SportsX Academy — Privacy Policy
Version: 1.1 Effective Date: [INSERT EFFECTIVE DATE] Last Updated: 2026-05-03 Jurisdiction: Province of Ontario, Canada (Phase 1) Operator: Next Play AI Inc. (“Next Play AI,” “we,” “us,” “our”) Privacy Officer: privacy@nextplayai.xyz
PLAIN-LANGUAGE SUMMARY — PLEASE READ
What this policy covers. It explains how Next Play AI collects, uses, shares, stores, and protects your personal information when you visit our website, create an account, use the SportsX Academy service, or sign documents through our service.
Three relationships. Your relationship with us depends on the role you are in:
Club operator, administrator, or staff member — we are directly responsible for your personal information.
Member, parent, or guardian using the service through a Club’s invitation — the Club is the organization responsible for your information held in connection with that Club’s programs; we process it on the Club’s behalf.
Member or parent / guardian holding a SportsX Member Account — we are directly responsible for the information you provide to your Member Account (your contact details, household and child profiles, summaries of documents you have signed, summaries of your participation and payments, and your consent preferences). This information is held under separate Member Account Terms and stays with us if any Club stops using the service.
Where your data is stored. Primarily in Canada (Amazon Web Services, Montréal). Some processing occurs in the United States (AI inference, error monitoring, edge security). The full list is in .
Your rights under PIPEDA and PHIPA. You have the right to know what personal information we have, ask us to correct it, withdraw consent, request deletion, and complain to a regulator. See .
Children. If you are under 18, a parent or guardian must consent before any personal information is submitted. See .
Health information. If you have a concussion history, allergy, or medical condition recorded through our service, that information is treated as Personal Health Information under Ontario’s PHIPA. See .
Questions. Email our Privacy Officer at privacy@nextplayai.xyz.
Complaints. You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, for health-information matters, the Information and Privacy Commissioner of Ontario (ipc.on.ca).
SECTION 1 — WHO WE ARE
Next Play AI Inc. is a Canadian corporation headquartered in Oakville, Ontario, Canada. We operate the SportsX Academy software-as-a-service platform (the “Service”), which is used by Ontario youth sports clubs to manage member registration, intake of consents and signed documents, scheduling, attendance, payments, and communications.
This Privacy Policy applies to:
our public website at [INSERT URL] and any sub-domains;
the SportsX Academy web application;
any mobile application we publish;
any account-creation, registration, and signing flow we operate;
any communication you send us by email, contact form, or phone.
This Privacy Policy does not apply to:
websites or services operated by Clubs themselves (those are governed by the Club’s own privacy policy);
third-party websites or services we link to;
any data you provide directly to a Club outside our Service.
SECTION 2 — THREE ROLES, THREE LEVELS OF RESPONSIBILITY
Under Canadian privacy law, an organization that decides why and how personal information is collected is the “controller” (PIPEDA) or “health information custodian” (PHIPA, where personal health information is involved). An organization that handles personal information on behalf of another organization is a “processor” (PIPEDA) or “agent” (PHIPA).
Our role depends on which of three relationships you are in. Many Members will be in two of these relationships at once — one with their Club (because they participate in Club programs) and one directly with us (because they hold a SportsX Member Account). The two relationships are separate and complementary.
2.1 You are a Club Operator, Administrator, or Authorized User
If you operate a Club, administer a Club account, or are a staff member with login credentials (“Authorized User”), we are the controller of the personal information you provide to us directly to create and manage your relationship with us. This includes your contact information, billing information, account credentials, and the records of how you use the Service.
In this role, we make the decisions about how your personal information is used, and we have direct accountability to you under PIPEDA.
