Privacy Policy

At Decision Athlete, privacy is not an administrative detail. It is part of the relationship.

The work involves information that is personal in the most literal sense: your health, physiology, cognition, behaviour and the circumstances in which you operate. For someone carrying significant responsibility in a business, there may also be a legitimate concern about who could see that information, how it might be interpreted, and what might happen if it reached the wrong person.

We take those concerns seriously. This policy explains what information we collect, why we use it, and how we approach its protection.

1. Who we are

Decision Athlete is a private clinical performance practice founded by Dermot Rock.

For the purposes of applicable data protection law, the organisation responsible for deciding how and why your personal information is processed is the data controller.

Data controller: Supple Beast Ltd
Contact: privacy@decisionathlete.com
Address: 9 Orchard Grove, Elphin, Co. Roscommon, F45 V250, Ireland

You can use these contact details to ask questions about this policy or exercise your data protection rights.

2. The information we collect

The information we collect depends on how you interact with Decision Athlete.

If you visit the website

We may collect information such as your IP address, browser and device details, pages visited, referral source and interactions with the website. This may involve cookies or similar technologies, depending on the services in use and your privacy choices.

If you enquire about the practice, request access to the book, or subscribe to receive writing, we may collect your name, email address and any information you choose to provide.

Providing an email address to access a publication does not, by itself, mean you have agreed to receive marketing communications.

If you undertake the Decision Athlete engagement

The engagement may involve the collection and interpretation of information relating to:

• Health history and relevant clinical information.
• Blood tests, laboratory results and other clinical measurements.
• Genetic testing and relevant genetic information.
• Cognitive assessment results.
• Sleep, activity, cardiovascular measures and other wearable data.
• Body composition, blood pressure and other physiological measurements.
• Relevant behavioural patterns, routines and lifestyle information.
• Consultations, progress reports, interventions and observations made during the engagement.

We may also process practical information needed to administer the relationship, such as contact details, appointments, correspondence, invoices and payment records.

Not every client will provide every category of information. The information collected will depend on the agreed scope of the engagement and the assessments undertaken.

Health and genetic information is particularly sensitive. We treat it accordingly and process it only where an appropriate legal basis and the necessary conditions under data protection law are satisfied.

3. Why we use your information

The purpose of collecting information is to deliver the service you have engaged us to provide, understand your individual circumstances, interpret measurements in context, monitor changes over time and inform appropriate interventions.

Depending on the information concerned, we may use it to:

• Establish your baseline physiological and cognitive profile.
• Interpret clinical measurements and assessment results.
• Monitor changes and trends during the engagement.
• Prepare reports and support clinical consultations.
• Plan, review and refine agreed behavioural interventions.
• Communicate with you and coordinate the practical delivery of the service.
• Meet legal, professional, accounting and regulatory obligations.
• Maintain the security and proper operation of our website and systems.

We may also use website interaction data to understand which material is useful to readers and to improve the website. Where we use analytics or marketing tools, their operation should be consistent with applicable data protection and electronic privacy requirements.

We do not treat the fact that information is available as a reason to use it. Its use must have a defined purpose.

4. Your professional life remains yours

Decision Athlete works with people whose professional responsibilities can make privacy especially important.

Your participation in the practice should not become information for your board, investors, employees, co-founders, business partners or the wider public.

We do not intend to share your individual health or cognitive information with your employer, board, investors, colleagues or business partners for the purpose of evaluating your professional competence or performance. We will not disclose such information to these parties simply because they are interested in your participation or are connected to your business.

We will not use your participation as a marketing endorsement, publish your name as a client, or disclose identifiable details of your engagement as a case study without your separate agreement.

Information may need to be disclosed where you have specifically authorised it, where it is necessary to deliver an agreed service with appropriate safeguards, or where disclosure is required or permitted by law. We will consider the circumstances and the minimum information necessary before making a disclosure.

The same principle applies to the existence of the relationship itself. We recognise that you may prefer not to have your participation publicly associated with you.

5. Who can access your information?

The aim is to keep access limited to the people and services that genuinely need it.

Dermot Rock is the primary point of contact for the engagement and is responsible for bringing together the relevant information and interpreting it in context.

Some aspects of the service may require other parties, such as laboratories, testing providers, technology platforms or appropriately qualified professionals. Website hosting, secure communications, scheduling, payment processing and email delivery may also involve external service providers.

Where these parties process personal information on our behalf, we should use appropriate contractual, confidentiality and security arrangements. They should receive only the information needed for their role and should not be free to use it for unrelated purposes.

We will not give an assistant, colleague, family member or other third party access to your clinical information merely because they help manage your schedule or professional life. If you want someone to assist with practical coordination, we can agree what information they may receive and what must remain between you and the clinician.

We will not disclose information to an insurer, employer, investor or other external party simply because they request it. Any proposed disclosure must have an appropriate legal basis.

6. Data security and confidentiality

No responsible organisation can promise that information held electronically is immune from every possible security incident. What matters is how information is handled, what safeguards are in place and how risks are managed.

Decision Athlete aims to use appropriate technical and organisational safeguards to protect personal information against unauthorised access, disclosure, alteration, loss or destruction. These safeguards should reflect the sensitivity of the information and the risks associated with processing it.

Access should be restricted, systems and service providers should be selected with care, and information should be transmitted and stored using appropriate protections.

If a personal data breach occurs, we will assess it and take the steps required by applicable law, including notification where legally required.

We will not ask you to accept unnecessary exposure as the price of participating in the engagement. If a particular platform, device or communication method raises a reasonable concern, we are willing to discuss alternatives.

7. Flexibility around your privacy requirements

A standard privacy policy cannot anticipate every professional circumstance.

