foxxcyber/docsHow your data is handled
Who can see what, how health information is treated, and what is recorded.
Praevio holds training records for coaches, and medical and contact details for the people they coach. This page describes how that information is kept separated and what happens to it.
Who can see what
Coaches see only their own work — their teams, their athletes, their personal-training clients, and the programs and sessions attached to them. One coach cannot see another coach's roster, notes, or client records, even when both coach teams for the same school.
Athletes and parents see the athlete they are linked to and the team context around them: schedule, results, announcements, team chat, and their own assigned workouts. A parent can see everything about their own child and nothing about anyone else's. Coach-private notes are never shown in the portal.
Organizations see program-level rollups only — team names, coaches, roster sizes, waiver coverage, and upcoming event counts. Not athlete records, not medical intake, not a coach's notes or clients. See The organization workspace.
Platform administrators at Foxx Cyber have a support path that can open an account to diagnose a problem. It is deliberately constrained: while an administrator is viewing an account as someone else, a banner names both the account being viewed and the administrator doing it, and every change made during that session is recorded against the real administrator — not the account they are viewing. Starting and ending that access is itself recorded.
Health information
Intake collects medical history, medications, pregnancy or postpartum status, physician restrictions, injuries, and chronic pain, and measurements track body composition over time. That is consumer health data, and it is treated as such.
- Consent is separate and specific. The client agrees to their coach's waiver and, as a distinct second checkbox, consents to Praevio processing their health data. The two are never bundled, because a bundled consent is not a meaningful one.
- Consent is versioned. The version agreed to is recorded with the response, so what someone consented to, and when, is always answerable.
- Every medical field is optional. A client can leave anything blank.
- It can be cleared. A coach can request a re-take, which permanently deletes the existing response before the client fills a new one in. See Client intake.
Signed waivers
Every signature keeps a verbatim copy of the document text as it stood when it was signed, along with the signer, their relationship to the participant, and the date. Editing or republishing a document never rewrites an existing signature — a newer version is simply marked as superseding it going forward.
Email and notifications
Praevio sends transactional email: verification and password reset, account invitations, portal sign-in links, event notifications, announcements, and waiver reminders. Portal push notifications carry event reminder text only — no medical information and no personal detail beyond the event itself. Notifications are opt-in per device and can be turned off at any time.
Account security
Coach and client accounts use passwords, with optional two-factor authentication through an authenticator app — see Profile & security. Portal access uses single-use, short-lived email links rather than passwords, so there is no shared family credential to leak. Rotating a team's join code invalidates the old one immediately.
The public documents
Three documents on the Praevio site set out the formal position, all maintained together so they cannot contradict each other:
- Terms of Service at
/terms - Privacy Policy at
/privacy - Consumer Health Data Privacy Policy at
/health-data-privacy— kept as a separate, distinctly labelled document rather than folded into the Privacy Policy, and linked from the health-data consent during intake.
Praevio is a product of Foxx Cyber LLC. Privacy questions and data requests
go to support@foxxcyber.com.