Legal
Privacy Policy
Also see Terms of Use
1. Introduction
1.1 This Privacy Policy describes how [INSERT LEGAL COMPANY NAME] ACN [INSERT ACN], trading as EkkoU (EkkoU, we, us or our), collects, holds, uses, processes, discloses, protects and otherwise handles Personal Information in connection with the EkkoU application, website, software and associated services.
1.2 EkkoU is committed to managing Personal Information in an open, transparent and privacy-conscious manner.
1.3 EkkoU has been designed around the principle:
We analyse movement, not identity.
1.4 EkkoU is a private individual-athlete movement-analysis platform. It is not intended to operate as:
(a) a social network;
(b) a video-hosting platform;
(c) a coach-athlete communication platform;
(d) a school-management platform;
(e) an advertising platform; or
(f) a medical or healthcare service.
1.5 This Privacy Policy should be read together with the EkkoU Terms and Conditions.
2. Definitions
2.1 In this Privacy Policy:
Account means an account established to access or use EkkoU.
AI System means any artificial intelligence, machine-learning, computer-vision, language-model, inference-model or similar technology used by EkkoU.
App means the EkkoU mobile application and any replacement, successor or updated version.
Applicable Privacy Law means any privacy, data-protection or related law applicable to EkkoU's handling of Personal Information.
Child means a person under 18 years of age, unless Applicable Privacy Law requires a different definition for a particular purpose.
Derived Movement Data means information generated from analysis of a video, including body landmarks, joint positions, angles, timing, speed, alignment, biomechanical measurements, Ekko Scores, performance indicators and related movement-analysis information.
Ekko Score means the proprietary movement-similarity score generated by EkkoU.
Parent or Guardian means a person with lawful parental responsibility or guardianship for a Child.
Personal Information has the meaning given to that expression under Applicable Privacy Law and, in Australia, includes information or an opinion about an identified individual or an individual who is reasonably identifiable.
Reference Content means a video selected for use as a movement reference.
Service means the EkkoU App, associated software, websites, movement-analysis systems, AI Systems, Ekko Score functionality and associated services.
User means an individual who accesses or uses the Service.
User Content means video or other permitted Content selected, recorded or supplied by or on behalf of a User.
3. Scope of this Privacy Policy
3.1 This Privacy Policy applies to Personal Information handled by EkkoU in connection with:
(a) creation and administration of Accounts;
(b) parental or guardian consent;
(c) movement analysis;
(d) Ekko Scores and performance history;
(e) purchases and subscriptions;
(f) customer support;
(g) security and fraud prevention;
(h) communications; and
(i) operation and improvement of the Service.
3.2 This Privacy Policy does not govern the independent privacy practices of third parties such as:
(a) Apple;
(b) Google;
(c) Stripe;
(d) telecommunications providers; or
(e) other independent services used by a User outside EkkoU.
4. Privacy by Design
4.1 EkkoU seeks to collect and retain only information reasonably necessary to provide and operate the Service.
4.2 EkkoU's standard privacy design includes:
(a) private Accounts by default;
(b) no public User profiles;
(c) no public video sharing;
(d) no social feed;
(e) no User-to-User messaging;
(f) no public leaderboards;
(g) no coach access to athlete Accounts;
(h) no school or club access to athlete Accounts;
(i) no facial-recognition identity system;
(j) no sale of Personal Information;
(k) no provision of athlete data to advertisers; and
(l) no use of identifiable athlete video to train general-purpose AI models.
5. Information We Collect
5.1 Depending on how a User interacts with EkkoU, we may collect or hold the following categories of Personal Information.
Account information
5.2 EkkoU may collect:
(a) username;
(b) email address;
(c) age category; and
(d) Account credentials or authentication records.
Parent or Guardian information
5.3 Where parental or guardian consent is required, EkkoU may collect information reasonably necessary to:
(a) contact the Parent or Guardian;
(b) record that consent was requested;
(c) record that consent was provided;
(d) record the date of consent;
(e) record the version of the relevant Terms or Privacy Policy accepted; and
(f) record withdrawal of consent where applicable.
