Coram Privacy Policy

Version: October 15, 2026. Effective only when published by Coram.

Coram LLC, an Ohio limited liability company ("Coram," "we," "us"), provides sports-performance software for organizations and their staff. This policy describes information handling on coramperformance.com, app.coramperformance.com and in our related business communications.

For athlete and workspace information supplied by a customer organization, Coram processes information on the organization's behalf and according to the agreed service instructions. The organization is responsible for its purposes, disclosure authority and required notices, while Coram retains obligations applicable to its own processing. For our website, marketing, prospective-customer relationships and independent business administration, Coram determines the relevant purposes of processing. The legal labels for these roles depend on applicable law. This policy does not replace an applicable signed customer agreement or data-processing addendum.

Information we handle

Staff and organization information. We handle staff names, email addresses, authentication information, invitations, organization/team information, preferences and account/commercial status. Supabase Auth provides authentication. Coram application code does not retain plaintext passwords in the application database.

Athlete and workspace information. Organizations and their staff supply information through manual entry, spreadsheet uploads and supported integrations. This may include athlete names, team/group membership, optional date of birth, height, weight, testing and force-plate results, workload/GPS and training measurements, source identifiers, metric targets, coach notes, reports, goals and action items. Notes and generic metrics may contain health-related information if staff enter it. Customers should provide only information appropriate and necessary for their authorized use of Coram.

Spreadsheet imports support CSV, TSV and XLSX files. Files are read in your browser; imported athlete and metric values, including source cell text, and associated filename, sheet, mapping and import-history information can remain as workspace records. Coram does not store the original spreadsheet file as a server-side file.

Integration information. When an organization connects VALD, we process organization-provided connection credentials and retrieve authorized athlete/profile/testing information. Organization Owners manage this connection. Disconnecting removes the saved connection credentials but does not itself delete previously imported performance information.

Calculated information. Coram calculates information from supplied measurements and settings, such as age from date of birth, targets/context, percentiles or cohort comparisons, workload ratios and attention indicators. Information linked to an athlete remains athlete information even when calculated. These outputs are subject to source-data quality, calculation methods and user judgment.

Business communications. We handle prospect/customer contact details, demo scheduling information, correspondence, support inquiries and commercial records. Internal Gmail/Google Sheets workflows may process messages, send/reply/opt-out status, message and thread identifiers, timestamps and derived CRM classifications. These workflows are separate from the athlete-performance database.

Website and technical information. Hosting and authentication providers may process IP addresses, browser/device information, request and security information and website activity. Our public marketing website previously used Meta Pixel to measure page views, video engagement and calls to action. Meta Pixel is currently paused. We continue to store allowlisted campaign attribution in browser session storage. Details appear below.

Payment information. The current customer application does not collect full payment-card numbers. We handle subscription status, agreed pricing and payment/purchasing correspondence. Any separate payment flow used for your organization will identify the relevant payment provider and its information handling.

Why we use information

We use information to provide and administer workspaces, authenticate staff, import and organize information, calculate/display results, produce reports, manage authorized integrations, support customers, protect and troubleshoot the service, administer commercial relationships, communicate with prospects and customers, measure public-site marketing and comply with legal obligations. We use identifiable athlete information for the customer's service and authorized support, rather than to target advertising at athletes.

This policy does not grant Coram a general right to sell athlete workspace information, commercialize cross-customer benchmarks, or train external AI models on it. Any proposed additional customer-data use requires a separate appropriate agreement and legal basis. The current production customer application does not send athlete/workspace performance information to an AI model provider. Coram uses ChatGPT/OpenAI internally for business work, including workflows involving commercial prospect/correspondence context.

Who receives information

Authorized members of your organization can access its workspace according to their roles. Current roles are Owner and Coach; organization members have broad workspace access. Trusted Coram administrators and server processes can access information to operate and support the service. Organization access controls do not mean Coram can never access customer data.

We use providers including:

• Supabase: staff authentication, database hosting and credential Vault.
• Netlify: website/application hosting and server processing.
• Vercel: retained legacy hosting and internal Google-workflow configuration. Moving the customer service does not itself erase earlier information or credentials.
• VALD: the organization's connected performance-data provider, when enabled.
• Google: internal email/CRM and external demo scheduling.
• OpenAI/ChatGPT: internal business workflows involving business communications and research; not a current athlete-data integration in the customer application.
• Meta: previous marketing website measurement and advertising technology; Pixel is currently paused. Meta may retain information previously received under its own policies.

GitHub supports source-code development; the application does not intentionally route production athlete data to GitHub. Provider roles differ: a customer-selected data source or advertising partner is not necessarily a processor acting solely on our instructions.

We may disclose information when legally required, to address security/fraud or enforce lawful rights, or as part of a corporate transaction subject to applicable restrictions. Customer athlete information remains subject to applicable contracts and laws, including school-record restrictions where applicable.

Google data and internal business workflows. Coram maintains existing Google authorizations and internal email/CRM records for its business work. The authorization covers Gmail read-only access, Gmail sending and Google Sheets access. The private Growth Transport is not enabled on this service, and automated sending through it remains off. Existing Google refresh credentials remain in Coram's server configuration on Vercel pending separate migration or revocation; short-lived access credentials, when used, are handled server-side. The Google Sheets permission is broad; the internal transport is designed to restrict CRM operations to Coram's designated workbook.

Authorized workflows can process commercial messages, including reply text, and persist contact details, message/thread identifiers, timestamps, send/reply/opt-out classifications and operational records. Internal CRM records may include exact reply text. Supabase stores existing connector authorization records and transport receipts. These records can remain even while the transport is unavailable or off. Revoking the separate ChatGPT-to-Coram connector stops that connector's access; it does not itself revoke Google access or erase Gmail, CRM, transport or ChatGPT history. Contact us for a request to disconnect Google access or delete eligible downstream information. Necessary suppression and execution records may be retained to honor opt-outs and prevent duplicate actions. These systems do not currently share a single automatic deletion schedule.

