Privacy Policy

Real_AMS (리얼에이엠에스), business registration number 450-73-00645, located at 충청남도 천안시 동남구 충절로 535-31, 503호 (삼룡동) (“Real_AMS”, “we”, “us”), handles personal information in accordance with the Personal Information Protection Act (개인정보보호법, “PIPA”) of the Republic of Korea.

This Privacy Policy explains what personal information we collect through the Real_AMS website and the Real Athlete Monitoring System platform, why we collect it, how long we keep it, and the rights you have over it.

Real_AMS is built around athlete data, some of which concerns health and injury. Health information is sensitive information (민감정보) under PIPA and receives the additional protections described below.

Under Article 31 of PIPA, we designate the following Privacy Officer (개인정보 보호책임자), responsible for handling personal information and for receiving complaints and requests from data subjects:

• Privacy Officer: 권하민 (Kwon Hamin), Representative
• Email: support@realams.com
• Address: 충청남도 천안시 동남구 충절로 535-31, 503호 (삼룡동)

You may direct any question, complaint, or request relating to your personal information to the contact above. We will respond without delay.

Our responsibilities depend on whose information is involved, which also determines who you should contact:

• Entrusted processing (수탁자). For athlete and staff information that a club, federation, or other customer organisation enters into the platform, that organisation is the personal information controller (개인정보처리자). We process the information only as entrusted by that organisation under Article 26 of PIPA. Athletes should contact their organisation first.
• Controller. For information we determine the purposes of ourselves — website visitors, enquiries, and the account administrators we deal with directly — we are the controller.

Website and enquiries (as controller). Name, email address, organisation, and the content of your enquiry, plus access records automatically generated during use: IP address, browser and device type, and pages visited.

Platform accounts (as controller). Name, work email, role, organisation, and authentication and access logs for users we provision.

Athlete information (as entrusted processor). Processed on behalf of the customer organisation:

• identity and profile information — name, date of birth, squad, position, contract and eligibility details;
• performance information — training load, testing results, wellness and readiness scores, development tracking;
• health information (sensitive information / 민감정보) — injury and illness records, diagnoses, treatment and rehabilitation notes, availability status, and medical assessments;
• connected source information — records imported from wearables, GPS, testing hardware, or other systems the organisation integrates.

We do not collect resident registration numbers (주민등록번호). We do not collect personal information from users through automated collection tools other than the access records and cookies described below.

We process personal information only for the following purposes:

• providing, operating, and securing the Service, and authenticating users;
• enforcing role-based access so that medical records are visible only to authorised staff;
• producing the analysis, trends, and reporting the platform exists to deliver, as entrusted by the customer organisation;
• responding to enquiries, providing support, and handling complaints;
• diagnosing faults, monitoring performance, and improving reliability; and
• meeting obligations under tax, accounting, and other applicable laws.

We do not use personal information for any purpose beyond those stated above without obtaining separate consent.

Where PIPA requires consent, we obtain it separately and clearly, and we identify which items are optional. You may decline consent to optional items; declining consent to items required to provide the Service may mean we cannot provide it.

Health information. Athlete health information is sensitive information under Article 23 of PIPA and requires separate, explicit consent from the data subject, obtained apart from consent to other items. Where we process such information as entrusted by a customer organisation, that organisation is responsible for obtaining this separate consent and for informing athletes of the matters required by PIPA. We process it only as entrusted, and apply the additional safeguards described under Security.

You may withdraw consent at any time by contacting the Privacy Officer. Withdrawal does not affect processing already carried out.

We do not sell personal information, and we do not provide it to third parties except as described here or as required by law. We do not use athlete information to train models for other customers.

We entrust certain processing to service providers to operate the Service, including hosting, database, and support infrastructure. A current list of entrusted parties and the work entrusted to each is available on request from support@realams.com, and currently includes Vercel Inc. (application hosting and content delivery, United States) and Supabase Inc. (database hosting and storage, United States). Each is bound by written terms requiring confidentiality, restrictions on further entrustment, and security measures, and we supervise their handling of personal information as required by Article 26 of PIPA. We announce changes to this list through this Policy.

The customer organisation and its authorised users can access athlete information according to the permissions that organisation configures.

Personal information processed through the Service is stored overseas, in the United States. We disclose the following in accordance with Article 28-8 of the Personal Information Protection Act:

• Items transferred:all categories described under “Personal information we collect” above, including athlete health information as sensitive information.
• Country of transfer: United States. Application hosting is located in the Northern Virginia region and the database in which personal information is stored is located in the Ohio region.
• Time and method of transfer: transmitted over an encrypted network connection at the time of entry or import, and stored for the retention periods set out below.
• Recipients: Vercel Inc. (application hosting and content delivery) and Supabase Inc. (database hosting and storage). Contact details for each are available on request from the Privacy Officer.
• Recipients’ purpose: hosting, storing, and operating the Service on our behalf as entrusted parties. Neither recipient uses the information for its own purposes.
• Recipients’ retention period: for the duration of our contract with each recipient, and no longer than our own retention periods below.

