9. Media Capture Protocol

Preamble This Media Capture Protocol ("Protocol") governs all photography and video footage captured by Gym facilities in connection with Athlete memberships or training sessions, and, where it is used (it is not offered at present), all media captured by Athletes via the Waiver2.0 Media Capture Documentation (MCD) module. This Protocol forms an integral part of the Waiver2.0 Legal Compliance Suite and must be read in conjunction with SOP-24 Section 11, the Privacy Policy, and the Data Processing Agreement. In the event of any conflict between this Protocol and any other document in the Compliance Suite, this Protocol shall prevail with respect to media capture matters. Availability: the MCD module (Category B) is not offered at present. The provisions of this Protocol on the MCD module apply only where it is used. 1. Scope & Application 1.1 This Protocol applies to two distinct categories of media capture: Category A — Facility Media Capture: Photography or video footage captured by or on behalf of the Gym facility within the premises, in connection with Athlete memberships, training sessions, or promotional activities. Category B — MCD Media Capture: Photography or video footage captured by the Athlete via the Waiver2.0 MCD module for the purpose of forensic documentation of an injury or incident. 1.2 Both categories are subject to the forensic integrity requirements of the Waiver2.0 Platform and the privacy rights of all individuals captured within the media. 1.3 This Protocol applies to all Gym staff, authorized operators, and Athletes using the Platform in all jurisdictions in which Waiver2.0 operates. 2. Category A — Facility Media Capture 2.1 Consent Requirement 2.1.1 Prior to any capture of an Athlete by or on behalf of the Gym, the operator must verify that the Athlete's waiver record carries an active, non-revoked media consent flag: IF_IMG_YES = true — Athlete has consented to photographic capture. IF_MEDIA_PERM = true — Athlete has consented to video capture and/or promotional use. 2.1.2 Capture of any Athlete whose consent flags are absent, inactive, or revoked is strictly prohibited and constitutes a breach of the Athlete's data rights under applicable privacy law in all jurisdictions. 2.1.3 Consent to media capture is freely given, specific, informed, and unambiguous, captured via the Athlete's signed waiver record on the Platform. It is not a condition of gym membership or Platform access. 2.2 Designated Capture Zones 2.2.1 Facility media capture is permitted exclusively within pre-designated zones of the facility where visible signage is displayed notifying all persons present that photography and/or video recording may occur. 2.2.2 Capture outside designated zones is strictly prohibited regardless of the Athlete's consent status. 2.2.3 The following areas constitute absolute prohibited zones in all circumstances: Changing rooms, locker rooms, and shower areas. Toilet facilities. Any area where a reasonable expectation of privacy exists. Any area in proximity to minors, as defined in Section 5 of this Protocol. 2.2.4 The Gym is solely responsible for the placement and maintenance of adequate signage in all designated capture zones, consistent with the signage requirements of applicable law in its jurisdiction. 2.3 Forensic Protocol for Facility Media 2.3.1 The Platform does not currently provide for the upload of facility media; this Section 2.3 sets out how such media is to be handled where the Platform provides for it. Each facility media file uploaded to the Platform is then designed to be recorded with a SHA-256 hash that the Waiver2.0 server computes over the bytes it receives, and with the server time at which it received them. 2.3.2 These values are designed to be kept in a tamper-evident record linked to the Athlete's waiver record. Neither the hash nor the server time shows when or where the media was taken. 2.3.3 A media file whose hash does not match the value recorded for it is designed to be reported to the Waiver2.0 operator for review, and the platform makes no determination as to its admissibility, which remains a matter for the competent tribunal. 2.3.4 Metadata stripping or re-encoding of facility media files prior to upload is prohibited: the hash recorded on upload would then be that of the altered file, not of the file as captured. This rule concerns uploads of facility media under this Section 2.3; for MCD media, the removal of location metadata by the Waiver2.0 server before the hash is set out in Section 4.1. 2.3.5 Athlete media collected under this Protocol is to be kept only on the Platform. Storage of Athlete media on personal devices, third-party cloud services, or facility-internal drives outside the Platform is non-compliant and may expose the operator to liability under applicable privacy law. 2.4 Permitted Uses of Facility Media 2.4.1 Media may only be used for the specific purpose for which consent was obtained, as recorded in the Athlete's waiver record. 2.4.2 No media may be published, shared, or used in any promotional context without a verified hash entry in the Waiver2.0 system confirming the Athlete's prior digital approval. 2.4.3 Media use is strictly limited to the purposes disclosed at the time of consent capture. Any new or extended use requires fresh consent, recorded as a new consent event in the forensic audit log. 2.5 Right of Revocation 2.5.1 Athlete consent to media capture is freely revocable at any time via the waiver portal without affecting the validity of previously executed agreements. 