2.2 You are a Member, Parent, or Guardian — data collected through a Club
If you are an athlete, learner, parent, or guardian using the Service because a Club invited you to (“Member”), and you are providing information to the Club through the Service (for example, completing the Club’s intake forms, signing the Club’s PDSA / Liability Waiver / Parental Indemnity / Rowan’s Law documents, providing health information for safe sport participation), the Club is the controller of that information, and we are the processor acting on the Club’s behalf. The Club decides what information it collects, what it uses it for, and how long it keeps it. We process the information only on the Club’s instructions and as described in our Data Processing Addendum with the Club.
In this role:
The Club’s privacy policy governs how your personal information is used by the Club.
You should direct privacy requests (access, correction, deletion, withdrawal of consent) to the Club in the first instance.
If you direct a request to us instead, we will inform the Club and (with the Club’s involvement) will help facilitate it. See .
For personal health information specifically (allergies, medical conditions, concussion history, emergency-contact medical authorizations), the Club is the health information custodian under PHIPA, and we are the Club’s agent under PHIPA section 17.
2.3 You are a Member or Parent / Guardian holding a SportsX Member Account
If you create a SportsX Member Account (a platform-layer account directly with Next Play AI, governed by separate Member Account Terms), we are the controller of the information you provide to your Member Account. This information (“Member Account Data”) is held by us independently of any Club, and includes:
your identification and contact information (name, date of birth, email, phone, postal address);
your household structure and profiles you create for any minor children for whom you have legal authority;
summaries of documents you have signed through the Service in connection with any Club (the document title, version, date signed, Club it was signed for, and validity status — but not the document body text, which is held by the Club as compliance archive);
summaries of your sports participation through any Club (Club name, sport category, program duration — but not the detailed attendance records or coach evaluations, which are Club-controlled);
summaries of your payments processed through the Service (amount, date, transaction ID, program — but not detailed financial reconciliation, which is Club-controlled);
your consent preferences (marketing, photo / video, AI-training opt-in if applicable).
In this role:
We are directly responsible for Member Account Data under PIPEDA.
You can access, correct, export, or delete your Member Account Data through the Account Privacy Console at any time.
Your Member Account is independent of any Club’s relationship with us. If a Club terminates its agreement with us, your Member Account continues unaffected, and your Member Account Data continues to be held by us.
Personal Health Information is NOT held in the Member Account layer — it remains with your Club as Health Information Custodian under PHIPA. To exercise PHIPA rights, contact your Club.
Member Account Data is governed by the SportsX Member Account Terms (E1). A copy is available at sportsx.ca/legal/member-account and is provided to you at Member Account creation.
2.4 You are a Website Visitor
If you visit our public website without creating an account (for example, to read marketing material), we are the controller of any limited information collected (such as cookies, IP address, and any contact form you submit). See for cookies.
2.5 Why three roles, not one
The three-role framework reflects how SportsX is built. The Club uses our software to run its programs (Section 2.1, 2.2). You use our software, through the Club, to participate in those programs (Section 2.2). And you also use our software, directly, to maintain a portable sports-life record that travels with you across Clubs (Section 2.3). Each role has its own privacy framework and its own responsibilities.
