1. Who we are
Bridgetx is a sports nutrition and performance intelligence platform operated by The Bridge High Performance Ltd, a company registered in England and Wales under company number 17181851, with its registered office at 124 City Road, London, EC1V 2NX, United Kingdom.
In this policy, “we”, “us” and “Bridgetx” mean The Bridge High Performance Ltd. For anything to do with privacy or your data, contact us at admin@bridgetx.co.
2. Who this policy covers
This policy applies to four groups of people:
- Athletes whose data is held in Bridgetx — whether added by a club, working with an independent practitioner, or signed up directly.
- Club staff and practitioners — managers, coaches, nutritionists, physiotherapists and doctors who use the platform.
- Prospective customers who fill in our “Book a Meeting” form.
- Visitors to bridgetx.co.
Where an athlete belongs to a club, the club decides what data is collected about that athlete and who at the club can see it. In data protection terms the club is generally the controller and Bridgetx acts as a processor on its instructions. If you are a club athlete and you want data corrected or removed, your club is usually the right first contact — but you can always come to us at admin@bridgetx.co and we will help.
3. What we collect
Athletes
Bridgetx is a clinical performance tool, so the athlete record is detailed. Depending on what a club or practitioner chooses to record, it can include:
- Identity and profile — name, athlete code, country, date of birth, gender, sport, position, tier, and a profile photo.
- Ethnicity — recorded because it can affect nutrition and supplement guidance. This is sensitive data and we treat it as such; see section 5.
- Health and clinical information — medical conditions (for example asthma, diabetes, cardiac conditions, anaemia, coeliac disease, epilepsy, sickle cell, a history of disordered eating), allergies, intolerances, and dietary or religious dietary preference.
- Injury records — injury type, clinical description, status, return-to-play phase and target return date.
- Body composition and physiology — height, weight, body fat percentage, lean and muscle mass, visceral fat, and estimated BMR/TDEE, recorded through assessments such as Tanita, InBody, DEXA or skinfold.
- Menstrual and iron status, including cycle length, period duration and the start date of the last period, for female athletes.
- Training and performance data — session distance, speed, sprint and acceleration counts, player load and session duration; and force-plate test results such as counter-movement jump and asymmetry percentages.
- Daily check-ins — self-reported nutrition, hydration, energy and sleep ratings, supplements taken, and free-text notes.
- Supplement prescriptions — what was prescribed, the dose, the timing and the dates it applied.
- Practitioner notes and comments about the athlete, including private staff notes.
- Messages exchanged between athletes and practitioners inside the platform.
- Reports generated about the athlete, stored as PDFs.
- Relationship history — which club, team and practitioner the athlete has been under, and when.
We do not collect identity documents such as passports or national ID. We do notcollect geographic location. Our “GPS” data is athletic performance telemetry from training sessions — distance, velocity, player load — and does not record where an athlete is or has been. We do not use advertising trackers, analytics pixels, or any third-party behavioural tracking on this site.
Club staff and practitioners
Name, email address, role, professional specialty and department, a display title, an optional avatar, and a record of which club or team you last opened so that signing in returns you to where you work.
Prospective customers
If you use our “Book a Meeting” form we collect your name, club name, email address, phone number, role, country, sport, approximate squad size, and any meeting time you request.
Technical data
Our hosting and infrastructure providers process standard technical information needed to serve the site securely, such as IP address, browser type and request logs. We do not combine this with athlete records to profile anyone.
4. Where athlete data comes from
Most athlete data is not entered by the athlete. Club staff and practitioners create athlete records and enter assessments, injuries, performance data and prescriptions. Athletes typically enter their own daily check-ins, and in some cases a practitioner enters those on their behalf.
Every data point carries a record of who provided it and whether it is club-verified, practitioner-verified or self-reported, so the origin of a figure is always traceable.