Movement and performance information
5.4 EkkoU may collect or generate:
(a) body landmark data;
(b) joint positions;
(c) joint angles;
(d) movement timing;
(e) movement speed;
(f) body alignment;
(g) movement sequences;
(h) biomechanical measurements;
(i) technique-related measurements;
(j) Ekko Scores;
(k) movement-analysis reports; and
(l) progress-history information.
Purchase and subscription information
5.5 EkkoU may receive limited information concerning:
(a) purchase status;
(b) subscription status;
(c) transaction identifiers;
(d) billing status;
(e) refund status; and
(f) other information necessary to administer access to paid features.
5.6 EkkoU does not ordinarily receive or store complete payment-card details where payment is processed directly by Apple, Google, Stripe or another authorised payment provider.
Support and security information
5.7 EkkoU may collect information provided in connection with:
(a) support requests;
(b) complaints;
(c) account-recovery requests;
(d) security incidents;
(e) suspected misuse; or
(f) legal or regulatory enquiries.
6. Information We Do Not Ordinarily Require
6.1 EkkoU does not ordinarily require a User to provide:
(a) full legal name;
(b) full date of birth;
(c) gender;
(d) school;
(e) sporting club;
(f) team;
(g) playing position;
(h) residential address;
(i) telephone number;
(j) precise geolocation;
(k) injury history;
(l) medical diagnosis; or
(m) health information.
6.2 EkkoU does not intentionally collect information merely because it may be useful for unrelated future purposes.
7. Age Information
7.1 EkkoU is intended for Users aged 10 years and over.
7.2 EkkoU seeks to minimise collection of unnecessary date-of-birth information.
7.3 Where practicable, EkkoU may collect an age category rather than a full date of birth, such as:
(a) 10–12 years;
(b) 13–17 years; or
(c) 18 years and over.
7.4 EkkoU may collect additional age-assurance information where required by Applicable Privacy Law.
8. Children and Young People
8.1 EkkoU recognises that information relating to Children requires a high level of privacy protection.
8.2 EkkoU intends to apply child-centred privacy safeguards including:
(a) high privacy settings by default;
(b) data minimisation;
(c) no public sharing;
(d) no behavioural advertising based on athlete performance;
(e) no unnecessary geolocation collection;
(f) no sale of children's Personal Information;
(g) no use of identifiable Child video for general-purpose AI training; and
(h) parental or guardian consent where required.
8.3 Users aged 10 to 12 may only use EkkoU through an Account established, authorised or approved by a Parent or Guardian.
8.4 Users aged 13 to 17 may operate an Account only where required parental or guardian consent has been obtained.
8.5 EkkoU may impose additional consent or age-assurance requirements where required in a particular country.
9. Parental and Guardian Consent
9.1 Where parental or guardian consent is required, EkkoU may record information necessary to demonstrate that consent was obtained.
9.2 EkkoU may retain records including:
(a) the relevant Account identifier;
(b) Parent or Guardian contact information;
(c) date consent was requested;
(d) date consent was provided;
(e) consent status; and
(f) version of the relevant legal notices accepted.
9.3 A Parent or Guardian may contact EkkoU to request information about a Child's Account or to withdraw consent where permitted by Applicable Privacy Law.
9.4 Where valid consent is withdrawn and EkkoU cannot lawfully continue processing the Child's Personal Information, EkkoU may restrict or delete the relevant Account.
10. Video Handling
10.1 EkkoU is not intended to operate as a cloud video-storage platform.
10.2 User videos are intended to remain stored on the User's device.
10.3 EkkoU does not intentionally retain original User videos as permanent server-side Account content.
10.4 Where technically required, EkkoU may temporarily process a video or create a transient technical copy solely for purposes including:
(a) body-landmark detection;
(b) movement-data extraction;
(c) movement comparison;
(d) Ekko Score generation; and
(e) report generation.
10.5 Temporary video processing is intended to occur only for the period reasonably required to complete the requested analysis.
10.6 Temporary processing copies are not intended to become part of a permanent EkkoU video library.
10.7 EkkoU may retain Derived Movement Data after video processing has been completed.
10.8 Video stored on the User's device remains under the User's control and may be deleted independently of EkkoU.
11. Local Video References
11.1 EkkoU may retain a local file reference, identifier or metadata necessary to allow the App to locate video stored on the User's device.