SECTION 3 — WHAT THIS POLICY COVERS — A QUICK MAP
SECTION 4 — PERSONAL INFORMATION WE COLLECT
4.1 When you visit our public website
Technical metadata: IP address, device type, browser, operating system, referring URL, pages visited, time on page
Cookies (see )
Contact form information if you submit it (name, email, message)
4.2 When you create or use an Authorized User account (Club operator / administrator / staff)
Identity: name, role at the Club, date of birth (if required for screening)
Contact: email, phone, work address
Account credentials: hashed password, multi-factor-authentication token
Billing: payment-method tokens (we do not store full card numbers — those are tokenized through Stripe), billing history, invoices
Audit-trail metadata: IP, timestamp, device fingerprint, document version hashes for any document you sign in your role
4.3 When you are a Member (athlete / learner / parent / guardian) — collected on behalf of the Club
Identity: full legal name, preferred name, date of birth
Contact: email, phone, postal address
Family relationship (for minor Members): parent or guardian name, relationship, contact, confirmation of legal authority to consent
Personal Health Information (where the Club’s program design records it): allergies, medical conditions material to participation, current medications, concussion history, removal-from-sport / return-to-sport notations, emergency contact, emergency medical-treatment authorization
Program participation: enrolment, level, schedule, attendance, coach assignment, performance / progress notes, certifications, make-up class history
Financial: Stripe-tokenized payment-method, billing history, refund records
Documents and consents: signed PDSA / Course Contract, Liability Waiver, Parental Indemnity Agreement, Rowan’s Law Code of Conduct, Rowan’s Law Cognitive Resources Acknowledgment, PIPEDA Standalone Consent, Electronic Signature Consent, photo / video / case-study consent
Communications: transactional email and SMS, in-product chat (where the Club enables it), customer-support tickets
Audit-trail metadata: IP address, timestamp (UTC), device fingerprint, scroll-to-bottom completion timestamp (where the document type requires “reasonable steps” under the Occupiers’ Liability Act), document version hash (SHA-256), email / SMS delivery confirmation IDs, signing method
Photo and video: profile photographs, program / event photos and videos (where consent is captured separately), case-study photos and videos (subject to separate consent under any agreement between the Club and Next Play AI)
4.4 What we deliberately do not collect
We do not collect, and the Club is contractually prohibited from uploading, the following sensitive identifiers:
Social Insurance Number
Full credit-card or bank-account number outside the tokenized Stripe / payment-processor flow
Driver’s license, passport, or other government-issued identification number
Biometric data (fingerprint, facial geometry, voice print)
Sexual orientation, religion, ethnic origin, political opinion, or trade-union membership
If you discover that any of the above has been uploaded to the Service, please email privacy@nextplayai.xyz immediately.
SECTION 5 — HOW WE USE YOUR PERSONAL INFORMATION
We use personal information for the following purposes, depending on your relationship with us:
5.1 To provide the Service
Create and authenticate accounts
Process registrations, intake forms, and signed documents
Schedule programs, manage attendance, generate rosters
Route payments through Stripe Connect
Send transactional and operational communications (account verification, security alerts, document-delivery confirmations, scheduling reminders, payment receipts)
Provide customer support
5.2 To meet legal and regulatory requirements
Generate audit trails for electronically signed documents under the Electronic Commerce Act, 2000 (Ontario)
Retain signed documents and financial records for the periods required by Ontario law (see )
Cooperate with valid legal process (lawful court orders, subpoenas, regulator requests, law-enforcement requests with proper legal basis)
Operate our anti-fraud, anti-abuse, and account-security functions
5.3 To improve and protect the Service
Detect and respond to security incidents
Diagnose application errors (with limited content captured by Sentry — see )
Compile aggregated, irreversibly anonymized analytics on Service usage (no individual is identifiable; this is not personal information)
5.4 For our own communications (Authorized Users only — not Members)
Onboarding emails about your Club account
Product updates and new-feature announcements
Legal-update notices (changes in Ontario consumer or sports law)
Marketing emails (only with your express, separately captured opt-in consent under Canada’s Anti-Spam Legislation; you can withdraw consent at any time)
5.5 What we do not do
We do not sell personal information to anyone, ever.
We do not use personal information for advertising targeting.
We do not use personal information you upload as a Club to train any general-purpose machine-learning model without the Club’s prior written consent.
We do not use Member personal information for any purpose beyond the Club’s instructions and as described in our Data Processing Addendum with the Club.
5.6 Note on cross-role processing
Where information you have provided appears in more than one role (for example, your name appears in your Member Account under Section 2.3 and is also collected by your Club in connection with your enrolment under Section 2.2), each instance is processed under the framework applicable to that role and is held by the corresponding party as controller / processor. The two instances are not automatically merged or cross-referenced for any purpose other than the minimum technical operation of the Service necessary to serve your participation in the Club’s programs.
