2. Privacy Policy

1. Identity & Contact Details of the Data Controller 1.1 The Platform is operated by Waiver2.0 OÜ, a company established in Estonia ("We", "Us", "Our"). Waiver2.0 OÜ is registered in the Estonian Commercial Register under registry code 17624360; its registered address is Sepapaja tn 6, Lasnamäe linnaosa, 15551 Tallinn, Harju maakond, Estonia. 1.2 For all privacy-related enquiries, users may contact: privacy@waiver2.com. 1.3 Because Waiver2.0 OÜ is established in the European Union, the GDPR applies to Our processing of personal data as a matter of Article 3(1), regardless of where an Athlete or Gym is located. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). 2. Personal Data We Collect 2.1 Identity & Contact Data: Full name, date of birth, residential address, email address, phone number. 2.2 Emergency Contact Data: The name, phone number, and relationship of a third party the Athlete nominates as their emergency contact. 2.3 Health Data (special category data): Fitness status; medical history status; the specific condition and medication flags the Athlete selects; any free-text description of other conditions or medication the Athlete chooses to provide; and the Athlete's health-related declarations (health warranty, consent to processing, consent to disclosure to the Gym, read-and-agree confirmation). 2.4 Account Data: The Athlete's email address, used to send a single-use, time-limited sign-in link (no password is ever created, stored, or transmitted), subscription tier, and account activity history. For a Gym, and for the owner of a group of Gyms, the email address registered for that account is used in the same way; the owner of a group of Gyms is shown the business name, city and setup status of the Gyms in that group, and no athlete or waiver data. 2.5 Contractual Data: Signed waivers, contracts, incident reports, and all associated document versions. 2.6 Forensic Metadata: IP address and a server timestamp captured at every signing event. The IP address is printed in the signed waiver document. 2.7 Media Data (where applicable): Photographs or video footage captured through the Platform's media capture feature, where used, subject to the Media Capture Protocol and explicit prior consent. 2.8 Payment Metadata: Transaction ID, subscription status, and payment timestamps. Full card data is never stored by Waiver2.0; payment processing is handled exclusively by Our payment provider, which acts as an independent data controller and is named at checkout. 2.9 Incident Records and Eyewitness Signatures (where applicable): An Athlete may keep an incident record from the Athlete's own account against the Athlete's sealed waiver; it is not a Gym's incident report. An eyewitness entry of that record may hold the eyewitness's statement, name and contact, and an image of a signature drawn on the Athlete's device for that entry. The image is kept as a file with the incident record, encrypted with a key of that record, as are the statement, the name and the contact; no function of the Platform returns them, and no function of the Gym reads these incident records. The record shows that the image was sent from the Athlete's account, not who drew it. A person who draws a signature for an eyewitness entry is a data subject of this Policy and may exercise the rights in Section 11. Waiver2.0 processes the eyewitness's statement, name, contact and signature image on the basis of the legitimate interests of the Athlete and of Waiver2.0 (Art. 6(1)(f) GDPR), the documentation of an incident for a legal claim, actual or anticipated; health information in a statement is processed under Art. 9(2)(f). This basis, and not the consent for media capture of Section 3.3, applies to these data. These data are kept for the retention period of the waiver's record (Section 5.1); on the request of the person who drew a signature, Waiver2.0 removes the signature image, unless the same image is also part of another entry of the incident record, and a removed image stays in backups until they expire in their rotation; after a removal the incident record keeps the image's SHA-256 hash, size and type, not the image. A person named in an eyewitness entry may ask privacy@waiver2.com for access to, or the erasure of, the statement, name, contact or signature image kept about them; Waiver2.0 finds the entry from the details the person gives, such as the Gym and the date of the incident, and answers within the period of Section 11.1. This feature is not switched on at present. 2.10 Incident Downloads (where applicable): The Athlete may download an incident record as an Incident Pack (one JSON file) and as an Insurance-Ready Export (one PDF). Each is built at the Athlete's request and is not kept by Waiver2.0. Neither holds the values the entries were given, a photo, video or signature image, the Athlete's name or email address, or an IP address. The Athlete may keep either download or hand it to a person the Athlete chooses, such as an insurer, a broker or a lawyer; that disclosure is the Athlete's, and Waiver2.0 does not know who receives it. These downloads are not switched on at present. 