Effective Date: April 19, 2026  |  Last Updated: April 19, 2026  |  Version 2.0

1. Overview & Scope

This Notice of Privacy Practices describes how Sport Screening, operated by Phuel Sports Science ("Sport Screening," "we," "us") may use and disclose your protected health information (PHI) and how you can access that information. This notice applies to all services provided through the Sport Screening (screeningsports.com), including all client-specific and direct-to-consumer portals offering genetic testing, blood work panels, health assessments, and results delivery.

Sport Screening is required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations to maintain the privacy of your PHI, to provide you with this notice of our legal duties and privacy practices, and to follow the terms of this notice currently in effect.

2. Protected Health Information We Collect

We collect and maintain the following categories of PHI in connection with providing testing services:

Category	Examples	Purpose
Identifying Information	Full name, email address, date of birth, phone number, mailing address	Identity verification, communication, result delivery
Test Results	Blood panel results, genetic test outcomes, reference ranges	Clinical reporting, treatment support
Consent Records	Signed waivers, parental consent for minors, date/time of consent	Legal compliance, documentation
Provider Notes	Clinical observations, follow-up recommendations	Care coordination, clinical decision support
Appointment Data	Booking dates, locations, service types	Scheduling, operations

3. Special Categories of PHI

3.1 Genetic Information

Certain Sport Screening services (SRY gene testing, and in the future an expanded genetic panel) generate genetic information about you. Genetic information receives heightened protection under:

• HIPAA — genetic information is PHI and subject to all protections described in this notice;
• Genetic Information Nondiscrimination Act (GINA), 42 U.S.C. §2000ff — prohibits use of genetic information by health insurers and employers for underwriting or employment decisions;
• State genetic privacy laws in applicable jurisdictions (Florida, California, and others have specific provisions beyond GINA).

Sport Screening will never disclose your genetic information to health insurers, life insurers, disability insurers, long-term-care insurers, or employers without your explicit written authorization. We will never use genetic information for any purpose other than providing you the ordered test, delivering results to your ordering provider, and supporting your care — unless you separately authorize such use in writing.

Genetic samples themselves (e.g., biological specimens submitted to partner labs) are handled according to the specific lab's BAA and retention policy; the Sport Screening stores only the digital result, not the physical sample.

3.2 Information About Minors

Certain Sport Screening services serve minor athletes. For patients under 18:

• The account holder is a parent or legal guardian, who provides PHI on behalf of the minor and consents to testing;
• The portal enforces guardian-only access to results until the minor reaches the age of majority in their state of residence;
• We follow the stricter of federal or state rules governing parental access to minors' health records;
• We do not knowingly accept PHI directly from a child under 13; such data, if identified, is deleted promptly in accordance with the Children's Online Privacy Protection Act (COPPA).

At the age of majority, the patient may request transfer of account control. See §6 (Your Rights) for the request process.

3.3 Information We Do Not Collect

Sport Screening does not knowingly collect or process:

• Substance use disorder records protected under 42 CFR Part 2 (we do not operate a federally-assisted substance use disorder program);
• Mental health psychotherapy notes as defined by HIPAA §164.501;
• Immigration status, citizenship, religion, or sexual orientation beyond what is medically necessary for testing;
• Biometric identifiers (fingerprints, voiceprints, iris scans) beyond the email + password-less OTP authentication flow;
• Precise geolocation data from user devices (we do not use location services).

4. How We Use and Disclose PHI

4.1 Uses and Disclosures That Do Not Require Authorization

We may use or disclose your PHI without your written authorization for the following purposes:

• Treatment: We share test results with the ordering provider or physician so they can review and interpret results. For example, delivering blood panel results to a team physician listed on a consent form.
• Health Care Operations: We use PHI for quality assurance, auditing, and administrative functions necessary to run our testing services. This includes reviewing testing workflows and improving portal functionality.
• As Required by Law: We will disclose PHI when required to do so by federal, state, or local law, including court orders, subpoenas, or mandatory reporting obligations.
• Public Health Activities: We may disclose PHI to public health authorities for the purpose of preventing or controlling disease, injury, or disability as required by law.
• Health Oversight: We may disclose PHI to a health oversight agency for activities authorized by law, such as audits, investigations, or inspections.