SECTION 6 — LEGAL BASIS UNDER PIPEDA SCHEDULE 1
Canadian privacy law is built around ten principles in Schedule 1 of the Personal Information Protection and Electronic Documents Act:
SECTION 7 — SHARING — SERVICE PROVIDERS AND SUBPROCESSORS
We share personal information only as described in this section.
7.1 With your Club (if you are a Member)
If you are a Member, your personal information is collected on behalf of, and shared with, the Club that invited you. The Club’s privacy policy governs what the Club does with it.
7.2 With our Service Providers (Subprocessors)
We engage the following Service Providers (“Subprocessors”) to operate the Service. Each is bound by a written agreement that imposes data-protection obligations no less protective than those required by PIPEDA and PHIPA.
Phase 1 specifically does not use general-purpose marketing or analytics services such as Google Analytics 4, Meta Pixel, TikTok Pixel, HubSpot, or Segment for Member-facing analytics. We will update this list before adding any new Subprocessor and notify Clubs in accordance with our Data Processing Addendum.
7.3 With professional advisors
We may share personal information with our legal, accounting, audit, insurance, and IT-security advisors when reasonably necessary for them to provide their services. They are bound by professional confidentiality obligations.
7.4 With regulators or law enforcement
We may disclose personal information when required to do so by valid legal process (court order, subpoena, regulator request, law-enforcement request with proper legal basis) or to protect the safety of any person. Where legally permitted, we will notify the affected individual.
7.5 In a corporate transaction
If we are involved in a merger, acquisition, financing, corporate reorganization, or sale of all or substantially all assets, personal information may be transferred to the successor entity, subject to that entity assuming this Privacy Policy and providing notice. Any such transfer will comply with PIPEDA.
7.6 With your express consent
For any disclosure not described above, we will ask for your express consent.
SECTION 8 — CROSS-BORDER PROCESSING
8.1 Where your information is processed
Our primary hosting is in Canada (Amazon Web Services Canada, Montréal region). The primary database storing personal information is in Canada.
Some of our Subprocessors process limited categories of personal information outside Canada, primarily in the United States:
Anthropic processes prompts and Template inputs (which may contain personal information) in the US
Sentry stores error logs (which may incidentally include personal information) in the US
Cloudflare processes technical metadata (IP, headers) at edge nodes globally
Stripe processes payment data primarily in Canada with parent infrastructure in the US
8.2 Comparable level of protection
Each cross-border Subprocessor is bound by a written agreement that imposes data-protection obligations no less protective than those required by PIPEDA. We rely on contractual protections (rather than government-to-government transfer mechanisms, since Canadian law does not impose them in the way GDPR does).
8.3 Foreign-government access risk
Personal information processed outside Canada may be subject to lawful access requests by foreign government authorities. We cannot prevent such access where required by foreign law. The Office of the Privacy Commissioner of Canada has issued guidance acknowledging that cross-border transfers are permitted where comparable protection is in place; we believe our practices meet that standard.
8.4 Your right to know
This Privacy Policy is the public disclosure of our cross-border processing under PIPEDA Schedule 1 Principle 8 (Openness).
8.5 Member Account Data cross-border processing
Member Account Data held under Section 2.3 is processed by Authorized Subprocessors substantially identical to the list applicable to Club-controlled processing, with the exception that Anthropic, PBC and Stripe Payments Canada, Ltd. — which process data on the Club’s behalf for AI workflows and payment processing — do not process Member Account Data. The Member Account Data Subprocessor list is maintained at the Member Account Terms (E1) Section 7.
SECTION 9 — RETENTION
We retain personal information only as long as necessary for the purposes for which it was collected, and as required by Ontario law.
9.1 During your active use of the Service
Active records are retained for the duration of your account or program participation.
9.2 After your account or program participation ends
9.3 Member Account Data retention
Information held under Section 2.3 is retained for as long as your Member Account remains active. We do not apply a fixed retention schedule to Member Account Data; you control its retention through your Member Account. If your Account is inactive for 36 consecutive months, we will send a dormancy notice and may close the Account thereafter. On Account closure, Member Account Data is deleted from production systems within 30 days, with backups overwritten in the ordinary course within a further 30 days, and a limited audit ledger entry is retained for 7 years for compliance and fraud-prevention purposes (no Member Account Data content is retained beyond closure). See Member Account Terms (E1) Article 5.
