Privacy Policy

1. Scope and responsibilities

TAN FIT is an Australian school-services platform based in Victoria. This policy applies to tanfit.org, the TAN FIT web application, and the related services we provide (the Service).

Schools decide which authorised users can use the Service and why school records are processed. For those records, the School is generally the controller or responsible organisation under applicable law, and TAN FIT acts as its processor or service provider. TAN FIT separately determines how information is used for account administration, security, support, legal compliance, and our own service operations. A School's privacy notice may therefore also apply to you.

This policy describes our usual practices. A signed customer agreement, data-processing agreement, feature-specific notice, or lawful School instruction may provide additional details. If you have a question about a School-controlled record, contact the School first.

2. Privacy at a glance

3. Information we handle

The information involved depends on the modules and features a School enables. It may include:

• Identity and account information, including name, school email address, user identifier, authentication information, role, and account status.
• School and relationship information, including organisation, classes, courses, groups, memberships, permissions, timetables, and staff-student relationships.
• Learning and administration records, including curriculum material, assignments, submissions, assessment answers, feedback, results, attendance-related activity, notes, and uploaded files.
• Physical education and performance records, including programmes, exercises, workouts, measurements, coaching records, readiness information, and progress history.
• Health and connected-device information, including optional heart-rate, step, sleep, workout, device, and source-payload information described below.
• AI feature information, including text, images, instructions, generated audio, extracted answers, and outputs processed when an authorised user invokes an AI-assisted feature.
• Communications, including support requests, privacy enquiries, feedback, and contact-form submissions.
• Technical and usage information, including session identifiers, IP address, browser and device characteristics, page views, referrers, approximate location derived from a request, diagnostic logs, and security events.

4. How we collect information

We collect information:

• from Schools when they configure the Service, create or invite users, and provide school records;
• from authorised users when they enter information, complete work, import records, upload files, or contact us;
• from connected services when a user chooses to authenticate or import information through them; and
• automatically when the Service receives requests, maintains a session, records diagnostic events, or measures aggregate page usage.

Schools are responsible for having appropriate authority to provide School-controlled information to TAN FIT. We collect only information reasonably needed for the enabled Service and its secure operation.

5. How we use information

We use personal information to:

• deliver the learning, PE, performance, administration, reporting, and account features requested by a School;
• authenticate users and apply organisation, role, class, and relationship-based access controls;
• process user-directed imports, uploads, assessments, and AI-assisted tasks;
• provide support, communicate service information, and respond to privacy requests;
• protect the Service, investigate misuse, prevent fraud, and diagnose faults;
• understand aggregate service usage and improve reliability, accessibility, and usability; and
• comply with law and protect the rights, safety, and security of Schools, users, TAN FIT, and others.

Where a law requires a legal basis, our basis will depend on the context and may include performing our agreements, following a School's lawful instructions, consent, legitimate interests in operating and securing the Service, or compliance with legal obligations.

We do not sell personal information, use student information for behavioural advertising, or make solely automated decisions that have legal or similarly significant effects on students.

6. Health and connected-device information

Performance and device-import features may involve information treated as sensitive or health information under applicable law. These features are optional and are made available only in the school and user context for which they are enabled.

When a user imports data from Xiaomi Mi Fitness, Google Fit, Health Connect, or another supported source, TAN FIT may store both extracted records—such as workouts, heart-rate samples, steps, and sleep sessions—and the source payload needed to process, trace, and support that import. Device providers remain responsible for their own services and privacy practices.

Users can stop future imports by not submitting further exports or by disconnecting a supported connection where that option is available. Requests to remove School-controlled imported information should be made through the School.

7. AI-assisted features

Some authorised workflows use OpenAI services. For example, TAN FIT may send an assessment image and related instructions to an AI model to extract or analyse a response, or send learning text to create audio. These features operate only when configured and invoked for the relevant school purpose.

AI output can be incomplete or incorrect. It is provided as an assistive result and must be reviewed by an appropriate person before it is relied upon for assessment, instruction, safety, or another decision affecting a student. TAN FIT does not use School content to build advertising profiles or to train a TAN FIT general-purpose model.

OpenAI processes submitted content and associated technical information under its contractual terms and data controls. Schools should avoid submitting information that is unnecessary for the task, and TAN FIT limits access to the authorised workflow and relevant users.