3. Purposes, Roles & Legal Bases of Processing 3.1 We process personal data for four distinct purposes, and act in a different capacity for each (a separate measurement of the waiver form is described after the table): PurposeWhat it coversWaiver2.0's roleCreation, sealing and preservation of the evidentiary record (the sealed waiver document, the cryptographic hash chain, timestamps, the Athlete's account and subscription, the /verify service, and the handling of legal claims relating to that record)Independent Data ControllerDisclosure of the Athlete's information — including health information, under its own separate consent — to the Gym, for activity clearance and safety awarenessData Controller: We disclose this information to the Gym based on the Athlete's own consent. This is not processing carried out on the Gym's instructions; once disclosed, the Gym is an independent Data Controller of the information it receivesDelivery of the executed document to both the Athlete and the GymData Controller (delivery is incidental to Purpose A)Gym-facing platform functions — the Gym's dashboard, its list of registered Athletes, and notifications to the Gym about an Athlete's subscription status or renewalProcessor, acting on the Gym's behalf In addition, while an Athlete completes the waiver form, Waiver2.0 records for itself, as controller, how far the visit progresses; to the extent that this record relates to an identifiable person, the legal basis is Waiver2.0's legitimate interest (Art. 6(1)(f)), and the Athlete may object (Art. 21). The Cookie & Tracking Policy (Sections 2.5 and 4.3) describes it. 3.2 The Data Processing Agreement between Waiver2.0 and each Gym applies only to the fourth purpose above — the Gym-facing platform functions. It does not apply to Purpose A (the evidentiary record) or to the disclosure of the Athlete's information to the Gym: for both of those, Waiver2.0 is an independent controller, not a processor acting on the Gym's instructions. 3.3 Legal bases: PurposeLegal BasisCreation and maintenance of the evidentiary record (non-health data)Art. 6(1)(b) — necessary to perform the contract with the AthletePreservation of the evidentiary record after the contract endsArt. 6(1)(f) — Our legitimate interest in retaining evidence of what was signed, for the duration set out in Section 5Processing of health data for Purpose A (creation and preservation of the evidentiary record)Art. 9(2)(a) — the Athlete's explicit consent (the "Health Data Consent" declaration in Section 4 of the waiver)Continued preservation of health data in the sealed record after the subscription endsArt. 9(2)(f) — establishment, exercise or defence of legal claimsDisclosure of health data to the Gym (Purpose B)Art. 9(2)(a) — the Athlete's separate, explicit consent (the "Medical Data Disclosure Consent" declaration); once disclosed, the Gym is responsible as controller for its own further use of that informationDisclosure of the sealed waiver document to the Gym's insurer or legal counsel upon verified request (Section 3.6)Art. 6(1)(f) — the legitimate interest of the Gym and of Waiver2.0 in establishing, exercising or defending legal claims; for the health declarations the waiver document includes, Art. 9(2)(f) — establishment, exercise or defence of legal claimsPlatform security & fraud preventionArt. 6(1)(f) — legitimate interestsCompliance with applicable lawArt. 6(1)(c) — legal obligationMedia capture & use (where consented)Art. 6(1)(a) — explicit consentSubscription & payment managementArt. 6(1)(b) — contractual necessity 3.4 For the Gym-facing platform functions, Waiver2.0 acts as the Gym's processor; the Gym, as controller, determines the legal basis for that processing. 3.5 Personal data is never used for marketing, profiling, or resale under any circumstances. 3.6 Disclosure of the sealed waiver upon verified request: Waiver2.0 may send the Athlete's sealed waiver document to the Gym's insurer or legal counsel only for the establishment, exercise or defence of a legal claim, actual or anticipated, relating to that waiver, and only when the request names the waiver, the requester and that purpose and the Gym confirms the request in writing. A request from an insurer alone is not acted on, and the document is sent only to an address the Gym confirms. The waiver document includes the health declarations of its Section 13 (fitness status, the medical-history answer — none, a recent surgery or injury, or a medical condition — the health warranty, the consent to processing, the final medical confirmation and, where given, the Medical Data Disclosure Consent), but not the detail of conditions or medication, which is in the Health Annex; the Health Annex is not sent under this Section. The legal basis is Art. 6(1)(f) — the legitimate interest of the Gym and of Waiver2.0 in establishing, exercising or defending legal claims — and, for those health declarations, Art. 9(2)(f); the Athlete may object (Art. 21). Where the recipient is outside the European Economic Area, the transfer relies on Art. 49(1)(e) (necessary for the establishment, exercise or defence of legal claims). Once it receives the document, the recipient is responsible as controller for its own copy. Each such disclosure is recorded with its date, the waiver, the recipient, what was sent, the purpose, the basis and the transfer mechanism. Where another sealed waiver document is sent under this Section, the evidence sent with it may include the identifier of the Athlete's record and one-way hashes of that record (its chain hash, a hash computed in part from its identifier and chain hash, and, for a record that follows that waiver's record in the hash chain, its payload hash), not the content of the Athlete's waiver, only so that the recipient can check the hash chain. 