intelligence model. It is stored on the same encrypted infrastructure as the rest of the athlete’s record and subject to the same access rules. When an athlete disconnects the device, we stop receiving new data and delete the Garmin data already held within 30 days; when an account is deleted, it is deleted with the account. Our use of Garmin data is governed by Garmin’s API terms and brand guidelines in addition to this policy.

Automated processing and AI

Readiness scores, training-load measures, trends, flags and the short written summaries shown to coaches are produced by rules we have written and published in the app: each athlete is compared with their own recent history, and a fixed set of thresholds decides what is shown. These are deterministic calculations, not a learning model, and they run on our own infrastructure.

We do not send athlete personal information — including check-ins, body reports, training logs, match statistics or connected-wearable data such as Garmin data — to any third-party artificial-intelligence or large-language-model service, and we do not use it to train any AI model, ours or anyone else’s. Where we consider adding an AI-assisted feature in future, we will update this policy first, describe exactly what would be sent and to whom, and make it opt-in for the athlete’s organisation; connected-wearable data would be excluded unless the device maker’s terms expressly permit it.

No decision with a legal or similarly significant effect on an athlete is taken automatically. Every readiness reading and flag is decision support for a human coach or practitioner, who decides.

Security

Every account is authenticated, and permissions are enforced at the database level: staff can only read athletes at their own organisation, parents only their own children, and athletes only themselves. Data is encrypted in transit and at rest. Passwords are set by each user and stored only as one-way hashes; invitation links expire.

The website

The marketing website at botthmsready.co.za uses Google Analytics to understand how the site is used. This applies to the website only, not to the app. You can block analytics cookies in your browser without affecting the website or the app.

Changes

If we make material changes to this policy we will update this page, change the effective date above, and, where the change affects how we use athletes’ information, tell schools, clubs and parents directly.

Contact

botthms Ready (Pty) Ltd · Randpark Golf Club, Randburg, Johannesburg, South Africa · info@botthms.co.za