8. Providers and disclosures

We disclose information only where reasonably necessary to provide and protect the Service, follow a School's instruction, complete a user-requested integration, or comply with law. Recipients may include:

• the relevant School and authorised users acting within their assigned roles;
• Supabase, which supports authentication, databases, file storage, and related backend services;
• Vercel, which supports application hosting and privacy-focused web analytics;
• OpenAI, when an authorised user invokes an enabled AI-assisted feature;
• Google, when a user chooses Google authentication or a supported Google-related import; and
• professional advisers, authorities, or other recipients where disclosure is required or permitted by law.

Service providers may use information only for the contracted service and their permitted security, compliance, and operational purposes. We do not authorise them to use student information for their own advertising.

Analytics, cookies, and local preferences

TAN FIT uses essential cookies and similar storage to maintain secure sessions and functional preferences. Vercel Web Analytics records privacy-focused, aggregate page-view information without advertising cookies and without tracking a visitor across different websites. We do not use advertising cookies in the TAN FIT application. Disabling essential browser storage may prevent authentication or preferences from working.

9. International processing

TAN FIT's primary production hosting and database services are configured in Australia where available. However, TAN FIT serves Schools internationally and uses global service providers. Depending on provider operations, support, security, a user's location, and an enabled feature, limited information or submitted content may be processed in other countries.

Where applicable, we use safeguards such as contractual data-protection commitments, access controls, encryption in transit, provider due diligence, and transfer mechanisms recognised by relevant law. We provide Schools with material provider and location information where reasonably required for their assessment and notices.

10. Retention and deletion

We keep School-controlled information for the period agreed with the School or required to provide the Service, then delete or return it in accordance with the customer agreement, lawful School instructions, and applicable law. The exact period can differ by School, record type, and module.

Account, support, security, and legal records are retained only while reasonably needed for their purpose, including resolving disputes, maintaining audit integrity, preventing abuse, and meeting legal obligations. Deletion from active systems may be followed by a limited period in protected backups before those copies age out. We may retain de-identified information that can no longer reasonably identify a person.

11. Security and incidents

We use technical and organisational measures designed to protect information against unauthorised access, loss, misuse, interference, alteration, and disclosure. Measures include authenticated access, role and tenant controls, encrypted network connections, restricted administrative access, software maintenance, and logging appropriate to the Service.

No online service can guarantee absolute security. Schools and users must protect credentials, use only authorised accounts, and promptly report suspected unauthorised access. If an incident affects personal information, TAN FIT will investigate, take reasonable containment and remediation steps, and notify affected Schools, individuals, or authorities when required by law or contract.

12. Children, schools, and families

TAN FIT is offered to students through Schools for authorised educational and school purposes; it is not marketed as a direct-to-child consumer service. Schools decide which students may use the Service and are responsible for their own notices, approvals, safeguarding, supervision, and family communications.

TAN FIT also retains its own obligations as a service operator. We limit student information to the school-authorised purpose, do not use it for behavioural advertising, provide Schools with information about our practices, support appropriate access and deletion requests, and do not require a student to disclose more information than is reasonably needed for the relevant activity.

Parents and guardians seeking access to, correction of, or deletion of a student's School-controlled record should contact the School. We will assist the School where required by law or contract.

13. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, restrict, object to processing of, or receive a copy of personal information. Where processing is based on consent, you may also have a right to withdraw consent without affecting earlier lawful processing.

For School-controlled information, submit the request to the School first. TAN FIT will assist the School as appropriate. For information TAN FIT controls independently, email privacy@tanfit.org. We may need to verify identity, consult the relevant School, preserve information required by law, or explain why an exception applies.

14. Complaints, changes, and contact

If a concern relates to a School-controlled record, contact the School first. You may also email privacy@tanfit.org with “Privacy complaint” in the subject line. Describe the concern and how we can contact you. We will acknowledge the complaint, investigate it, aim to respond within 30 days, and explain if more time is reasonably needed.

If you are not satisfied, you may contact the privacy or data-protection authority in your location. In Australia, this is the Office of the Australian Information Commissioner.

We may update this policy when the Service, our providers, or legal obligations change. We will publish the revised policy with a new effective date and give Schools reasonable notice of material changes where practicable.

For privacy matters, email privacy@tanfit.org. For general support, use the TAN FIT contact page.