4. Health Information 4.1 Health information is collected only with the Athlete's explicit, separate consent, given via the "Health Data Consent" declaration described in Section 3.3. 4.2 A second, independent consent — the "Medical Data Disclosure Consent" — governs whether the same health information is also transmitted to the Gym for activity clearance and safety awareness. An Athlete may give one consent without the other; declining disclosure to the Gym does not affect Waiver2.0's own processing of the information for the evidentiary record, and declining the evidentiary-record consent means the waiver cannot be completed. 4.3 Withdrawal: an Athlete may withdraw either consent at any time by contacting privacy@waiver2.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and does not affect what is already required to be retained for the establishment, exercise or defence of legal claims under Section 5.4. 4.4 Retention of health data specifically follows Section 5.2 below: the Gym's access to the operational copy used for the Gym-facing medical alert ends at the end of the Athlete's subscription; the copy inside the sealed evidentiary record is preserved until the applicable limitation period in Section 5.1 expires. 4.5 Not collected as dedicated fields: pregnancy status, allergies. If an Athlete chooses to describe either in the free-text "other conditions" or "other medication" fields, that text is handled as health data under this Section. 5. Data Retention 5.1 The sealed evidentiary record (the waiver document, health declarations, the signature image, identity and contact data, and the cryptographic hash chain) is retained until the limitation period applicable to the Gym's jurisdiction expires, counted from the expiry of the waiver, with retention extended (a "hold") where the Waiver2.0 operator places a hold on the record while an incident report relating to that waiver is still open; holds are placed and lifted by the Waiver2.0 operator, not automatically: JurisdictionRetention periodAustralia12 yearsUnited States6 yearsCanada15 years An unpaid submission that is never sealed is not part of that record: its personal data (the submission, including any health declarations, the typed signature and the signature image, the name, the email address and the IP address) is deleted once 365 days have passed since it was made, after the next monthly deletion check, and from backups as those backups expire in their normal rotation. A paid submission that is never sealed is kept until its seal is recovered or until the payment is refunded in full; a partial refund does not end this. Once the payment has been refunded in full, the rule for unpaid submissions applies: its personal data is deleted once 365 days have passed since the submission was made, or earlier on the Athlete's request. 5.2 Health information specifically: the Gym's access to the operational copy used to generate the Gym-facing medical alert ends when the Athlete's subscription ends. The copy inside the sealed evidentiary record described in Section 5.1 is preserved until the applicable limitation period expires, under Art. 9(2)(f) and Art. 17(3)(e) GDPR — because it may be needed to establish, exercise, or defend a legal claim relating to the waiver. 5.3 Notwithstanding Sections 5.1 and 5.2, personal data may be retained beyond the applicable period where required by applicable law, a court order, or a regulatory obligation, and solely for the duration of that requirement. 5.4 Upon expiry of the applicable retention period, the personal data described above — including the sealed document, the PDF file, identity and contact data, and health declarations — is to be permanently deleted from primary systems, from backups — including the database backups of the archive copy of Section 6.6 — as those backups expire in their normal rotation, and from the archive copy of Section 6.6. Only the cryptographic hash chain entry generated at the time of signing — the SHA-256 hash value, the server timestamp, and the entry's position in the chain — is retained, because each entry is cryptographically linked to the one before it and the chain's integrity depends on no entry being removed. A hash value cannot, on its own, identify the user or reveal the content it was generated from. 6. Data Storage, Infrastructure & Subprocessors 6.1 Hosting: All Platform infrastructure — the API, the database, PDF generation, and the storage of sealed PDF files — is hosted by Railway, in the EU West region (Amsterdam). The archive copy of Section 6.6 is kept in addition, once it is started. 