5. Standard Operating Procedure (SOP)

1. Purpose & Legal Scope 1.1 This Standard Operating Procedure ("SOP-24") defines the mandatory steps the Gym must follow to maintain the forensic integrity of the Waiver2.0 platform and to keep incident records in a form that can be offered as evidence and used to meet regulatory requirements in each jurisdiction in which the Platform operates; whether a record is admissible, and its weight, is for the competent court or tribunal. 1.2 Compliance with this SOP is a prerequisite for the legal validity of the Platform's evidentiary record and for Waiver2.0's ability to provide forensic support in any subsequent legal, insurance, or regulatory proceeding. 1.3 This SOP applies to all Gym staff authorized to access the Waiver2.0 Incident Report (IR) Module, including facility managers, coaches, trainers, and designated compliance officers. 1.4 The IR Module is not offered to Gyms at present. The Gym records reportable incidents under its own procedures; the provisions of Sections 3 to 7 that refer to the IR Module apply only where the IR Module is made available to the Gym. 2. Definition of a Reportable Incident 2.1 A reportable incident is any event occurring within the Gym facility or in connection with a Gym-facilitated activity that results in, or has the potential to result in: Physical injury to an Athlete, staff member, or third party. A medical emergency or request for emergency services. Property damage directly related to athletic activity. A complaint, dispute, or allegation by an Athlete relating to their participation or safety. Any event that may give rise to an insurance claim or legal action. 2.2 Near-miss events — incidents that did not result in injury but had the potential to do so — are also reportable under this SOP and carry equal forensic weight. 3. Mandatory Reporting Timeline 3.1 Where the IR Module is available to the Gym (Section 1.4), all reportable incidents must be recorded via the Waiver2.0 Incident Report (IR) Module within twenty-four (24) hours of the occurrence ("the 24-Hour Rule"). 3.2 The 24-Hour Rule is a forensic integrity requirement. Reports submitted beyond this window are designed to be flagged in the audit trail as "Late Entry," which may: Diminish the forensic weight of the record in legal proceedings. Be considered by the competent tribunal when assessing the weight of the report. Be raised by opposing parties in insurance or litigation contexts as evidence of administrative failure. 3.3 Jurisdiction-Specific Regulatory Reporting Obligations: In addition to the 24-Hour Rule, Gym operators must comply with any mandatory statutory incident reporting obligations in their jurisdiction, including: 🇦🇺 Australia: Gyms must comply with applicable Work Health and Safety (WHS) Act obligations at the Commonwealth and state/territory level. Serious incidents must be reported to the relevant state or territory WHS regulator immediately. Where available, Waiver2.0's IR Module is designed to support record-keeping but does not replace statutory WHS notification obligations. 🇨🇦 Canada: Gyms must comply with applicable provincial occupational health and safety legislation. Serious injuries must be reported to the relevant provincial authority in addition to being recorded in the IR Module where it is available. 🇺🇸 United States: Gyms must comply with applicable OSHA recordkeeping and reporting requirements (29 CFR Part 1904) where applicable. 4. Incident Report Submission — Required Data Fields 4.1 Every IR submitted via the Waiver2.0 IR Module must include, at minimum, the following fields: Athlete full name and Waiver2.0 Contract_ID. Date, time, and precise location of the incident within the facility. Nature and description of the incident (factual, non-interpretive account). Names and roles of all witnesses present. First aid or emergency response measures taken, if any. Name and role of the reporting staff member. Whether emergency services were contacted and, if so, the service and response time. 4.2 Reporting staff must use factual, non-interpretive language. Medical diagnoses, legal conclusions, or assessments of fault must not be included in the IR. The IR is a factual record, not a medical or legal opinion. 5. Evidence Integrity & Prohibitions 5.1 The Gym is strictly prohibited from attempting to retroactively modify, delete, or sanitize any incident data once submitted. 5.2 The IR Module is designed to use tamper-evident logging: once an IR is submitted, the timestamp, data, and SHA-256 hash are designed to be sealed, so that a later alteration of the sealed data can be detected by hash verification. 5.3 Where a submitted IR requires clarification or supplementation, the authorized staff member must submit a "Supplemental Addendum" via the IR Module. The Addendum is designed to receive its own SHA-256 hash and timestamp and to be chain-linked to the original IR record; submitting an Addendum is designed not to change the original IR. 5.4 Attempts to circumvent the tamper-evident logging system constitute a material breach of the Gym's Terms of Service and may constitute a criminal offence under applicable law in all jurisdictions. 