5. Why we process it, and our legal basis
| What we do | Why | Legal basis (UK GDPR) |
|---|---|---|
| Run athlete profiles, assessments and reporting | To deliver the platform the club or practitioner has contracted for | Contract; legitimate interests |
| Process health data — conditions, allergies, injuries, body composition, menstrual and iron status | To give safe, individualised nutrition and supplement guidance, and to avoid prescribing something contraindicated | Explicit consent, and/or Article 9(2)(h) health-care purposes — to be confirmed on review |
| Process ethnicity | Certain nutrition and supplement guidance (for example vitamin D) varies by ethnicity | Explicit consent — see the note below |
| Generate AI reports | To produce nutrition, body-composition, compliance and injury reports | Contract; legitimate interests |
| Send transactional email | Activation links, report-shared notifications, compliance alerts | Contract; legitimate interests |
| Respond to booking enquiries | To arrange a meeting you asked for | Legitimate interests; steps prior to a contract |
| Keep the service secure | To protect accounts and data | Legitimate interests; legal obligation |
Ethnicity is a special category of personal data requiring its own legal basis, over and above ordinary health data. Our internal documentation has flagged this field as needing legal sign-off before it drives supplement dosing for real athletes, and that sign-off has not yet happened.Ethnicity is optional — the field includes a “Prefer not to say” option — and if you would like it removed from your record, email admin@bridgetx.co and we will remove it.
6. AI-generated reports
Bridgetx uses Anthropic’s Claude APIto draft nutrition, body-composition, compliance and injury reports. When a practitioner generates a report, we send that athlete’s relevant record to Anthropic for processing. That can include their name, date of birth, gender, ethnicity, sport and position, dietary preference, medical conditions, allergies and intolerances, body-composition assessments, training and performance data, injury records including the clinical description, daily check-ins, and practitioner comments.
We use Anthropic’s commercial API. Anthropic acts as our processor and, under its commercial terms, does not use data submitted through the API to train its models.
Reports are generated by a language model and are intended to be reviewed by a qualified practitioner before being acted on. They are not medical advice, not a diagnosis, and not a substitute for professional clinical judgement. See our Terms of Service.
7. Who we share data with
We do not sell personal data, and we do not share it for advertising. We share it with the following service providers, who process it on our instructions:
| Provider | What it does | What it receives |
|---|---|---|
| Supabase | Database, authentication and file storage — the core of the platform | All platform data, including athlete health records, report PDFs and profile photos |
| Vercel | Website and application hosting | Technical request data; application traffic |
| Anthropic | AI report generation (Claude API) | The athlete record sent for a given report — see section 6 |
| Resend | Transactional email delivery | Recipient name and email address, and the content of the notification (for example athlete name, club and team, report type) |
| Fontshare (Indian Type Foundry) | Serves one of our brand fonts to your browser | Your IP address and browser details, when you load a page |
Within the platform, athlete data is visible to the staff at that athlete’s club whose role permits it, and to any independent practitioner the athlete works with. Access is enforced at the database level, not merely hidden in the interface. Some clinical detail — for example the full description of an injury — is deliberately restricted from athletes themselves and visible only to appropriate staff.
We may also disclose data if required by law, or to establish, exercise or defend legal claims.
8. Where your data is stored
We are a UK company, and many of our clients are outside the UK — the current pilot is in the United Arab Emirates. Your data therefore crosses borders.
- Our database and file storage are hosted with Supabase in Australia.
- Our hosting (Vercel), AI processing (Anthropic) and email delivery (Resend) are provided by companies based in the United States, and process data there.
Where we transfer personal data out of the UK, we rely on the safeguards our providers offer for international transfers, including the UK International Data Transfer Addendum and the EU Standard Contractual Clauses. You can ask us for details of the safeguards that apply by emailing admin@bridgetx.co.
9. Children and young athletes
Bridgetx is built for sports clubs and academies, and academy squads routinely include athletes under 18. The platform supports youth age groups, and we expect to hold data about minors.
We want to describe this plainly rather than imply protections we have not built yet.
Athlete accounts are created by club staff, not by athletes signing themselves up. Where an athlete is a minor, we currently rely on the club’s own consent and safeguarding arrangements with the athlete and their parents or guardians — the same arrangements under which the club already holds medical and performance information about that player. Bridgetx does not separately collect individual parental or guardian consent, and the platform does not currently record guardian details or enforce a minimum age at sign-up.
We have identified this as a gap. Introducing verifiable guardian consent, and reviewing whether club-mediated consent is sufficient, is an open item that we are addressing with legal advice before the platform scales beyond its current pilot.
If you are a parent or guardian of an athlete on Bridgetx and you want to know what we hold, object to it, or have it removed, email admin@bridgetx.co and we will deal with it directly.
Clubs and practitioners using Bridgetx are responsible for ensuring they have a proper basis to record a young athlete’s health information and to enter it into the platform.