2.5.2 Upon revocation, the Gym is prohibited from capturing or using new material featuring the revoking Athlete. 2.5.3 Previously sealed and hash-verified material may be retained solely for the period specified in the applicable data retention policy, after which it shall be permanently deleted from primary systems and subprocessor environments, and from backups as those backups expire in their normal rotation. 2.5.4 The Gym may not contest or delay compliance with a revocation notice. Continued capture or use of an Athlete's media following revocation constitutes a material breach of this Protocol and may give rise to liability under applicable privacy law in all jurisdictions. 3. Category B — MCD Media Capture (Premium Plan) 3.1 Purpose & Anti-Fraud Architecture 3.1.1 The MCD module, which is not offered at present, is designed as an anti-fraud forensic tool of the Premium Plan only; the Premium Plan cannot be chosen at present. Its purpose is to create a sealed photographic or video record of an injury or incident, recorded with the server time at which each file is received. 3.1.2 Capture method: the MCD module is designed to record, for each file, whether the Athlete's app reports it as taken with the camera or chosen with the file button. The Waiver2.0 server does not check this report, and neither the hash nor the server time shows when or where a file was taken. 3.1.3 The MCD module does not block access to images or videos already stored on the device; a file chosen with the file button is designed to be marked as such in the record. 3.1.4 The record shows what was reported and received, and when it was received; it does not show how or when a file was created, and the weight to give it remains a matter for the competent court or tribunal. 3.2 Premium Plan Entitlement & Gym Obligation 3.2.1 MCD access would be a contractual entitlement of the Premium Plan subscription only where the MCD module is offered; it is not offered at present. Where an Athlete holds an active Premium Plan subscription with MCD access enabled (IF_MEDIA_PERM = true), the Gym is unconditionally obligated to permit the Athlete to activate the MCD module at the time of a reportable incident. 3.2.2 The Gym may not refuse, obstruct, discourage, or delay an Athlete's exercise of their MCD rights under any circumstances, including by reference to internal photography policies, facility rules, or staff discretion. 3.2.3 Refusal or obstruction of an Athlete's MCD rights constitutes: A material breach of the Gym's Terms of Service with Waiver2.0. A potential violation of the Athlete's contractual rights under their Premium Plan subscription. Potential liability under applicable consumer protection law in all jurisdictions. 3.2.4 The Gym's obligation under this Section applies regardless of the Gym's internal media or photography policies, which may not override a contractual entitlement arising from the Athlete's Premium Plan subscription. 3.3 Absolute Prohibited Capture Contexts 3.3.1 Notwithstanding Section 3.2, MCD capture is strictly and absolutely prohibited in the following contexts, which take unconditional precedence over the Athlete's MCD entitlement: Prohibited Zones: Changing rooms, locker rooms, shower areas, toilet facilities, and any other area where a reasonable expectation of privacy exists. Prohibited zones apply regardless of the Athlete's consent or subscription status. Proximity to Minors: MCD capture is strictly prohibited where the capture field includes or is in proximity to any person under the age of 18 years, whether as the subject or incidentally within the frame. It is the joint responsibility of the activating Athlete and the supervising Gym staff member to ensure compliance with this prohibition before and during any capture event. Non-Consenting Third Parties: MCD capture must not be directed at or incidentally capture any third party who has not provided explicit consent to being recorded, except where strictly necessary to document the immediate physical circumstances of the incident and no alternative framing is practicable. 3.3.2 Jurisdiction-Specific Prohibited Capture Obligations: 🇦🇺 Australia: MCD capture must comply with the Privacy Act 1988 (Cth), the APPs, the Surveillance Devices Act 2004 (Cth), and applicable state surveillance legislation. Capture in prohibited zones may constitute a criminal offence under applicable state law. 🇨🇦 Canada: MCD capture must comply with PIPEDA, applicable provincial privacy legislation, and the Criminal Code of Canada. Capture without consent in private areas may constitute a criminal offence. 🇺🇸 United States: MCD capture must comply with applicable state wiretapping, recording consent, and privacy laws. Several states require all-party consent for audio recording. Capture of minors is governed by applicable state and federal child protection law including COPPA where applicable. 4. Forensic Processing of MCD Media 4.1 Where the MCD module is used, media submitted through it is designed to be processed as follows when the Waiver2.0 server receives it: The removal of the metadata in which a device may save its location: the Exif and XMP metadata of a photo (JPEG, PNG, HEIC, HEIF, WebP) and the IPTC metadata of a JPEG, and the user-data and metadata boxes of an MP4 or QuickTime video. The orientation of a JPEG photo is designed to be kept, in a new Exif that holds nothing else. The picture or video data itself is designed to be left unchanged. Data that a JPEG file carries after its images is removed, except a video that begins right after them and that the server can read, which is cleaned in the same way. A location that a video keeps in a separate timed-metadata track, as some action cameras record it, is not removed. A WebM video is not read and is kept as received, with any location written in its tags. A file whose structure the server cannot read is refused. A SHA-256 hash computed by the server over the file after that removal. An entry in a hash chain kept for the incident, which links each entry to the one before it and the first entry to the waiver and its sealed record; the media is not entered into the waiver's own hash chain. The server time at which the file was received, independent of device time. The file stored as it is after that removal. 