Dura Performance Limited
Building 18, Gateway 1000, Whittle Way
Arlington Business Park, Stevenage
Hertfordshire, England, SG1 2FP
Contact: mlook@duraperformance.co.uk
Details of each type of personal data collected are provided in the relevant sections of this policy or by specific explanatory text presented before collection takes place. Personal data may be provided directly by the user or, in the case of usage data, collected automatically when you use this application.
Unless stated otherwise, all data requested by this application is mandatory. Failure to provide it may prevent the application from delivering its services. Where data is marked optional, you are free to withhold it without affecting service availability.
Any use of cookies or tracking tools serves the purpose of delivering the service and any other purposes described in this policy and our Cookie Policy.
This application is a sports performance monitoring platform. As part of its core function, it collects, stores and processes health data relating to athletes. This constitutes special category data under Article 9 of the UK GDPR and is processed only with the explicit consent of the data subject, or where necessary for the provision of services under a contract with the relevant sporting organisation.
The following categories of health and performance data are collected and processed:
Records of athlete injuries including injury type, affected body area, onset date, severity, and recovery status. Entered manually by practitioners or athletes.
Physical measurements and monitoring metrics recorded over time, including body composition data and other practitioner-assessed physical attributes.
Self-reported sleep duration and quality metrics logged by athletes or practitioners to support wellbeing monitoring.
Subjective stress and wellness scores recorded to monitor athlete readiness and mental load alongside physical training demands.
Session rating of perceived exertion (RPE) and related internal load metrics entered by athletes following training sessions.
Objective training load data including distances, durations, and effort metrics, entered manually or uploaded by practitioners from training records.
GPS and movement data collected via third-party wearable hardware worn by athletes during training and match play. This data is not collected by this application directly — it is uploaded to the platform by practitioners from the third-party device system. Data includes distance covered, speed, acceleration, deceleration, and high-speed running metrics.
Records of individual training and match sessions including session type, date, duration, and associated performance metrics.
Availability and readiness status logs indicating whether an athlete is available for training or competition, including the reason for any unavailability.
Calculated and recorded risk scores derived from combinations of the above health and performance data, used to inform practitioner decisions.
Individual athlete performance and health goals set by the athlete or practitioner.
Free-text notes recorded by practitioners in relation to an athlete's health, performance, or progress.
Name and contact details of an athlete's nominated emergency contact. This is not health data but is stored alongside athlete records for safeguarding purposes.
Health and performance data is used solely to deliver the performance monitoring service to the athlete's organisation. It is used to generate charts, trend analyses, risk indicators, and availability reports for use by authorised practitioners within that organisation. It is not used for advertising, profiling for commercial purposes, or shared with third parties outside the platform without explicit consent.
Aggregated or anonymised data may be used to generate squad-level or group-level reports visible to authorised practitioners within the same organisation. Individual athlete data is not visible to other athletes.
Athlete accounts are created by the subscribing organisation, not by athletes directly. The subscribing organisation (such as a sports club or coaching team) acts as the data controller for their athletes and is responsible for obtaining appropriate consent or establishing a lawful basis for processing health data under their own data agreements with those individuals.
Dura Performance Limited acts as a data processor on behalf of the subscribing organisation, processing athlete health data solely for the purpose of delivering the platform service. This relationship is governed by our data processing terms agreed with each organisation at the point of subscription.
Processing is carried out under Article 9(2)(b) of the UK GDPR where necessary for carrying out obligations in the field of sport and athlete welfare, and under Article 6(1)(b) in performance of a contract with the subscribing organisation. Athletes wishing to exercise their data rights should contact their organisation in the first instance, or contact us directly using the details in the Owner section of this policy.
We take appropriate security measures to prevent unauthorised access, disclosure, modification or destruction of your data. Processing is carried out using computers and IT-enabled tools, following organisational procedures tied to the purposes set out in this policy. In some cases data may be accessible to staff involved in the operation of this application, or to third-party technical providers appointed as data processors.
Data is processed at our operating offices and wherever the parties involved in processing are located. Where your location requires an international data transfer, the relevant section of this policy describes the safeguards in place.
Personal data is stored for as long as required to fulfil the purpose for which it was collected. Once the retention period expires, data is deleted, and rights of access, erasure, rectification and portability can no longer be exercised.
Your data is processed to provide and operate the service, fulfil contractual obligations, comply with legal requirements, and pursue legitimate interests where applicable. Specific purposes are described in the context in which data is collected.
We may process your data where you have given consent; where processing is necessary for a contract with you; where we are under a legal obligation; where processing is in the public interest or exercise of official authority; or where processing is necessary for our legitimate interests or those of a third party.
Data collected for contractual purposes is retained until the contract is fully performed. Data collected for legitimate interests is retained as long as needed to fulfil those interests. You may find specific information in the relevant sections of this document or by contacting us. Longer retention is possible where you have consented, or where we are required to retain data by law.
Under the GDPR, you have the following rights in relation to your personal data:
You may withdraw any consent you have previously given at any time.
You may object to processing carried out on a legal basis other than consent. You may always object to processing for direct marketing purposes, free of charge and without justification.
You have the right to know whether your data is being processed, and to obtain a copy of it.
You have the right to verify the accuracy of your data and request corrections.
You may request that we restrict processing of your data to storage only.
You have the right to request deletion of your personal data.
You have the right to receive your data in a structured, machine-readable format and, where technically feasible, to have it transferred to another controller.
You have the right to bring a claim before your national data protection authority. In the UK, this is the Information Commissioner's Office (ICO).
To exercise any of these rights, contact us using the details in the Owner section above. Requests are free of charge and will be responded to within one month.
Personal data may be used for legal purposes in court or in connection with legal action arising from improper use of this application. We may be required to disclose personal data to public authorities on request.
For operational and maintenance purposes, this application and any third-party services may collect system logs or use data such as IP addresses.
We reserve the right to update this policy at any time. Changes will be notified on this page. Where changes affect processing based on your consent, we will seek fresh consent where required. We recommend checking this page periodically.
Any information that directly or indirectly allows for the identification of a natural person.
Information collected automatically when you use this application, including IP addresses, browser type, pages visited, time spent, and other technical parameters.
The individual using this application.
The entity that determines the purposes and means of processing personal data. For this application, the Data Controller is Dura Performance Limited.
A natural or legal person that processes personal data on behalf of the Data Controller.
The means by which personal data is collected and processed, as described in this policy.