4.2 Uses and Disclosures That Require Authorization

We will obtain your written authorization before using or disclosing your PHI for any purpose not described in this notice. This includes:

• Marketing communications
• Sale of PHI (Sport Screening does not sell PHI under any circumstances)
• Sharing PHI with athletic organizations, teams, schools, or governing bodies beyond the treating provider
• Research purposes

You may revoke any authorization in writing at any time. Revocation will not affect actions already taken in reliance on the authorization.

4.3 De-identified Data

We may use or disclose de-identified health information (information that does not identify you and cannot reasonably be used to identify you) for any purpose without restriction, in accordance with HIPAA de-identification standards (45 CFR 164.514).

4.4 Text Message (SMS) Communications

If you provide a mobile phone number and consent at sign-up, we use it to send you one-time verification codes (OTPs) by text message when you create an account or sign in. Providing a mobile number is optional; you may instead receive codes by email. The following applies to this program:

• Messages are transactional verification codes only — we do not send marketing or promotional text messages.
• Message frequency depends on your activity; messages are sent only in response to an account-creation or sign-in request you initiate.
• Message and data rates may apply, depending on your carrier and plan.
• You may opt out at any time by replying STOP to any message (you will then receive codes by email); reply HELP or contact info@screeningsports.com for help.
• We do not sell or share your mobile phone number or SMS opt-in information with third parties or affiliates for their marketing or promotional purposes. Mobile information is used solely to deliver the verification codes described above.

5. Minimum Necessary Standard

When using, disclosing, or requesting PHI, Sport Screening applies the minimum necessary standard. This means we limit access to only the PHI reasonably necessary to accomplish the intended purpose.

• Role-based access: The Sport Screening enforces three role levels — patient, provider, and admin — each with access limited to the minimum data required for their function.
• Patients see only their own records and test results.
• Providers see only the records of patients assigned to them or their organization.
• Administrators have operational access for system management; access is logged and auditable.
• Internal staff receive training on the minimum necessary standard and are required to follow it.

6. Your Rights Regarding PHI

6.1 Right to Access

You have the right to inspect and obtain a copy of your PHI maintained by Sport Screening. This includes test results, consent records, and provider notes. Requests may be submitted to the contact information below. We will respond within 30 days of your request.

6.2 Right to Amend

You have the right to request an amendment to your PHI if you believe it is inaccurate or incomplete. We may deny the request if the information was not created by Sport Screening, is not part of the records we maintain, or is already accurate. We will respond within 60 days.

6.3 Right to Restrict

You have the right to request a restriction on certain uses and disclosures of your PHI. Sport Screening is not required to agree to all restriction requests, but if we do agree, we will honor the restriction except in emergency circumstances.

6.4 Right to an Accounting of Disclosures

You have the right to receive an accounting of disclosures of your PHI made by Sport Screening during the six years prior to the date of your request (or from April 2, 2026, whichever is more recent). This accounting will not include disclosures made for treatment, payment, or health care operations, or disclosures authorized by you. The Sport Screening maintains audit logs that support this right.

6.5 Right to Request Confidential Communications

You have the right to request that we communicate with you about your PHI by alternative means or at alternative locations. For example, you may request that we contact you only by email rather than by phone.

6.6 Right to Deletion

You have the right to request deletion of your PHI from the Sport Screening. Upon verification of your identity, we will delete your PHI from our active systems, including associated records in our database. Note that certain records may be retained as required by law, regulation, or for legal defense purposes. Audit log entries reflecting prior access to your data will be retained for compliance purposes but will not contain your PHI after deletion.

6.7 Right to a Copy of This Notice

You have the right to obtain a paper or electronic copy of this notice at any time by contacting us at the information provided below.

6.8 Right to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with Sport Screening or with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be retaliated against for filing a complaint.

7. How We Protect Your Information

Sport Screening employs administrative, physical, and technical safeguards to protect your PHI. Key measures include:

• AES-256 encryption for all PHI at rest (database, backups, object storage)
• TLS 1.2+ for all data in transit, with HSTS preload
• Passwordless authentication with time-limited, single-use verification codes stored as HMAC-SHA256 hashes (not plaintext) with constant-time comparison
• Automatic session timeout after 15 minutes of inactivity; server-side tokens expire after 24 hours
• Comprehensive audit logging of all authentication events and PHI access, retained for one year
• AWS CloudTrail multi-region with DynamoDB and S3 data events — independent audit trail at the infrastructure layer
• Role-based access controls enforced at the application layer; no shared accounts; no email-based allowlists
• Web Application Firewall with AWS managed rule sets (OWASP common threats, known bad inputs, SQL injection detection) and rate limiting
• Daily encrypted backups (35-day retention) + point-in-time recovery on all PHI tables
• S3 versioning on all buckets for object-level recovery
• Documented Incident Response Plan and Data Recovery Runbook, tested annually

For a current, detailed view of our technical controls, see our public Trust & Security page. Our internal Security Policy and Risk Assessment are available to auditors on request.