Coram also uses ChatGPT-connected Google services for internal business work. The private transport is designed to return status and execution receipts, including message/thread identifiers, without returning Google tokens or raw email bodies; this does not mean other authorized business workflows never process commercial email content in ChatGPT. These operations are separate from the customer athlete-performance workspace. The current customer application does not offer customer Google OAuth or direct Google Sheets OAuth import.

Cookies, browser storage and Meta Pixel

The application uses authentication cookies to maintain and refresh staff sessions. Meta Pixel is currently paused on the public website. While enabled previously, Meta could collect browser/device/network information and site activity for measurement and advertising under its own policies. Coram's explicit event payloads used marketing metadata, including CTA location, media name and limited campaign attribution, without intentionally attaching athlete records, raw performance values or authenticated user IDs. This did not limit information Meta collected independently through its technology. Newly loaded current pages do not initialize Pixel; previously open pages may retain older code until closed or reloaded. The pause does not erase previously received information or cookies already on a visitor's device. See Meta's Privacy Policy.

The application also keeps a workspace recovery copy in browser local storage. It can include athlete identifiers, DOB, measurements, observations and other workspace information. Coram application code does not separately encrypt this copy, and the current implementation has no time-based expiration. Deletion recognized by the application can clear a current-browser copy, but an offline or dormant device can retain a copy until the application or browser clears it. Signing out alone does not clear all browser recovery copies. Use devices with appropriate access protection; clearing site storage may remove local copies and sign you out.

Browser settings can limit cookies and clear local/session storage, but may affect sign-in or recovery. The public marketing pages offer a Privacy choices control with equally available Accept marketing and Reject marketing choices. Optional Meta tracking stays off unless you affirmatively accept and stays off when your browser sends a Global Privacy Control or Do Not Track signal. Browsing or closing the choice does not count as acceptance. A preference is remembered for that browser and site; clearing storage or using another browser may require a new choice. With Pixel paused, accepting marketing does not activate Meta tracking. You can reopen Privacy choices to change or withdraw your preference. Withdrawal stops future optional collection when available; it does not erase information already received by Meta. Contact us about other applicable privacy choices.

Minors and school information

Coram's current accounts are intended for authorized organizational staff, not athlete self-registration. Athlete records supplied by organizations may concern minors, including high-school students. We do not currently offer athlete accounts or a parent-consent workflow. Organizations must establish their authority to disclose and use athlete information, provide appropriate notices and obtain required consents or other authorization. Where a school supplies protected education records, applicable school terms govern Coram's authorized processing. A parent's or athlete's acknowledgment of this policy is not a substitute for a required school agreement or consent.

Contact us if you believe a child has directly provided information through a staff account or website interaction, or if athlete information has been supplied without authority. We will evaluate the circumstances with the organization and take action required by applicable law.

Security

Coram uses HTTPS for the hosted service and Supabase APIs. Customer workspace access uses organization-scoped controls and Supabase Row Level Security. Supabase reports encryption at rest for its database/backups. Organization VALD credentials are stored through Supabase Vault and are not exposed to ordinary authenticated browser roles. Browser recovery storage has the separate limitations described above. No security measure guarantees complete security.

Retention and deletion

We keep information for the applicable service or business purpose and legal/security needs. Actual periods vary by information category and provider; we have not adopted a single uniform retention period for every system. An inactive athlete remains stored unless deleted. Imported VALD information remains after disconnection. Imported spreadsheet values remain as workspace information.

An Owner can request organization deletion through the application, subject to current commercial restrictions; where that path is unavailable, or a legal right requires other action, contact us. Active organization records are generally removed through database deletion/cascades. Limited deletion tombstones, appropriate business/legal records, provider backups, logs and browser copies may remain. Deletion from the active database is not immediate permanent erasure from every device and backup. We will evaluate required deletion and any permitted retention independently of amounts owed.

The application does not currently offer self-service authentication-account deletion or a complete workspace export. Contact us for requests involving these records. Reports can be printed/saved as PDFs; this is not a complete raw-data export.

Requests and choices

Depending on location and circumstances, you may have rights to access, correct, delete or receive information and to object to or restrict particular uses, including certain advertising disclosures. Contact coramperformance@gmail.com. We may verify identity and authority without requesting more information than necessary. For athlete information controlled by an organization, ordinarily contact that organization first; we assist it with authorized requests. You may also contact us directly, and we will handle the request according to our role and applicable law. We will not deny a legally available request merely because you did not use the organization first. Applicable exceptions and verification requirements may apply.

To stop marketing emails, use the message's opt-out method or contact us. Necessary account/service communications may continue. We may keep minimal suppression information to honor your choice.

If we deny a request, you may ask us to review that decision by replying to our response with the reasons for your request. We will follow any appeal procedure or additional request method required by applicable law. You may contact the relevant regulator where a right to complain applies.

Location and external services

Coram operates from the United States. Information may be handled where our providers and personnel operate. Our providers may use infrastructure and personnel in other countries. We do not promise that all information remains in a particular country. External booking/provider websites have their own privacy practices. Do not upload data subject to a specific localization/transfer requirement until Coram and your organization agree on appropriate arrangements.

Changes and contact

We will identify updates through the effective date and provide additional notice or obtain authorization when required. A policy update does not by itself authorize a new use of customer athlete information inconsistent with an applicable agreement or law.

Coram LLC, Ohio, United States • coramperformance@gmail.com