6. The Record-Keeping Principle 6.1 Waiver2.0 functions as an independent third-party record-keeper. The Platform's sole role is to capture facts as reported by authorized Gym staff; it does not provide triage, medical judgment, or legal assessment of any incident. 6.2 The forensic value of the IR record is directly proportional to the completeness, accuracy, and timeliness of the data entered by Gym staff. Waiver2.0 bears no responsibility for the quality or accuracy of data entered by the Gym. 6.3 Where the IR Module is available to the Gym, failure to utilize it for a known reportable incident constitutes a material breach of the Terms of Service and exempts Waiver2.0 from any obligation to provide forensic support, records, or expert assistance in connection with that incident. 7. Gym Accountability & Staff Training 7.1 The Gym is solely responsible for ensuring that all authorized staff members are trained in the use of the Waiver2.0 IR Module prior to commencing their role. 7.2 Training records must be maintained by the Gym and are subject to audit upon request by Waiver2.0 or any relevant regulatory authority. 7.3 The Gym must designate at least one (1) named Compliance Officer responsible for overseeing SOP-24 compliance. The Compliance Officer's details must be registered in the Gym's Waiver2.0 account profile. 7.4 Waiver2.0 is not liable for administrative omissions, inaccurate data entry, delayed reporting, or any other failure to comply with this SOP that occurs at the Gym's operational level. 8. Access to Incident Records 8.1 Incident records are accessible to authorized Gym staff via the Waiver2.0 portal, accessed via secure sign-in, subject to Role-Based Access Control (RBAC). 8.2 Athletes have the right to request access to their own incident records, subject to applicable privacy law in their jurisdiction. 8.3 Incident records may be disclosed to the following parties, subject to applicable law: The Athlete named in the record, upon verified request. The Gym's legal counsel or insurer, upon verified request. A court, tribunal, or regulatory authority, upon receipt of a valid legal order or statutory obligation. Waiver2.0's legal representatives, for the purpose of providing forensic analysis or expert evidence. 8.4 Jurisdiction-Specific Access & Disclosure Notes: 🇦🇺 Australia: APP 12 — Privacy Act 1988 (Cth). 🇨🇦 Canada: PIPEDA Principle 9. 🇺🇸 United States: CCPA (California residents). 9. Retention of Incident Records 9.1 Incident records are retained for the same period as the waiver they relate to, set out in the Privacy Policy (Section 5): until the limitation period applicable to the Gym's jurisdiction expires, counted from the expiry of the waiver, longer where the Waiver2.0 operator places a hold while the incident report is still open (holds are placed and lifted by the Waiver2.0 operator, not automatically). Upon expiry of the applicable period, the personal data contained in the incident record is to be permanently deleted. The record's cryptographic hash and its position in the forensic chain are retained permanently, by design; a hash value cannot, on its own, identify anyone or reveal the content it was generated from. 9.2 The retention periods in Section 9.1 (12 years Australia, 6 years United States, 15 years Canada) are set with reference to applicable personal injury limitation periods in each jurisdiction. 10. SOP Versioning & Amendments 10.1 This SOP is versioned and stored on the Platform. Its version is not recorded in the forensic audit log or with the Gym's registration. 10.2 We will notify the Gym's designated Compliance Officer of material amendments and, where required by law, seek consent again. 11. Media Capture Documentation (MCD) in Incident Reporting 11.1 Purpose & Anti-Fraud Architecture 11.1.1 The Media Capture Documentation ("MCD") feature is designed as an anti-fraud tool of the Premium Plan only; it is not offered at present, and the Premium Plan cannot be chosen at present. Its purpose is to create a sealed photographic or video record of an injury or incident, submitted through the Waiver2.0 Platform interface and recorded with the server time at which each file is received. This Section 11 applies only where the MCD feature is used. 11.1.2 The MCD module is designed to record, for each file, whether the Athlete's app reports it as taken with the camera or chosen with the file button. The Waiver2.0 server does not check this report; the module does not block access to the device's photo gallery, and neither the hash nor the server time shows when or where a file was taken. 11.1.3 Media that reaches the Gym or Waiver2.0 outside the MCD module is not part of the MCD record. The weight to give any media remains a matter for the competent court or tribunal. 