8. Breach Notification

In the unfortunate event of a Breach of Unsecured PHI as defined by 45 CFR §164.402, Sport Screening will:

• Notify affected individuals within 60 days of discovery of the breach, by first-class mail to the last known address (or by email where agreed). Notification will describe what happened, what PHI was involved, what we are doing in response, and what steps you can take to protect yourself.
• Notify the U.S. Department of Health and Human Services Office for Civil Rights (OCR) per HIPAA requirements — immediately for breaches affecting 500+ individuals, or annually for smaller breaches.
• Notify prominent media outlets in the affected state if the breach affects more than 500 residents of that state.
• Maintain a breach log retained for at least six years.

Our Incident Response Plan defines specific roles, containment procedures, and evidence preservation steps. Incident response is tested at least annually via tabletop exercise.

Report a suspected incident or breach: info@screeningsports.com.

9. State Privacy Law Addendum

Some U.S. states grant privacy rights beyond HIPAA. Where applicable, those laws apply to you in addition to this notice. The following summarizes state-specific additions; where state law conflicts with HIPAA, the more protective rule applies.

9.1 California (CCPA / CPRA / CMIA)

California residents have rights under the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA). However, PHI governed by HIPAA is generally exempt from CCPA. For any personal information we hold about you that is NOT PHI (e.g., marketing contact information you provided outside the clinical context), California residents have the right to know, delete, correct, and limit use of sensitive personal information.

The California Confidential Medical Information Act (CMIA) provides additional protections for medical information and is applied where it grants rights beyond HIPAA.

We do not sell or share personal information for cross-context behavioral advertising under CPRA definitions.

9.2 Other States

Residents of Colorado (CPA), Connecticut (CTDPA), Virginia (VCDPA), Utah (UCPA), Texas (TDPSA), Florida (FDBR), Oregon (OCPA), and other states with comprehensive privacy laws may have additional rights regarding personal information that is not HIPAA-protected PHI. Submit requests to info@screeningsports.com.

9.3 Genetic Privacy Laws

Florida (F.S. 760.40), California (Genetic Information Privacy Act), and several other states have laws specifically regulating genetic information. Where applicable, these laws require explicit written authorization for certain disclosures beyond HIPAA's baseline and provide additional remedies for unauthorized disclosure. Sport Screening applies these heightened standards to all patients regardless of state of residence.

10. International Users & Data Transfers

The Sport Screening is designed for and operated in the United States. All PHI is stored and processed in the United States (AWS us-east-1 region). We do not actively solicit patients outside the United States.

If you access the portal from outside the United States, your information will be transferred to, stored, and processed in the United States. U.S. privacy laws, including HIPAA, will apply. If you are in a jurisdiction (e.g., EU/EEA, UK) with stronger local privacy laws, those laws may not apply to your data once it is transferred to the United States.

11. Changes to This Notice

Sport Screening reserves the right to change the terms of this notice at any time. Changes will apply to all PHI we maintain. The revised notice will be posted on the Sport Screening and will be available upon request. The effective date will be updated accordingly.

12. Contact Information

Sport Screening maintains distinct contact channels for different privacy / security matters:

Purpose	Email	Expected response
HIPAA privacy rights (access, amend, delete, accounting)	info@screeningsports.com	Within 30 days (HIPAA standard)
State privacy law requests (CCPA, CPRA, etc.)	info@screeningsports.com	Within 45 days
BAA requests from covered entities	info@screeningsports.com	Within 3 business days
Suspected breach or unauthorized access of PHI	info@screeningsports.com	Within 24 hours
Security vulnerability reports (researchers)	info@screeningsports.com	Within 3 business days (per disclosure policy)

HIPAA Privacy Officer
Phuel Sports Science
Email: info@screeningsports.com
Portal: screeningsports.com
Trust center: screeningsports.com

You may also file a complaint directly with:

U.S. Department of Health and Human Services
Office for Civil Rights
www.hhs.gov/ocr/complaints
Toll-free: 1-877-696-6775

You will not be retaliated against for filing a complaint with Sport Screening or OCR.