9.4 Deletion on request
You can request deletion of your personal information using the rights described in , subject to the legal-retention requirements above. We will explain which items can be deleted and which must be retained, and we will delete items as soon as the legal-retention period ends.
SECTION 10 — SECURITY
We maintain technical and organizational security measures appropriate to the sensitivity of the personal information we hold. The full description is in our Data Processing Addendum, Schedule 4. Summary:
Encryption: TLS 1.2+ in transit; AES-256 at rest for production database, object storage, and backups
Access control: role-based access, multi-factor authentication for all our personnel, principle of least privilege, just-in-time access for production with audit logging
Network and infrastructure: VPC isolation, web-application firewall, DDoS protection, intrusion-detection
Application security: secure-development-lifecycle, code review, static security analysis, dependency vulnerability scanning, parameterized queries, rate limiting on sensitive endpoints
Resilience: daily encrypted backups, point-in-time recovery, multi-AZ deployment within Canada, documented incident-response plan
Audit logging: account creation, login, permission change, document signing (with scroll completion, IP, device, hash), data export, data deletion, payment events — retained at least 2 years
Personnel: confidentiality agreements, privacy and security training annually, background checks for elevated production access (subject to provincial employment-screening law), 24-hour access revocation on departure
Incident response: documented Security Incident response plan; 24-hour notification commitment to affected Clubs
Compliance posture: SOC 2 Type II audit to be initiated within 12 months of our first paying Customer
No security system is perfect. If we discover a security incident affecting your personal information, we will follow the breach-notification process described in our Data Processing Addendum (24-hour notification to the affected Club, and the Club is responsible for notifying you and the regulator as required by PIPEDA’s Breach of Security Safeguards Regulations). For our own breach notifications (where we are the controller — for example, an Authorized User account compromise), we will notify you and the OPC as required by PIPEDA.
SECTION 11 — YOUR RIGHTS
11.1 Rights you have under PIPEDA
You have the right to:
Know what personal information we hold about you, why, and to whom we have disclosed it;
Access your personal information (PIPEDA section 8 — generally responded to within 30 days);
Correct your personal information if it is inaccurate, incomplete, or out of date;
Withdraw consent for any future processing (subject to legal or contractual restrictions, such as a signed contract that cannot be unilaterally rescinded);
Request deletion of your personal information (subject to the legal-retention exceptions in );
Lodge a complaint with our Privacy Officer or with the regulator ().
11.2 Rights you have under PHIPA (for Personal Health Information)
For Personal Health Information, you also have:
Right of access under PHIPA section 53 (generally 30 days);
Right of correction under PHIPA section 55;
Right to know who has accessed your records under PHIPA section 12 (audit log).
11.3 How to exercise your rights
If you are a Member, your Club is the controller / health information custodian. Please direct requests to your Club in the first instance. You may also email us at privacy@nextplayai.xyz; we will inform the Club and help facilitate the request.
If you are an Authorized User, you may exercise your rights through your account settings, through our Account Privacy Console, or by emailing privacy@nextplayai.xyz.
Identity verification. Before responding to a request, we may need to verify your identity (for example, by confirming login from an authenticated session, by emailing a verification code to the address on file, or by other reasonable means). This is to protect your information from unauthorized access.
No charge. PIPEDA section 8 prohibits an unreasonable charge for access. We do not charge for routine access, correction, or withdrawal-of-consent requests. If a request is unusually complex or large, we may, after consultation with you, charge a reasonable cost-recovery fee.
Our response timelines. We aim to respond to access requests within 30 days of receipt. If we need more time, we will tell you why and when you can expect our response.