You may have a public profile, operate in a sensitive industry, be involved in confidential transactions, or simply prefer to keep your health and performance information entirely separate from your working life. You may also have concerns about the devices, applications or communication channels through which information is collected or shared.

We are willing to discuss these concerns with you before the engagement begins and, where practical and lawful, adapt the arrangements accordingly.

That could include agreeing:

• Which communication channels we use for clinical and administrative matters.
• Whether an assistant may coordinate appointments, and precisely what information they can access.
• How reports are delivered and who is authorised to receive them.
• Which connected devices, applications or data-sharing arrangements are necessary and which can be avoided.
• How information is shared with external clinicians or other professionals involved in your care.
• What information is appropriate to retain, and for how long, subject to clinical, legal and professional obligations.

We will not assume that convenience takes precedence over confidentiality. Equally, we will be clear when a particular request cannot be accommodated because of clinical requirements, security limitations or legal obligations.

These arrangements should be agreed explicitly rather than left to assumption. If privacy is a concern, raise it with us before sharing sensitive information. We would rather discuss it properly than ask you to proceed with unresolved reservations.

8. We do not sell your personal information

We do not sell your personal information or offer your health, genetic or cognitive data to advertisers, investors or commercial data brokers.

We do not intend to use individual clinical data to create promotional material or to endorse a third-party product.

Some service providers may process information on our behalf to operate the website, communicate with readers or deliver the engagement. This is different from selling personal information, but it still requires appropriate oversight and safeguards.

We will not use identifiable client information for research, publication or promotional purposes without an appropriate legal basis and, where required, your explicit consent. If we undertake research or use data beyond the original purposes of the service, we will assess the applicable requirements before doing so.

9. Cookies, analytics and website activity

Our website may use essential technologies to make pages function, maintain security and provide requested services. It may also use analytics or other optional technologies to understand how visitors use the website.

Where consent is required, non-essential cookies or similar technologies should not be activated before the relevant consent is obtained.

If the website uses visitor identification, lead-scoring or marketing analytics tools, those tools may process information such as page visits, referral information, device details or inferred interest in particular content. We will assess the information collected, the purposes of processing, any profiling involved and the applicable consent requirements.

We do not regard a visitor’s interest in Decision Athlete as evidence of a medical condition, nor should website activity be used to infer sensitive health information without an appropriate legal basis.

You can contact us if you want to understand which technologies are active on the website and how to manage your choices.

10. The book and email communications

If you provide your email address to read Decision Athlete: The Last Unaudited Asset, we may use that address to provide access to the book, send a return link and maintain the service associated with your request.

Access to the book should not automatically enrol you in a marketing newsletter. If you choose to subscribe to future writing, that preference should be recorded separately, and you can unsubscribe at any time.

We may use an external email or publication platform to deliver these communications. Such a provider may process your email address and relevant delivery information to provide the service.

We aim to keep these communications useful and proportionate. Receiving a book or subscribing to writing should not result in unrelated marketing or the sharing of your details with third parties for their own promotional purposes.

11. Where information is stored and processed

Decision Athlete may use service providers located in Ireland, elsewhere in the European Economic Area, the United States or other jurisdictions, depending on the systems required to deliver the service.

Where personal information is transferred outside the European Economic Area, we will ensure that an appropriate transfer mechanism and safeguards are in place where required by law.

Because health and genetic information is especially sensitive, the location of data storage, the access available to service providers and the terms under which they process information are important considerations. We will assess these arrangements rather than assume that every technology provider offers the same protections.

You may ask us which relevant service providers process your information and whether international transfers are involved.

12. How long we keep information

We keep personal information only for as long as it is needed for the purposes for which it was collected, taking account of the nature of the information, the service provided, applicable clinical and professional obligations, legal requirements and the need to resolve potential disputes.

Clinical records and test results may need to be retained for longer than routine website enquiries or mailing-list records. We will not assume that all information can be deleted immediately when an engagement ends, but neither should information be retained indefinitely without a reason.

When information is no longer required, it should be securely deleted or irreversibly anonymised where appropriate.

If you want to understand how long a particular category of information is retained, you can ask us.

13. Your rights

Depending on the circumstances and applicable law, you may have the right to:

• Request access to your personal information.
• Ask us to correct inaccurate or incomplete information.
• Request erasure of information where the legal conditions for erasure are met.
• Ask us to restrict certain processing.
• Object to processing carried out on particular legal grounds.
• Request a portable copy of certain information.
• Withdraw consent where processing is based on consent.
• Complain to the relevant data protection supervisory authority.

These rights are not absolute in every circumstance. For example, legal, clinical or professional obligations may require certain records to be retained, even where you request deletion.

To exercise a right or ask a question, contact us using the details at the beginning of this policy. We may need to verify your identity before responding, particularly where sensitive clinical information is involved.

If you are unhappy with how your information is handled, you can raise the matter with us directly. You also have the right to complain to the Data Protection Commission in Ireland or the relevant supervisory authority in your jurisdiction.

14. Changes to this policy

This policy may change as the practice, its services and its technology develop. If a change materially affects how we use personal information, we will take appropriate steps to explain the change and obtain consent where required.

The version published on this website should identify when it was last updated.

A final word

The purpose of Decision Athlete is to understand the individual more completely, not to make that individual more exposed.

The information involved in this work can be revealing. It deserves careful interpretation, restricted access and a clear purpose. It should not become a source of professional vulnerability or a commodity to be traded.

Privacy concerns are not an inconvenience to be brushed aside. If there is something about the way we collect, access, communicate or store information that gives you pause, tell us. We will discuss the concern openly and work with you to find an appropriate arrangement wherever we can.

Your health information is yours. The responsibility we accept in working with it should be treated accordingly.