HIPAA Compliance Notice

    Overview

    Elite Coaching Hub implements technical safeguards aligned with the HIPAA Security Rule to protect Protected Health Information (PHI) handled within the platform. This notice describes those safeguards and the boundaries of our compliance posture.

    Technical Safeguards

    • Access Controls: Role-based access control (RBAC) and row-level security (RLS) policies ensure that only authorised users can access PHI.
    • Automatic Session Timeout: User sessions are automatically terminated after 15 minutes of inactivity to prevent unauthorised access.
    • Audit Logging: All access to, creation, modification, and deletion of PHI (including SOAP notes, treatment logs, clinical letters, and injury cases) is logged with user identity and timestamps.
    • Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2+.
    • Authentication: Secure email/password authentication with password hashing and optional multi-factor authentication.
    • Unique User Identification: Every user has a unique identifier that is recorded in all audit trails.

    Administrative Safeguards

    While we implement robust technical controls, full HIPAA compliance also requires administrative and physical safeguards that depend on your organisation's policies:

    • Business Associate Agreement (BAA): If you are a HIPAA-covered entity, a BAA must be executed between your organisation and our infrastructure providers before PHI is stored on the platform.
    • Workforce Training: Your staff should be trained on HIPAA requirements and proper use of the platform.
    • Incident Response: Your organisation should have procedures for reporting and responding to potential data breaches.

    Scope & Limitations

    Elite Coaching Hub is designed primarily for coaching professionals. The platform is not itself a HIPAA-covered entity. However, when used by healthcare providers or entities that handle PHI, these technical safeguards support your compliance obligations.

    If you require a signed BAA for your use case, please contact us at support@elitecoachinghub.com.

    Data Retention

    PHI audit logs are retained indefinitely for compliance purposes. Athlete health data is retained for the duration of the coaching relationship and may be deleted upon request, subject to applicable legal requirements.

    Last updated: March 2026