If we refuse a request. We will tell you in writing the reason for the refusal, the section of PIPEDA or PHIPA we rely on, and how to complain to the regulator.
11.4 How to exercise your rights — choosing the right path
Because of the three-role framework described in Section 2, the path for exercising your rights depends on which information you are asking about:
Where a request concerns information that exists at both layers (e.g., the validity of an annual Rowan’s Law signing — full document held by the Club, summary held by us), you may direct your request to either or both organizations; we will coordinate in good faith.
SECTION 12 — COOKIES AND SIMILAR TECHNOLOGIES
Our Cookie Policy (A3) describes the cookies we use, why, and how to manage them. Phase 1 uses a deliberately minimal cookie set: strictly-necessary cookies (session, security, CSRF) and limited functional cookies (login persistence, language preference). Phase 1 does not use marketing or third-party advertising cookies (no Google Analytics 4, Meta Pixel, TikTok Pixel, HubSpot, or Segment).
If we add analytics or advertising cookies in a future Phase, we will update the Cookie Policy and obtain consent through a cookie banner that complies with PIPEDA, the IPC’s Guidance on Cookie Use, and any other applicable Ontario authority guidance.
SECTION 13 — CHILDREN AND MINORS
The Service is used by youth athletes and learners, including those under 18.
For any Member under 18, we require that a parent or guardian with legal authority to consent complete the registration, sign the PDSA / Course Contract, sign any Liability Waiver, sign the Parental Indemnity Agreement, sign the Rowan’s Law Code of Conduct (where applicable for athletes 26 and under), sign the Rowan’s Law Cognitive Resources Acknowledgment (where applicable), and sign the PIPEDA Standalone Consent.
Under PIPEDA, the OPC has indicated that children under 13 generally lack capacity to provide meaningful consent and that parental / guardian consent is required for any non-trivial use of their personal information. For children between 13 and 18, capacity is assessed based on the maturity of the child and the nature of the information. Out of caution, the Service requires parental / guardian consent for all Members under 18.
For Personal Health Information of a minor, PHIPA contains additional provisions (the “capable minor” doctrine — minors aged 12 to 15 may have capacity to consent in certain medical contexts, and minors aged 16 and over generally do). The Service treats parental / guardian consent as the default for all minors and supplements with the minor’s own assent where appropriate.
Children’s Member Accounts. A Member Account for a person under 18 is created by their Parent / Guardian under the Member Account Terms (E1). The Parent / Guardian represents that they have legal authority for the minor and manages the minor’s profile until the minor reaches the age of majority, at which point control transitions to the minor. Personal Health Information of a minor is held by the Club, not in the minor’s Member Account.
If you are a parent or guardian and believe a child’s personal information has been collected without your consent, please email privacy@nextplayai.xyz and we will investigate and, if appropriate, delete the information.
SECTION 14 — PERSONAL HEALTH INFORMATION (PHIPA)
If your Club records, through the Service, allergies, medical conditions material to participation, current medications, concussion history, removal-from-sport / return-to-sport notations, emergency contact, or emergency medical-treatment authorization, that information is Personal Health Information within the meaning of section 4 of Ontario’s Personal Health Information Protection Act, 2004 (“PHIPA”).
Roles under PHIPA:
The Club is the health information custodian (PHIPA section 3) and is directly responsible to you for the use, disclosure, and protection of your Personal Health Information.
We are the Club’s agent under PHIPA section 17 and process Personal Health Information only on the Club’s instructions, in accordance with our Data Processing Addendum.
Your PHIPA rights:
Access (section 53)
Correction (section 55)
Withdrawal of consent or imposition of conditions (section 19)
Audit log of who has accessed your records (section 12)
To exercise PHIPA rights, please contact your Club’s Privacy Contact Person in the first instance. You may also email privacy@nextplayai.xyz.
SECTION 15 — UPDATES TO THIS POLICY
We may update this Privacy Policy from time to time to reflect changes in law, our Service, or our Subprocessor list.