4.2 Because the SHA-256 hash is computed over the file after the removal of that metadata, it identifies the file as stored, not the file as the device saved it; it does not show that the file is unchanged since it was taken. 4.3 A media file whose hash does not match the value recorded for it is designed to be reported to the Waiver2.0 operator for review, and the platform makes no determination as to its admissibility, which remains a matter for the competent tribunal. 5. Minors — Prohibition 5.1 The capture, storage, processing, or use of any image or video footage depicting a person under the age of 18 years is strictly and absolutely prohibited on the Platform under all circumstances, without exception. 5.2 This prohibition applies to both Category A and Category B media capture and supersedes all other provisions of this Protocol. 5.3 Gym operators are solely responsible for ensuring that no minor is present within the capture field at the time of any media capture event. 5.4 Any media file found to contain an image of a minor must be immediately and permanently deleted from all systems and reported to Waiver2.0 at privacy@waiver2.com. Waiver2.0 reserves the right to immediately suspend the Gym's account pending investigation. 5.5 Jurisdiction-Specific Minor Protection Obligations: 🇦🇺 Australia: The capture and storage of images of minors may constitute an offence under applicable state child protection legislation and the Criminal Code Act 1995 (Cth). 🇨🇦 Canada: The capture and storage of images of minors may constitute an offence under the Criminal Code of Canada and applicable provincial child protection legislation. 🇺🇸 United States: The capture and storage of images of minors is governed by COPPA, applicable state child protection law, and the Child Exploitation and Obscenity statutes. Any suspected breach must be reported to the National Center for Missing & Exploited Children (NCMEC). 6. Storage, Access & Retention 6.1 Where the MCD module is used, media submitted through it is designed to be stored on Waiver2.0's infrastructure hosted on Railway (EU West, Amsterdam), subject to appropriate technical and organisational measures. 6.2 Access to stored media is to be limited by role. The gym_representative field in the waiver record identifies the accountable person for each facility. 6.3 Periodic compliance audits must verify that no unregistered copies of Athlete media exist outside the Platform. 6.4 Retention periods for media files are the same as for the waiver they relate to, set out in the Privacy Policy (Section 5): until the limitation period applicable to the Gym's jurisdiction expires, counted from the expiry of the waiver, longer where the Waiver2.0 operator places a hold while an incident report is still open (holds are placed and lifted by the Waiver2.0 operator, not automatically). 6.5 Upon expiry of the applicable retention period, all media files are to be permanently deleted from primary storage and all subprocessor environments, and from backups as those backups expire in their normal rotation. The cryptographic hash of each media file and its position in the forensic chain are retained permanently, by design; a hash value cannot, on its own, identify anyone or reveal the content it was generated from. 7. Waiver Fields & Compliance Checklist 7.1 The following waiver fields govern media capture compliance and must be verified by the Gym prior to any capture event: FieldDescriptionSEC_13_Image_ChoiceAthlete's consent status for photographic captureIF_IMG_YESActive consent flag — photographic capture permittedIF_MEDIA_PERMActive consent flag — video capture and promotional use permittedGym_Check_Privacy_ZonesGym confirmation that capture is occurring within a designated zoneGym_Check_MCD_AwarenessGym confirmation of awareness of MCD Protocol obligations 7.2 The Gym is solely responsible for verifying all applicable fields prior to initiating any capture event. Failure to verify constitutes a breach of this Protocol. 8. Liability 8.1 Waiver2.0 bears no liability for media captured by Gym staff outside the Platform's forensic workflow, for media captured in prohibited zones, or for any breach of this Protocol occurring at the Gym's operational level. 8.2 The Gym indemnifies Waiver2.0 against any claim, loss, or liability arising from the Gym's failure to comply with this Protocol, including any claim arising from unauthorized capture, capture in prohibited zones, or capture of minors. 8.3 Nothing in this Section limits any non-excludable liability under applicable law in any jurisdiction. 9. Amendments & Versioning 9.1 This Protocol is versioned and stored on the Platform. Its version is not recorded with a signing event (Audit Trail & Compliance Package, Section 8.2). 9.2 We will notify the relevant user or Gym Compliance Officer of material amendments and, where required by law, seek consent again. 9.3 Last updated: 10 November 2026.