Right to refuse. You may refuse the transfer of your personal information overseas by contacting the Privacy Officer at support@realams.com. Because the Service is hosted on this infrastructure, refusing means we cannot provide the Service to you. Where a customer organisation enters athlete information into the platform, that organisation is responsible for obtaining any separate consent to overseas transfer required from its athletes.

We destroy personal information without delay once the purpose of processing is achieved or the retention period expires, unless another law requires longer retention:

• Athlete information — retained while the athlete is associated with the customer organisation on the platform. We destroy or anonymise it:
  • within 7 days of the athlete or organisation withdrawing the consent or permission the processing relies on;
  • within 30 daysof the athlete’s association with the organisation being removed; and
  • within 30 days of a subscription ending, for all information remaining at that point.
  All periods are counted in calendar days from the event.
• Account information — retained while the account is active, then destroyed within 30 days of the account being removed.
• Enquiry information — 3 years from last contact.
• Records required by the Act on Consumer Protection in Electronic Commerce — contract and withdrawal records 5 years, payment and supply records 5 years, consumer complaint and dispute records 3 years.
• Books and vouchers under tax law — 5 years.
• Access records under the Protection of Communications Secrets Act — 3 months.
• Security and audit logs — 1 year.

Electronic files are destroyed by a method that makes recovery impossible; printed documents are shredded or incinerated.

Anonymised information. In place of destruction, we may irreversibly anonymise information at the end of its retention period and retain it for producing performance benchmarks and for research. Anonymisation removes names and contact details, generalises date of birth to an age band, club to league level, and exact dates to a relative point in the season, and deletes free-text medical notes. Groups too small to prevent re-identification are excluded from benchmark outputs. Once anonymised in this way, the information can no longer identify an individual and is not personal information under the Personal Information Protection Act. A customer organisation may ask us not to combine its anonymised data with that of other organisations.

We apply the technical, administrative, and physical measures required by Article 29 of PIPA and appropriate to the sensitivity of the data:

• encryption of personal information in transit and at rest;
• role-based access control that separates medical records from general performance access, granted on a least-privilege basis;
• revocation of access on role change or departure; and
• regular backups and technical measures against malicious code.

If a breach of personal information occurs, we will notify affected data subjects and report to the Personal Information Protection Commission or the Korea Internet & Security Agency within the period required by PIPA, and will notify the relevant customer organisation without delay.

Under Articles 35 to 37 of PIPA, you may at any time request access to your personal information, correction of errors, suspension of processing, or deletion. You may also withdraw consent previously given. You will not be disadvantaged for exercising these rights.

Athletes and club staff: contact your organisation, which controls your information. If you contact us directly we will forward the request and support their response.

Website visitors and account administrators: contact the Privacy Officer above. Requests may be made in writing, by email, or through a legal representative or delegate using the form prescribed by PIPA. We act on requests without delay, and will explain our reasons if we are unable to act on one.

Where processing is based on the automated analysis of personal information and produces a significant effect on you, you may refuse or request an explanation of that decision under Article 37-2 of PIPA.

If you are not satisfied with our response, you may seek assistance from:

• Personal Information Dispute Mediation Committee (개인정보분쟁조정위원회) — 1833-6972, www.kopico.go.kr
• Personal Information Infringement Report Centre (개인정보침해신고센터) — 118, privacy.kisa.or.kr
• Supreme Prosecutors’ Office Cybercrime Investigation — 1301, www.spo.go.kr
• National Police Agency Cyber Bureau — 182, ecrm.police.go.kr

You may also seek relief under Article 62 of PIPA, or bring an administrative appeal against a decision made by a public authority.

We use cookies that are strictly necessary to keep you signed in and to secure the Service. Where we use analytics or other non-essential cookies, we ask for your agreement first. You can refuse or delete cookies through your browser settings, though refusing necessary cookies may prevent you from signing in. We currently use only session cookies that maintain your signed-in state and protect against cross-site request forgery; these are removed when your session ends or expires. If we introduce analytics or other non-essential cookies, we will update this Policy and ask for your agreement before setting them.

Athlete monitoring often involves academy and youth players. Under Article 22-2 of PIPA, processing the personal information of a child under 14 requires the consent of a legal guardian. Where a customer organisation processes information about such athletes, it is responsible for obtaining that consent and for providing the required information in a form the child can readily understand. We apply the same safeguards to this information as to all health information, and we do not knowingly collect personal information directly from children through our website.

We update this Policy as our processing changes. Where changes are material we will give notice at least seven days before they take effect, by email or through the Service. The date shown at the top of this page is the effective date of the current version.