11.2 A local reference does not mean that EkkoU holds a server-side copy of the video.
11.3 If a User deletes or moves the relevant video on their device, EkkoU may no longer be able to access that video.
12. Derived Movement Data
12.1 EkkoU may retain Derived Movement Data separately from the original video.
12.2 Derived Movement Data may include information concerning:
(a) body landmarks;
(b) joint positions;
(c) joint angles;
(d) limb movement;
(e) movement speed;
(f) timing;
(g) body alignment;
(h) jump characteristics;
(i) technique measures;
(j) Ekko Scores; and
(k) historical performance comparisons.
12.3 Where Derived Movement Data is linked or reasonably linkable to a User, EkkoU will treat it as Personal Information where required by Applicable Privacy Law.
12.4 EkkoU will not describe information as anonymous merely because a User's face or name has been removed if the individual remains reasonably identifiable.
13. Facial Recognition and Identity
13.1 EkkoU does not use facial recognition to identify Users.
13.2 EkkoU does not intentionally:
(a) identify a User from facial characteristics;
(b) compare a User's face against identity databases;
(c) create facial-recognition templates;
(d) create facial identity profiles; or
(e) recognise returning Users from facial appearance.
13.3 EkkoU's computer-vision systems are intended to analyse movement and body position, not identity.
14. Artificial Intelligence
14.1 EkkoU may use AI Systems to assist with:
(a) movement interpretation;
(b) comparison;
(c) analysis;
(d) Ekko Score-related processing;
(e) report generation; and
(f) explanatory feedback.
14.2 EkkoU's AI model is intended to be hosted on infrastructure controlled by EkkoU.
14.3 EkkoU does not ordinarily send athlete videos or movement data to an external general-purpose AI provider for analysis.
14.4 EkkoU does not intentionally use identifiable athlete video to train general-purpose AI models.
14.5 EkkoU does not intentionally use identifiable video of Children as general-purpose AI training material.
14.6 EkkoU may use properly aggregated or genuinely de-identified information to:
(a) improve system performance;
(b) validate movement-analysis methods;
(c) improve product functionality;
(d) conduct technical research; and
(e) produce statistical information,
where permitted by Applicable Privacy Law.
15. Automated Analysis and Decisions
15.1 EkkoU uses computer programs and automated systems to:
(a) extract movement characteristics;
(b) compare User movement with Reference Content;
(c) generate an Ekko Score;
(d) generate automated observations; and
(e) produce movement-analysis reports.
15.2 EkkoU's automated outputs are intended to assist the User in understanding movement similarity.
15.3 EkkoU does not intend the Ekko Score to determine:
(a) employment;
(b) education admission;
(c) school grades;
(d) team selection;
(e) eligibility for insurance;
(f) healthcare treatment;
(g) access to essential services; or
(h) another decision of comparable legal or significant effect.
15.4 EkkoU may nevertheless provide additional information about automated processing where required by Applicable Privacy Law.
16. How We Use Personal Information
16.1 EkkoU may use Personal Information for purposes including:
(a) creating and maintaining Accounts;
(b) verifying Account access;
(c) obtaining and recording parental or guardian consent;
(d) providing movement analysis;
(e) generating Ekko Scores;
(f) generating reports;
(g) storing progress-history information;
(h) processing purchases and subscriptions;
(i) providing customer support;
(j) preventing fraud and misuse;
(k) maintaining security;
(l) investigating complaints;
(m) complying with legal obligations;
(n) administering Account deletion;
(o) communicating important Service information; and
(p) improving EkkoU where permitted by law.
16.2 EkkoU will not use Personal Information for an unrelated purpose where doing so would require additional consent or otherwise contravene Applicable Privacy Law.
17. Direct Marketing
17.1 EkkoU may send necessary operational communications including:
(a) account verification;
(b) parental-consent requests;
(c) security notices;
(d) purchase or subscription notices;
(e) password-recovery communications;
(f) legal notices; and
(g) material Service updates.