10. How long we keep data
Bridgetx is deliberately built so that an athlete’s history is permanent and travels with them between clubs, practitioners and seasons. A body-composition trend or a compliance record is only meaningful over years, and an athlete who leaves a club keeps their history.
The practical consequence, stated honestly: we do not currently delete athlete data automatically, and we have no automated retention or purge schedule. Removing an athlete from a team or a club does not delete their record. Ending a club subscription does not delete anything. Records including check-ins, assessments, prescriptions and relationship history are designed never to be deleted, and report PDFs and profile photos are retained in storage.
The one thing an athlete can do themselves is delete their own account (section 11). That permanently removes their login and anonymizes their name, email and profile-photo link, but it does not delete their records. We also keep one copy of the original name and email, readable only by us as the platform operator, so the account can be restored if the athlete asks or the deletion was a mistake; that copy is removed when the account is restored. Photo files remain in private storage.
We recognise that “indefinitely” is not an adequate retention position under UK data protection law. Defining proper retention periods, and building the mechanism to enforce them, is active work. In the meantime, we will delete data on request — see section 11.
11. Your rights
If you are in the UK or the EU, you have the right to:
- ask what personal data we hold about you, and get a copy of it;
- have inaccurate data corrected;
- ask us to delete your data;
- ask us to restrict or object to how we use it;
- ask for your data in a portable format;
- withdraw consent at any time, where we rely on consent;
- complain to a data protection regulator.
People outside the UK and EU have comparable rights under their own local law — including, for our UAE clients, the UAE Personal Data Protection Law — and we will honour requests from any user on the same basis.
Email admin@bridgetx.co with what you want. We will respond within one month, as UK GDPR requires, and will tell you if we need longer for a complex request.
Deleting your account.If you are an athlete you can delete your account yourself, in the app (More → Delete my account) or on the web (My Account). It takes effect immediately: your login is permanently removed, so you cannot sign in, reset your password or use a sign-in link; and your name, email address and profile-photo link are anonymized, with your name shown as “Deleted Athlete”.
What deleting your account does not do.It does not erase your records. Your check-ins, assessments, reports and other history stay with your club and practitioners as part of their professional records, attributed to “Deleted Athlete”. We also retain one copy of your original name and email, kept apart from those records and readable only by us as the platform operator, solely so your account can be restored. You can ask us to erase that copy, and the records, by emailing admin@bridgetx.co; we will consider it as described below.
Being transparent about the rest: Bridgetx does not currently offer a self-service way to download your data from within the app, and deleting your account is not the same as erasing your data. Requests to download or erase data are handled manually by our team. This is a limitation of the product today, not a reason for us to decline a request.
If you are a club athlete, we may need to consult your club before deleting records the club holds as controller — for example where it has its own medical-record retention obligations. We will tell you if that applies.
12. How we protect data
- Access control at the database level. Every table enforces row-level security, so who can see which athlete is decided by the database itself, not by the user interface. Hiding a button is not our security model.
- Private file storage. Report PDFs, profile photos and club branding are held in private buckets and served only through short-lived signed links.
- Structural restriction of clinical detail. Sensitive fields such as full injury descriptions are restricted through dedicated database views rather than by convention.
- Encryption in transit across the platform, and encryption at rest by our infrastructure providers.
- Scoped credentials. Keys for AI, email and privileged database access are held server-side and are never exposed to the browser.
No system is perfectly secure. If you believe your account or data has been compromised, contact admin@bridgetx.co immediately.
13. Cookies
We use cookies only to keep you signed in and to keep your session secure. We do not use advertising cookies, analytics cookies, or third-party tracking of any kind, which is why you are not seeing a cookie consent banner. The one third party your browser contacts when loading our pages is our font provider, listed in section 7.
14. Changes to this policy
We will update this policy as the platform changes — in particular when we introduce a defined retention schedule, self-service data access and deletion, and a settled approach to guardian consent. The date at the top of this page shows when it was last revised. Where a change materially affects you, we will tell the clubs and users concerned.
15. Contact and complaints
For any privacy question or request, contact admin@bridgetx.co, or write to The Bridge High Performance Ltd, 124 City Road, London, EC1V 2NX, United Kingdom.
If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk, or to the data protection authority in your own country. We would rather you raised it with us first so we can put it right.