RTS ProtocolPrivacy Policy
RTS Protocol helps athletes return to sport after injury under the guidance of their sports-medicine or rehabilitation practice. Because the service exists to handle recovery data, we hold ourselves to a simple standard: we collect only what the service needs, we share it only with your care team and the vendors that run the service, and we never sell it or use it for advertising. This policy explains exactly what that means. It covers the RTS Protocol website (rtsprotocol.com), web app, and iOS app (together, the “Service”).
1. How RTS Protocol accounts work
There is no self-registration. Every account is created by a sports-medicine or rehabilitation practice (a “Practice”) for its own staff and athletes. Your Practice decides what clinical information is recorded about you, and your data is visible only inside your own Practice — practices can never see each other’s data.
2. Information we collect
Account information
- Name, username, email address, and role (for example provider, or athlete), and for athletes: date of birth, sport, and position, as entered by your Practice.
Health and rehabilitation information
- Injury and diagnosis details, injury and surgery dates, and return-to-sport phase history, as recorded by your Practice.
- Daily check-ins you submit: pain, soreness, fatigue, sleep quality, stress, and confidence ratings, and the readiness score computed from them.
- Exercise activity: assigned programs, completions, and the pain/difficulty ratings and notes you attach to them.
- Sport workload: throwing counts and similar volume entries, distances, intensity, and planned activities.
- Movement videos you or your Practice upload, along with provider annotations and comments on them.
Apple Health data (iOS app, optional)
- If — and only if — you grant permission in the iOS Health prompt, the app reads your recent sleep data (total sleep and sleep stages) and dietary intake (calories, protein, carbohydrates, fat — including data other apps such as MyFitnessPal write to Apple Health) and syncs daily summaries to your record so you and your care team can see them.
Technical and security information
- A security audit trail of actions taken in the Service (who did what and when), including IP address and browser/device identifiers. This exists to protect your records.
- One strictly necessary session cookie that keeps you signed in. We use no advertising cookies, no tracking pixels, and no third-party analytics.
3. Our Apple Health (HealthKit) commitments
- Health data is used only to display your sleep and nutrition to you and your care team inside the Service.
- We never use HealthKit data for advertising, marketing, or similar purposes.
- We never sell HealthKit data or disclose it to third parties, including data brokers or information resellers.
- We do not use HealthKit data for machine-learning training or any purpose unrelated to providing the Service to you.
- You can revoke access at any time in iOS Settings → Privacy & Security → Health → RTS Protocol. Revoking stops all future syncing; previously synced daily summaries remain in your record until you ask us or your Practice to delete them.
4. How we use information
- To operate the Service: showing your plan, computing readiness and workload-ratio scores, powering your care team’s dashboards, and streaming your videos to the people treating you.
- To send service emails, such as morning reminders of your planned activities and notifications to your provider when you upload a video. We do not send marketing email.
- To secure the Service: authentication, access control, and the audit trail.
- To support you when you or your Practice ask for help.
We do not sell personal information. We do not share it for advertising. We do not profile you for any purpose unrelated to your rehabilitation.
5. How information is shared
- Your care team. Staff of your own Practice (providers and practice administrators) see your record to guide your rehabilitation. Access is limited to your Practice by technical controls.
- Service vendors. We use a small number of infrastructure providers to run the Service — currently server hosting (DigitalOcean, United States) and email delivery. They process data only to provide those functions.
- Legal requirements. We may disclose information if required by law, court order, or to protect the rights, safety, or property of users or the public.
- Business transfer. If RTS Protocol is acquired or merged, data may transfer under this policy’s protections; we would notify you of any material change.
That is the complete list. No data brokers, no advertisers, no social networks.
6. Young athletes
Many athletes in rehabilitation are minors. The Service is not offered directly to children: a minor’s account is created only by their Practice as part of care, and the Practice is responsible for obtaining the consent of a parent or guardian before the athlete uses the Service. We collect no more information from a minor than from any other athlete, we never use a minor’s information for marketing, and a parent or guardian may review the athlete’s information or request its deletion at any time through the Practice or by contacting us directly.
7. Your relationship with your Practice
Your Practice controls the clinical content of your record — what is diagnosed, prescribed, and recorded. We process that information on the Practice’s behalf to provide the Service. Practices remain responsible for their own legal and professional obligations regarding patient records. Questions about your clinical care belong with your Practice; questions about this Service belong with us.
8. Security
- All traffic is encrypted in transit with TLS (HTTPS).
- Passwords are stored only as salted bcrypt hashes — we cannot read them.
- Access is role-based and partitioned by Practice; athletes see only their own record.
- Every significant action is recorded in an append-only audit trail that no user of the application can edit or erase.
- Videos are stored privately and streamed only to authenticated members of your own Practice — they are never publicly addressable.
No system is perfectly secure, but if we learn of a breach affecting your information we will notify you and your Practice promptly and as required by law.
9. Retention and deletion
We keep your information while your account is active with your Practice. You may ask your Practice, or us directly, to delete your videos, your wearable data, or your entire record. We honor deletion requests except where a record must be kept for security or legal reasons (for example, entries in the security audit trail, which contain no health measurements). Disabled accounts can no longer sign in or be viewed by anyone other than practice administrators.
10. Your rights
You may request access to, correction of, export of, or deletion of your personal information by contacting us or your Practice. California residents have corresponding rights under the CCPA/CPRA, including the rights to know, correct, and delete; we do not “sell” or “share” personal information as those terms are defined in California law, and we treat all users, everywhere, to that same standard. We will never discriminate against you for exercising a privacy right.
11. Where data lives
The Service is hosted in the United States. If you use it from elsewhere, you consent to processing in the United States.
12. Changes to this policy
If we change this policy, we will post the new version here with a new effective date, and for material changes we will notify Practices so they can inform their athletes. The current version always lives at rtsprotocol.com/privacy.html.
13. Contact
PeopleStar Enterprises, Inc. · RTS Protocol
Email: Chip@chipandkim.com