17.2 EkkoU may separately send optional marketing communications where lawful.
17.3 Users will be provided with an appropriate means of opting out of direct marketing where required.
17.4 EkkoU will not sell Personal Information to advertisers.
17.5 EkkoU does not intend to use children's movement or performance data to create advertising profiles.
18. Disclosure of Personal Information
18.1 EkkoU does not ordinarily disclose private athlete Account data to:
(a) coaches;
(b) schools;
(c) clubs;
(d) teams;
(e) other Users; or
(f) advertisers.
18.2 EkkoU may disclose or make Personal Information accessible where reasonably necessary to:
(a) infrastructure and hosting providers;
(b) payment providers;
(c) App marketplaces;
(d) email-delivery providers;
(e) professional advisers;
(f) law-enforcement bodies;
(g) regulators;
(h) courts or tribunals; or
(i) other recipients where required or authorised by law.
18.3 EkkoU will seek to limit disclosures to what is reasonably necessary for the relevant purpose.
19. No Sale of Personal Information
19.1 EkkoU does not sell Personal Information.
19.2 EkkoU does not sell:
(a) athlete video;
(b) movement profiles;
(c) Ekko Scores;
(d) Child information;
(e) Account information; or
(f) performance histories
to advertisers, data brokers or other third parties.
20. Infrastructure and Hosting
20.1 EkkoU operates using VPS and associated infrastructure.
20.2 EkkoU infrastructure may be located outside Australia.
20.3 EkkoU currently expects that some infrastructure may be located in the United Kingdom.
20.4 Personal Information may therefore be stored or processed outside Australia.
20.5 EkkoU will update this Privacy Policy if material hosting arrangements or relevant locations change.
21. Overseas Processing and Disclosure
21.1 Where EkkoU provides Personal Information to an overseas recipient, EkkoU will handle that disclosure in accordance with Applicable Privacy Law.
21.2 Whether a particular hosting arrangement constitutes a disclosure to an overseas recipient may depend on the nature of the service and the degree of control EkkoU retains over the information.
21.3 Where practicable, EkkoU will identify countries in which overseas recipients of Personal Information are likely to be located.
21.4 EkkoU currently expects that relevant overseas processing may occur in the United Kingdom.
22. Self-Hosted AI
22.1 EkkoU's AI System is intended to operate on EkkoU-controlled VPS infrastructure.
22.2 EkkoU does not intend to transmit User video or Derived Movement Data to an external DeepSeek API or other external general-purpose AI provider for ordinary analysis.
22.3 The use of a self-hosted model is intended to reduce unnecessary third-party access to User data.
22.4 Hosting and infrastructure providers may nevertheless process or have technical access to information to the extent necessary to provide infrastructure services.
23. Payment Providers
23.1 Purchases may be processed through providers including:
(a) Apple;
(b) Google;
(c) Stripe; or
(d) another payment provider notified by EkkoU.
23.2 Those providers independently collect and process payment information according to their own privacy policies.
23.3 EkkoU may receive transaction-related information necessary to:
(a) confirm payment;
(b) activate features;
(c) administer subscriptions;
(d) process refunds; or
(e) resolve payment disputes.
24. Administrative Access
24.1 Access to User Personal Information within EkkoU will be restricted to authorised administrators.
24.2 Administrative access is intended to occur only where reasonably necessary for:
(a) customer support;
(b) security;
(c) account recovery;
(d) technical troubleshooting;
(e) maintenance;
(f) investigation of misuse;
(g) fraud prevention;
(h) legal compliance; or
(i) protection of EkkoU or its Users.
24.3 Because EkkoU does not intend to retain original User videos server-side, administrators should not ordinarily have access to original athlete video through EkkoU's server systems.
24.4 EkkoU intends to maintain audit logs relating to authorised access to sensitive or Account-linked information.
25. Security
25.1 EkkoU will take reasonable technical and organisational steps to protect Personal Information from:
(a) misuse;
(b) interference;
(c) loss;
(d) unauthorised access;
(e) unauthorised modification; and
(f) unauthorised disclosure.
25.2 Security measures may include:
(a) encrypted network communications;
(b) secure authentication;
(c) restricted administrative privileges;
(d) access controls;
(e) audit logging;
(f) server updates and patching;
(g) secure database configuration;
(h) monitoring for suspicious activity; and
(i) incident-response procedures.