6.2 Submission: When an Athlete submits a waiver, the Athlete's browser sends the full content of the submission, including health information, directly to the Waiver2.0 API (Section 6.1) over an encrypted connection (HTTPS). The submission does not pass through a workflow-automation tool. 6.3 Email: Waiver2.0 sends transactional email (including the single-use sign-in link, the Gym-facing medical alert, the sealed PDF delivered to the Athlete and the link to it sent to the Gym) through Resend. Resend's sending infrastructure for this purpose is located in Ireland; Resend Inc. is a United States company. 6.4 Payment Processing: Our payment provider, Paddle.com — named at checkout — acts as an independent data controller for all payment transactions. Paddle.com is the reseller and Merchant of Record for all our orders, and receives, as an independent data controller, the data needed to process the payment. Waiver2.0 retains transaction metadata with the sealed record of the waiver, including the provider and its transaction and order identifiers, the amount, currency, plan, payment status, failure count and times. 6.5 A current list of subprocessors is available upon request at privacy@waiver2.com. 6.6 Archive Copy: From the date Waiver2.0 starts the archive copy, it is kept, for recovery, with Scaleway SAS (Paris, France) in a Scaleway region in the EU. It holds a copy of each sealed PDF file and of the daily root values of the hash chain, and a daily backup copy of the Platform's database, which contains what the database holds — including identity and contact data, health declarations and the records of the hash chain. Each file and each database backup is encrypted by Waiver2.0 before it is sent, with a key Scaleway does not hold. Each database backup is kept for at least 35 days and is then deleted by the storage's expiry rules, in its normal rotation. What Scaleway can see includes, for each PDF file, its name, which carries the waiver identifier, its size, the time it was stored, and whether a hold placed by the Waiver2.0 operator keeps it from deletion; and, for each database backup, its name, which carries the date and time of the backup, its size and the time it was stored. Scaleway SAS is a company established in France. 7. International Data Transfers 7.1 Waiver2.0 OÜ is established in the European Union; Our subprocessors named in Section 6 are located in the EU (Railway; and, once the archive copy of Section 6.6 is kept, Scaleway SAS, a company established in France, in a Scaleway region in the EU) and, for Resend, partly outside the EEA (Resend Inc. is a US company, though the sending infrastructure used for Our traffic is in Ireland). 7.2 Where a subprocessor's own processing involves a transfer of personal data outside the EEA, that transfer is conducted under the safeguards set out in that subprocessor's own data processing terms — for example, Standard Contractual Clauses approved by the European Commission, or an equivalent lawful transfer mechanism. 7.3 Our payment provider acts as an independent data controller and publishes its own transfer safeguards; Waiver2.0 does not control how the payment provider transfers data. 7.4 Where Waiver2.0 sends a sealed waiver document under Section 3.6 to a recipient outside the European Economic Area, that transfer relies on Art. 49(1)(e) (necessary for the establishment, exercise or defence of legal claims) for that disclosure, and the transfer mechanism is recorded with it (Section 3.6). 8. Security Measures 8.1 Waiver2.0 applies appropriate technical and organisational measures to protect personal data, reviewed periodically as the Platform's processing evolves. 8.2 Hashing: SHA-256 cryptographic hashing is applied to every signed document, creating a tamper-evident digital fingerprint — a change to the underlying record is detectable because it no longer matches the recorded hash. This is a fingerprint of the record, not encryption of the record's content. 8.3 Access Control: Role-based access control limits data access to authorized personnel only. 8.4 Timestamping: All signing and processing events are timestamped using the Platform's own server clock at the moment the event is received (the "server timestamp"), independent of the signer's local device time. 8.5 Breach Response: In the event of a confirmed or suspected personal data breach, Waiver2.0 will notify affected Gyms (as Data Controllers of what they receive under Purpose B) without undue delay, and in any event within 72 hours of becoming aware of it; for the Gym-facing platform functions, for which Waiver2.0 is the Gym's processor, the Gym is notified as set out in Section 9 of Our Data Processing Agreement, and the Gym, as controller of those functions, decides on any notification to its supervisory authority and to the users concerned. For the processing for which Waiver2.0 is the Data Controller, unless the breach is unlikely to result in a risk to individuals, Waiver2.0 will notify the Estonian Data Protection Inspectorate without undue delay and, where feasible, within 72 hours of becoming aware of the breach, consistent with GDPR Art. 33; where the breach is likely to result in a high risk to individuals, Waiver2.0 will also inform the affected users without undue delay, unless an exception in GDPR Art. 34(3) applies. Waiver2.0 will meet any additional notification obligation that applies under Australian, US, or Canadian law. 9. Cookies & Tracking Technologies 9.1 Waiver2.0 uses only a strictly necessary sign-in cookie and session storage, as described in the Cookie & Tracking Policy (Sections 2.1 and 2.4). While an Athlete completes the waiver form, Waiver2.0 also records how far the visit progresses; the Cookie & Tracking Policy (Sections 2.5 and 4.3) explains what is recorded, why, and for how long. 9.2 No third-party marketing, advertising, or tracking cookies are deployed on the Platform. 