Material changes will be communicated by email (to Authorized Users) and by an in-product banner at next login. We will provide at least 30 days’ notice for material adverse changes.
Non-material changes (such as Subprocessor list updates that do not change the categories of personal information processed or the countries of processing) will be reflected by updating the “Last Updated” date at the top of this policy.
The current version is always available at our public website at [INSERT URL].
Last Updated: 2026-05-03
Change Log
v1.0 → v1.1 (2026-05-03) — Three-Role Framework
Coordinated change with E1 (NEW), A1 v1.2, A4 v1.2, B6 v1.1.
Plain-Language Summary — restructured “two relationships” into “three relationships.”
Section 2 — REWRITTEN. Replaces two-role framework with three-role framework adding §2.3 Member Account Data direct relationship.
Section 5 — added cross-role processing note (§5.6).
Section 8 — added Member Account Data cross-border processing disclosure (§8.5).
Section 9 — added Member Account Data retention disclosure (§9.3).
Section 11 — added dual-path rights-exercise table (§11.4).
Section 13 — added Children’s Member Accounts paragraph.
SECTION 16 — CONTACT
Privacy Officer Next Play AI Inc. Attention: Privacy Officer [INSERT FULL ADDRESS], Oakville, Ontario, Canada Email: privacy@nextplayai.xyz Legal: legal@nextplayai.xyz
We aim to respond to privacy inquiries within five (5) business days of receipt.
SECTION 17 — COMPLAINTS
If you are not satisfied with our response to a privacy inquiry or request, you may complain to the regulator with appropriate jurisdiction.
17.1 Office of the Privacy Commissioner of Canada (OPC)
For complaints under PIPEDA:
Office of the Privacy Commissioner of Canada 30 Victoria Street Gatineau, QC K1A 1H3 Toll-free: 1-800-282-1376 Website: priv.gc.ca
17.2 Information and Privacy Commissioner of Ontario (IPC)
For complaints under PHIPA (Personal Health Information):
Information and Privacy Commissioner of Ontario 2 Bloor Street East, Suite 1400 Toronto, ON M4W 1A8 Toll-free: 1-800-387-0073 Website: ipc.on.ca
You may also have remedies in the courts of Ontario; PIPEDA section 14 provides a right of application to the Federal Court following an OPC investigation in certain circumstances, and the Privacy Act and Ontario common-law privacy torts (such as intrusion upon seclusion, recognized in Jones v. Tsige, 2012 ONCA 32) may provide additional remedies.
SECTION 18 — DEFINITIONS
“Authorized User” means a person we authorize to access the Service through a Club’s account, including the Club’s operators, administrators, staff members, and front-desk personnel.
“Club” means a youth sports organization that has subscribed to the Service.
“Member” means an athlete, learner, parent, or guardian using the Service because a Club has invited them to.
“Member Account Data” means personal information held under Section 2.3 in connection with a SportsX Member Account, as further specified in the Member Account Terms (E1) and the Data Processing Addendum (A4) section 1.14.
“Personal Health Information” has the meaning given in section 4 of PHIPA.
“Personal Information” has the meaning given in PIPEDA (information about an identifiable individual).
“PHIPA” means the Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sch. A.
“PIPEDA” means the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5.
“Service” means the SportsX Academy software-as-a-service platform operated by Next Play AI Inc., including the public website, web application, mobile application (where published), and any related communications and signing flows.
“Service Providers” or “Subprocessors” has the meaning in .
ELECTRONIC ACKNOWLEDGMENT
By using the Service, by creating an account, or by signing any document through the Service, you acknowledge that you have read this Privacy Policy and understand how your personal information is collected, used, shared, stored, and protected. If you do not agree with this Privacy Policy, please do not use the Service.
Privacy Policy v1.1 — drafted 2026-05-03, subject to legal review under the Phase 1 hybrid review strategy. Phase 1 jurisdiction: Ontario only. The English text governs in all cases. French translation will be made available in a future Phase consistent with the AODA accessibility plan.