11.2 Premium Plan Entitlement & Gym Obligation 11.2.1 MCD access would be a contractual entitlement of the Premium Plan subscription only where the MCD feature is offered; it is not offered at present. Where an Athlete holds an active Premium Plan subscription with MCD access enabled (IF_MEDIA_PERM = true), the Gym is obligated to permit the Athlete to activate the MCD module at the time of a reportable incident. The Gym may not refuse, obstruct, or discourage an Athlete's exercise of this right. 11.2.2 Refusal or obstruction of an Athlete's MCD rights by Gym staff constitutes a material breach of the Gym's Terms of Service with Waiver2.0 and may expose the Gym to liability under applicable consumer protection law in all jurisdictions. 11.2.3 The Gym's obligation under this Section applies regardless of the Gym's internal photography or media policies, which may not override a contractual entitlement arising from the Athlete's Premium Plan subscription. 11.3 Mandatory Exclusion Zones & Prohibited Capture Contexts 11.3.1 Notwithstanding Section 11.2, MCD capture is strictly prohibited in the following contexts, which take absolute precedence over the Athlete's MCD entitlement: Prohibited Zones: Any area of the facility designated as a no-capture zone, including but not limited to changing rooms, shower areas, toilets, and any other area where a reasonable expectation of privacy exists. Prohibited zones must be clearly identified by visible signage at the point of entry. Proximity to Minors: MCD capture is strictly prohibited where the capture field includes, or is in the proximity of, any person under the age of 18 years, whether as the subject of the capture or incidentally within the frame. It is the responsibility of the activating Athlete and the supervising Gym staff member to ensure compliance with this prohibition prior to and during any capture event. Third-Party Privacy: MCD capture must not be directed at, or incidentally capture, any third party who has not provided explicit consent to being recorded, except where strictly necessary to document the immediate physical circumstances of the reported incident and no alternative framing is practicable. 11.3.2 Jurisdiction-Specific Privacy Obligations in MCD Capture: 🇦🇺 Australia: MCD capture and storage must comply with the Privacy Act 1988 (Cth), the APPs, and applicable state surveillance and listening device legislation, including the Surveillance Devices Act 2004 (Cth) and state equivalents. Capture in prohibited zones may also constitute an offence under applicable criminal law. 🇨🇦 Canada: MCD capture must comply with PIPEDA and applicable provincial privacy legislation, including Quebec's Act respecting the protection of personal information in the private sector. Capture without consent in private areas may constitute a criminal offence under the Criminal Code of Canada. 🇺🇸 United States: MCD capture must comply with applicable state wiretapping, recording consent, and privacy laws. Several states require all-party consent for audio recording. Capture of minors is governed by applicable state and federal child protection law, including COPPA where applicable. 11.4 Forensic Processing of MCD Media 11.4.1 Where the MCD module is used, media submitted through it is designed to be processed when the Waiver2.0 server receives it, as set out in the Media Capture Protocol, Section 4: the removal of the metadata in which a device may save its location (the Exif and XMP metadata of a photo, except the orientation of a JPEG photo; the user-data and metadata boxes of an MP4 or QuickTime video); a SHA-256 hash computed by the server over the file after that removal; an entry in a hash chain kept for the incident, linked to the waiver and its sealed record (the media is not entered into the waiver's own hash chain); and the server time of receipt, independent of device time. 11.4.2 A media file whose hash does not match the value recorded for it is designed to be reported to the Waiver2.0 operator for review, and the platform makes no determination as to its admissibility, which remains a matter for the competent tribunal. 11.4.3 MCD media is designed to be kept on the Platform. Storage on personal devices, third-party cloud services, or facility-internal drives outside the Platform is non-compliant and may breach the Athlete's data rights. 11.5 MCD Record Retention 11.5.1 Where the MCD module is used, MCD media records are subject to the same retention periods as all forensic records: MCD media is retained for the same period as the waiver it relates to, set out in the Privacy Policy (Section 5); Digital Vault archival is not offered at present. The media file and any personal data it contains are to be deleted upon expiry of the applicable retention period; the record's cryptographic hash and chain position are retained permanently; a hash value cannot, on its own, identify anyone or reveal the content it was generated from. 11.5.2 Upon an Athlete's written request, MCD media linked to their record may be provided to the Athlete, their legal counsel, or a relevant authority, subject to verification of identity and applicable privacy law in the relevant jurisdiction. Last updated: 10 November 2026.