9.3 Forensic metadata (IP address and the server-recorded timestamp) is collected for audit trail integrity and legal non-repudiation purposes (the IP address also to limit repeated submissions from one network), and is recorded with the sealed record; for waivers submitted from 16 October 2026 it is not an input to the hash chain described in Section 5. It is not used for profiling or behavioural advertising. 10. Children's Privacy 10.1 The Platform is intended only for people who have reached the age of majority under the law of the jurisdiction in which the Gym operates. An Athlete declares this when signing; Waiver2.0 records the declaration and does not independently verify age. 10.2 The Platform is not directed to, and does not knowingly collect personal information from, anyone under the age of majority, including children under 13 within the meaning of the Children's Online Privacy Protection Act (COPPA). 10.3 An eyewitness named in an Athlete's incident record (Section 2.9) may be any person; Waiver2.0 does not ask for an eyewitness's age. An Athlete should not name a child under 13 as an eyewitness nor ask a person under the age of majority to draw a signature, and should name any other person under the age of majority only with the agreement of that person's parent or guardian. 11. User Rights — How to Exercise 11.1 Users may exercise any of their applicable privacy rights by contacting privacy@waiver2.com. Requests will be acknowledged within 5 business days and resolved within 30 days, or such shorter period as required by applicable law. 11.2 Where a request relates to information the Gym received from Us as a disclosure under Section 3.1, Waiver2.0 will refer the request to the relevant Gym, since the Gym is the independent Data Controller of what it received. Where a request relates to the Gym-facing platform functions described in Section 3.1, Waiver2.0 will assist the Gym as required under Our Data Processing Agreement with that Gym. 11.3 Because Waiver2.0 OÜ, the Data Controller named in Section 1, is established in Estonia, users may lodge a GDPR complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) — www.aki.ee. Under Article 77 GDPR, a user may also lodge a complaint with the supervisory authority of the EU or EEA country where the user habitually lives or works, or where the alleged infringement took place; for a user who lives in Greece, for example, that is the Hellenic Data Protection Authority — www.dpa.gr. Depending on where the user is located, the following bodies may also be relevant to rights under local law: Australia: Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au, under the Privacy Act 1988 (Cth) Canada: Office of the Privacy Commissioner of Canada — www.priv.gc.ca, under PIPEDA and applicable provincial legislation United States: the relevant state Attorney General or consumer protection agency, under applicable state privacy law 11.4 Where an erasure request concerns the sealed evidentiary record described in Section 5.1, Waiver2.0 may retain that record, including the health declarations it contains, until the period in Section 5.1 expires, because it may be needed to establish, exercise or defend a legal claim relating to the waiver (Art. 17(3)(e) GDPR); the response to the request will say so. A submission that was never sealed is deleted on request, unless it was paid for and the payment has not been refunded in full: such a submission is kept, as set out in Section 5.1, until its seal is recovered or the payment is refunded in full, and the response to the request will say so. Where a sealed record is erased, the response will state which cryptographic chain elements — hash values, timestamps, and chain position — remain retained under Section 5.4, and that a hash value cannot, on its own, identify the user or reveal the content it was generated from. 12. Amendments to this Privacy Policy 12.1 This Privacy Policy is versioned and stored on the Platform. We will notify users of material changes and, where required by law, seek consent again. 12.2 For waivers submitted from 25 October 2026, the record of the submission holds the version and SHA-256 hash of the legal corpus of the server that accepted the submission: the templates and the files of text they print, including the jurisdiction texts, of the waiver contract and the health annex. This Privacy Policy is not part of that corpus. 12.3 Last updated: 10 November 2026.