Privacy policy

Last updated: October 2026

1. Who we are

VitalForg is performance-data software for sports organizations. VitalForg is headquartered in Abuja, Nigeria, and is open to sports organizations in any country. For any privacy question or request, email jennifer@vitalforg.com.

2. Our role

Clubs, academies and performance facilities (our customers) decide what athlete data to put into their VitalForg workspace and why. For that athlete data, the customer is responsible for it and VitalForg processes it only on the customer’s instructions to provide the service. If you are an athlete, please contact your club or organization first about your data; if you contact us, we will pass your request to them and help them answer it.

VitalForg is responsible for the accounts of staff who sign in, messages sent through our contact form, security logs, and business contact details of our customers.

3. Visiting our website

• We do not use analytics, advertising or tracking cookies, and we do not build visitor profiles.
• Fonts, styles and scripts are served from our own site. Our pages do not load anything from other companies.
• The public demo uses only fictional data. Its calculations run in your browser, flag reviews you save stay in your browser’s local storage, and CSV files you check are not uploaded. Please do not enter real athlete data into the demo.

4. Cookies

We use one cookie, vf_sid, which keeps you signed in to the VitalForg application. It is set when you sign in and ends when you sign out, close your browser, or after 8 hours of inactivity. It is marked HttpOnly and SameSite=Lax, and is only sent over secure connections when the site is used over HTTPS. We use no other cookies.

5. Staff accounts

For each user we hold their name, email address, password (stored only as a one-way hash, so we cannot read it), last sign-in time, and the workspaces and roles (owner, admin, analyst or viewer) they have. When you sign up, we also record that you confirmed you are 18 or over, agreed to the Terms of service and read this Privacy policy. We use this information to provide the service, control access and send service emails such as invitations and password-reset links.

6. Contact form

When you use our contact form we receive your name, email, organization, enquiry type, message, IP address and the time, so that we can reply and protect the form from abuse. Please do not send athlete data through the contact form or by email.

7. Security logs

To keep the service secure, we record actions in the application (such as imports, membership changes and deletions) with the user, workspace, IP address and time; failed sign-in attempts; password-reset requests; and requests made with API keys. Workspace admins can read their own workspace’s activity log.

8. Athlete data in workspaces

Workspaces currently accept synthetic test data only. The kinds of data a workspace can hold are:

• athlete code, name, team, position and date of birth;
• training sessions: date, start time, session type, duration, rating of perceived exertion, distance, high-speed running distance and the recording device;
• morning wellness: heart rate variability, resting heart rate, sleep hours, soreness rating and the recording device;
• jump tests: countermovement jump height and trials;
• notes staff write when reviewing flags, and a history of imports.

Some of these measures, such as heart rate variability, resting heart rate, sleep and soreness, may be treated as health information. Customers are responsible for having a lawful basis to use them and for telling their athletes how their data is used.

When a CSV file is imported, each row is checked and only valid rows are stored; the original file is not kept.

VitalForg’s flags compare an athlete’s recent data with their own baseline and with simple rules, such as a rapid rise in training load. They are decision support for qualified staff, not medical advice or a diagnosis, and should not be the only basis for selection, medical or employment decisions. One check uses a machine-learning model to flag unusual patterns for staff to review. No decision about an athlete is made automatically.

9. Adults only

VitalForg is for adults only. Account holders must be 18 or over, and customers must not upload data about anyone under 18. Every athlete must have a date of birth, and anyone under 18 is refused, whether entered in the app, imported from a file or sent through the API. If we learn that data about a person under 18 has been stored, we delete it.

10. Who we share data with

We do not sell personal data or use it for advertising. Our website, application, database and outgoing email are hosted by Namecheap. We may also disclose information where the law requires it.

11. Where data is stored

VitalForg is based in Nigeria and our data is hosted with Namecheap. Because our customers and their athletes may be in any country, personal data may be stored and accessed outside the country where you live.

12. How we protect data

Signed-in use is only over secure (HTTPS) connections. Passwords are stored only as one-way hashes. Permission checks run on the server for every request, and each organization’s workspace is kept separate. We protect forms against cross-site request forgery, limit repeated sign-in, password-reset and API attempts, and keep an activity log. Users can turn on two-step sign-in with an authenticator app, and owners and admins of workspaces holding real athlete data must use it. The database and files are backed up daily in encrypted form, stored outside the public website, with the encryption key kept separately. VitalForg has not completed an independent security audit or certification, and no system can be guaranteed completely secure.

13. How long we keep data

We keep personal data only as long as needed for the purposes above. Logs are removed automatically on a schedule once they are no longer needed, while records of important security events are kept longer to protect accounts. Athlete data is kept until the customer deletes it or their workspace or contract ends.

Backups are kept for a limited period and then expire automatically, so deleted data also disappears from backups once those backups expire. We do not edit individual records inside encrypted backups. Instead, we keep a list of the identifiers of deleted records, containing no personal details, and if a backup ever has to be restored, those records are deleted again before the restored copy is used.

14. Deleting and exporting data

• Any user can delete their own account after re-entering their password. A workspace owner with other members must first transfer ownership.
• A workspace owner can delete the whole workspace, including its athletes, records, review notes, imports and API keys, after re-entering their password and typing the workspace name.
• Workspace admins can export everything stored about one athlete, correct athlete details, and delete an athlete together with their sessions, wellness records, tests and related notes.

15. Your rights

Depending on where you live, you may have the right to access, correct or delete your personal data, to object to or restrict its use, to receive a copy in a portable format, and to withdraw consent where we rely on it. For your staff account, contact-form messages or security logs, email jennifer@vitalforg.com; we may need to confirm your identity. For athlete data, contact the club or organization that holds it. You may also have the right to complain to the data protection authority in your country.

16. Changes to this policy

We will post any changes on this page with a new date and tell customer account owners about significant changes by email.

17. Contact

Email jennifer@vitalforg.com or use our contact form.