Data Protection at TrueMind
Edge collects voice from players, many of them under 18, inside academy environments. That sets the bar high. This is our data protection policy in full, published so a club's Data Protection Officer can read our position before anyone signs anything.
01 · Roles and ownership
This is the single most important thing on this page. The club decides why and how player data is processed. TrueMind processes it only on the club's documented instructions, as set out in the Data Processing Schedule that forms part of every agreement.
The football club or organisation deploying Edge determines the purpose and the means of processing, including where the player is a minor. The club holds the lawful basis and is responsible for the notices and consents that sit behind it.
TrueMind Intelligence Ltd processes personal data only on the club's documented instructions. We do not decide what the data is used for and we do not repurpose it.
Edge is a mental performance platform. It does not produce medical, psychological or clinical assessments, and its outputs must not be the sole basis for selection, disciplinary, welfare or contractual decisions.
Applicable law for our purposes means the UK GDPR, the Data Protection Act 2018, and, where the data subject is under 18, the ICO's Age Appropriate Design Code.
02 · What Edge collects
Edge is used by adult players and staff, and by academy players under 18. Every profile is flagged by age status at enrolment, based on date of birth. That flag governs consent and transparency obligations. It does not change the retention rule, which is the same regardless of age.
We collect the following:
03 · Retention and deletion
Nothing is held indefinitely unless it has been irreversibly anonymised. Everything else has a documented reason for existing and a point at which it goes.
| Data type | Retention | UK GDPR status |
|---|---|---|
| Raw audio and identifiable transcripts | Retained while the player is actively registered. Deleted within 90 days of departure, which covers final report compilation and the standard post-release dispute window, or within 30 days of a valid withdrawal or erasure request, whichever is sooner. Longer retention only with a specific documented reason. | Personal data. Full rights apply. |
| Derived features, archetypes and scores | Retained only while there is a documented, ongoing purpose. By default the same window as raw data above. | Personal data if attributable to a player via any retained reference, regardless of pseudonymisation. Full rights apply, including erasure. |
| Structured coach and player reports | Same as derived features above. Edge is a mental performance platform, not a safeguarding record system, and does not apply an extended safeguarding-length retention period to routine reports. | Personal data where player-identifiable. Full rights apply. |
| Aggregated, irreversibly anonymised data | Retained indefinitely. | Not personal data. This applies only where no key or reference exists, held by TrueMind or anyone else, capable of re-identifying an individual. |
The one fixed deadline, 30 days on a valid withdrawal or erasure request, reflects TrueMind's obligation under Article 12(3) UK GDPR to act on a data subject's rights request without undue delay and within one month.
04 · Pseudonymised and anonymised
The difference decides what rights a player has and how long we are allowed to keep anything. So it is worth setting out plainly.
A player's name is replaced with an internal ID, and a reference still exists somewhere that could reconnect it to that person.
Almost everything Edge produces falls into this category, because TrueMind always keeps an internal player ID against each record.
No one, TrueMind included, retains any key or index capable of linking the data back to a specific person.
This is the only category we can retain indefinitely without a specific, ongoing reason.
The distinction matters because UK GDPR treats the two differently. Pseudonymised data is still personal data. For as long as TrueMind holds it, a player can ask to access it, correct it, object to it, or have it erased. Anonymised data is not personal data.
05 · Cross-club data sharing
Raw identifiable voice is processed and stored within TrueMind's systems on a logically segregated, per-club basis. It is not accessed, shared or made available to any other club, and TrueMind does not hold or transfer it to the club itself.
Only irreversibly anonymised, aggregate-level data is pooled across clubs for benchmarking. Per-player pseudonymised records are not pooled. They remain personal data and stay within the originating club's control.
06 · Players under 18
For adults, profiling for performance and development purposes is carried out on ordinary legitimate interest or consent grounds. For players under 18, the Children's Code requires profiling to be off by default unless there is a compelling reason, with measures in place to protect against harmful effects.
Edge's compelling reason is the player-development purpose. The harm-mitigation measure is that outputs go to human coaching staff for interpretation. Edge does not make automated decisions about a child.
Parental or guardian consent is required for players under 18, and the club is responsible for obtaining and maintaining it. Adult players receive adult-appropriate, plain-English privacy notices. Players under 18 and their parents each receive notices pitched appropriately, one for a child and one for a parent.
07 · Safeguarding referrals
Edge is a mental performance platform. It is not designed or positioned as a child welfare or safeguarding case management system, and TrueMind does not hold itself out as the system of record for safeguarding concerns.
Where a session, response or report raises a safeguarding concern, our process is manual and takes place outside the Edge platform. The relevant material is captured, for example by screenshot, and sent directly to the club's Designated Safeguarding Lead. From that point the safeguarding matter is owned and recorded by the club in its own designated system, for example CPOMS, under the club's own safeguarding policy and retention practice.
TrueMind keeps its own record that a referral was made in its offline back-office files, not on the Edge platform. This is an internal TrueMind process, not a feature of Edge.
08 · Security, sub-processors and transfers
Personal data is encrypted in transit and at rest. Access is role-based and granted on a need-to-know basis. Reads and deletions are audit-logged, including for pseudonymised data. Staff are subject to confidentiality obligations and data protection training, and we maintain a documented incident response plan.
We name our sub-processors rather than describing them in the abstract. Our current sub-processors are OpenAI for transcription and signal analysis, AWS for storage, Redis and BullMQ for the processing queue, Vercel for frontend hosting, and our backend hosting provider. We maintain a current list and notify the club of any change with a reasonable opportunity to object.
Where a sub-processor transfers personal data outside the UK, for example to OpenAI in the United States, that transfer is made under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as applicable.
TrueMind notifies the club without undue delay, and in any event within 72 hours of becoming aware, of any personal data breach. Clubs may audit our compliance on reasonable notice.
09 · Rights and contact
All data subjects may exercise the ordinary UK GDPR rights: access, rectification, erasure, objection and portability. Those rights run over raw data and derived or pseudonymised data alike, for as long as we hold it.
Where the data subject is under 18, a parent or guardian may exercise these rights on their behalf, or the young person may do so directly where they have sufficient understanding. Anyone may also complain to the Information Commissioner's Office.
Michael Dowling-Fleet, Chief Operating Officer, is the named contact for all data protection matters relating to Edge.
Data protection enquiries · michael@truemindedge.ai
TrueMind Intelligence Ltd, 128 City Road, London EC1V 2NX. Company number 17047338.
This page is Part A of the TrueMind Edge Data Protection Pack. The full pack, which also contains the Data Processing Schedule and the Master Service Level Agreement, is provided to a partner club's Data Protection Officer on request.
Last updated. August 2026. Material changes will be communicated to active partners. For the standard website privacy policy, see Privacy Policy. For our safeguarding posture in academy settings, see Safeguarding.