25.3 No internet-connected system can be guaranteed to be completely secure.
26. Data Breaches and Security Incidents
26.1 EkkoU will maintain procedures for responding to suspected or confirmed privacy and security incidents.
26.2 Where an incident occurs, EkkoU may:
(a) investigate;
(b) contain the incident;
(c) determine what information was affected;
(d) remediate vulnerabilities;
(e) preserve relevant evidence;
(f) notify affected individuals; and
(g) notify regulators or other authorities
where required by Applicable Privacy Law.
27. Retention of Personal Information
27.1 EkkoU will not retain Personal Information for longer than reasonably necessary for the purpose for which it was collected, subject to legal and operational requirements.
27.2 Retention periods may depend on:
(a) whether an Account remains active;
(b) the purpose of the information;
(c) legal requirements;
(d) dispute or fraud risks;
(e) taxation or accounting obligations; and
(f) security requirements.
27.3 EkkoU does not intend to retain original athlete videos as permanent server-side content.
28. Account Deletion
28.1 Users may request permanent deletion of their EkkoU Account.
28.2 An eligible Parent or Guardian may request deletion of a Child's Account.
28.3 Subject to any lawful retention requirement, Account deletion may include deletion of:
(a) username;
(b) email address;
(c) Account credentials;
(d) movement history;
(e) Derived Movement Data;
(f) Ekko Scores;
(g) reports;
(h) parental-consent records where no longer required; and
(i) other Account-linked Personal Information.
28.4 EkkoU intends to delete Personal Information from active systems promptly following a valid deletion request.
28.5 EkkoU may retain limited information where legally required or reasonably necessary for:
(a) taxation;
(b) accounting;
(c) fraud prevention;
(d) payment disputes;
(e) legal claims;
(f) regulatory obligations; or
(g) enforcement of legal rights.
28.6 Account deletion does not delete video stored independently on the User's device.
29. Backups, Logs and Temporary Copies
29.1 EkkoU aims to minimise retention of Personal Information in backups, logs and temporary technical systems.
29.2 Before launch, EkkoU will verify its production configuration for:
(a) VPS snapshots;
(b) automated backups;
(c) application logs;
(d) cache storage;
(e) temporary video-processing files; and
(f) disaster-recovery systems.
29.3 EkkoU will not state that all information is "immediately and permanently deleted from every system" unless its production architecture supports that representation.
29.4 Where residual copies must temporarily remain for technical or legal reasons, EkkoU will seek to restrict further use of those copies and remove them in accordance with applicable retention processes.
30. Inactive Accounts
30.1 EkkoU may classify an Account as inactive after approximately 24 months without use.
30.2 Where reasonably practicable, EkkoU will provide notice to the registered email address before deleting an inactive Account.
30.3 EkkoU may vary the inactivity period where reasonably necessary for legal, regulatory, technical or operational reasons.
31. Access to Personal Information
31.1 A User may request access to Personal Information EkkoU holds about them.
31.2 A Parent or Guardian may request access to information concerning a Child where permitted by Applicable Privacy Law.
31.3 EkkoU may require reasonable identity verification before providing access.
31.4 EkkoU may refuse or limit access where permitted or required by Applicable Privacy Law.
31.5 Where access is refused, EkkoU will provide any notice or explanation required by Applicable Privacy Law.
32. Correction of Personal Information
32.1 Users may request correction of Personal Information that is inaccurate, out of date, incomplete, irrelevant or misleading.
32.2 EkkoU may take reasonable steps to verify the requested correction.
32.3 Where required by Applicable Privacy Law, EkkoU will take reasonable steps to correct information it is satisfied is inaccurate or otherwise requires correction.
33. Withdrawal of Consent
33.1 Where EkkoU relies on consent for a particular processing activity, that consent may be withdrawn where permitted by Applicable Privacy Law.
33.2 Withdrawal of consent does not necessarily affect processing that was lawful before withdrawal.
33.3 Where withdrawal means EkkoU can no longer lawfully provide part or all of the Service, EkkoU may restrict or terminate the relevant Account or functionality.
34. Complaints
34.1 A User, Parent or Guardian may make a privacy complaint by contacting EkkoU using the details at the end of this Privacy Policy.
34.2 A complaint should provide sufficient information to allow EkkoU to understand and investigate the concern.
34.3 EkkoU will seek to:
(a) acknowledge the complaint;
(b) investigate it appropriately;
(c) communicate with the complainant where further information is required; and
(d) provide a response within a reasonable period.
34.4 Where a complainant remains dissatisfied, they may have the right to contact the relevant privacy regulator in their jurisdiction.
35. Australian Privacy Complaints
35.1 Australian Users may have rights to raise privacy matters with the Office of the Australian Information Commissioner where applicable.
35.2 EkkoU encourages Users to contact EkkoU first so that we have an opportunity to investigate and respond to the concern.
36. Children's Privacy Requests
36.1 EkkoU will take reasonable steps to ensure that requests concerning Child Personal Information are handled with appropriate regard to:
(a) the Child's age;
(b) maturity;
(c) privacy interests;
(d) Parent or Guardian authority; and
(e) Applicable Privacy Law.
36.2 EkkoU may require evidence of Parent or Guardian authority before providing or deleting information relating to a Child.
37. International Privacy Rights
37.1 Because EkkoU may be made available internationally, Users in some jurisdictions may have additional privacy rights.
37.2 Depending on Applicable Privacy Law, those rights may include:
(a) access;
(b) correction;
(c) deletion;
(d) restriction;
(e) objection;
(f) portability;
(g) withdrawal of consent; or
(h) complaint to a regulator.
37.3 EkkoU will respond to valid privacy requests in accordance with Applicable Privacy Law.
37.4 EkkoU may introduce jurisdiction-specific privacy notices where required.
38. Changes to this Privacy Policy
38.1 EkkoU may update this Privacy Policy from time to time.
38.2 Changes may be required because of:
(a) changes to EkkoU functionality;
(b) changes to technical architecture;
(c) new AI Systems;
(d) new hosting arrangements;
(e) changes to Applicable Privacy Law;
(f) introduction of new products; or
(g) changes to data-handling practices.
38.3 Where a change materially affects how Personal Information is handled, EkkoU will provide notice or obtain additional consent where required by Applicable Privacy Law.
38.4 EkkoU will not rely solely on a general right to update this Privacy Policy where Applicable Privacy Law requires specific consent for a new use.
39. Future Products
39.1 The initial EkkoU Service does not provide separate coach, club, school or team Accounts.
39.2 If EkkoU later introduces products such as:
(a) EkkoU Coach;
(b) EkkoU Teams;
(c) EkkoU Clubs; or
(d) EkkoU Schools,
those products may involve materially different information flows.
39.3 EkkoU will conduct an additional privacy assessment and update or supplement this Privacy Policy before introducing materially different organisational data-sharing arrangements.
40. Contact Details
Privacy enquiries, access requests, correction requests, deletion requests and complaints may be directed to:
[INSERT LEGAL COMPANY NAME]
Trading as EkkoU
ACN: [INSERT ACN]
Privacy Contact:
[INSERT PRIVACY CONTACT ROLE]
Email:
[INSERT PRIVACY EMAIL]
General Support:
[INSERT SUPPORT EMAIL]
Registered Office:
[INSERT REGISTERED OFFICE]
Website:
[INSERT WEBSITE]
41. Core Privacy Commitment
EkkoU's privacy model is based on the following commitments:
Your Account is private.
EkkoU does not operate public athlete profiles, social feeds or public leaderboards as part of the standard Service.
Your video remains yours.
EkkoU is designed so original athlete videos remain on the User's device rather than becoming part of a permanent EkkoU cloud video library.
We analyse movement, not identity.
EkkoU analyses body movement and positioning and does not use facial recognition to identify Users.
We do not sell athlete data.
EkkoU does not sell Personal Information, Ekko Scores or athlete performance histories to advertisers or data brokers.
We do not train general-purpose AI on identifiable athlete videos.
EkkoU's standard AI architecture is self-hosted on infrastructure controlled by EkkoU.
Users retain control.
Users and eligible Parents or Guardians may request access, correction or deletion in accordance with this Privacy Policy and Applicable Privacy Law.