Privacy policy

This policy covers two different things: this website (getkaha.app), and the club platform — the separate site each Kaha club gets at its own web address, where athlete data lives. They collect very different information, so we've kept them apart below.

We handle personal information under the Australian Privacy Act 1988 and the New Zealand Privacy Act 2020. Where the two differ, we apply the stricter one.

1. This website

Trial and demo requests

If you fill in the trial form, we collect your name, email address and club name, and — if you choose to give them — your preferred web address, sport, squad size and whatever you write in the message box. We use it for one purpose: to contact you about setting up a trial. We don't sell it, and we don't send marketing to people who didn't ask for it.

Those enquiries are stored separately from every club's data, and are only visible to us. If you'd like yours deleted, email us and it's gone.

Analytics and cookies

This site uses Google Analytics 4 to understand how people find us and which pages are useful, and to measure our advertising. It sets cookies in your browser and shares your IP address and browsing activity on this site with Google. You can opt out with Google's browser add-on, or by blocking cookies in your browser — the site works fine either way.

Analytics never runs on club sites. Google Analytics is loaded on this marketing site only. Athlete pages, wellness entries, injury records and test results are never sent to Google or any other analytics provider.

2. The club platform

Each club has its own site and its own database, isolated from every other club. The club decides what it records. Depending on how they use Kaha, that can include:

• Identity and contact — name, preferred name, date of birth, gender, email, phone, playing position.
• Physical measurements — height, weight, sitting height, reach.
• Growth and maturation — estimated biological age, peak height velocity, maturity stage.
• Performance — test results over time, coach ratings, and any video clips the club uploads.
• Wellness — self-reported sleep, soreness, stress, mood and perceived exertion, plus any notes.
• Injuries — injury records kept by the club.

Some of this is health information, which gets stronger protection than ordinary personal information under both Australian and New Zealand law. We treat all of it that way.

Who's responsible for what

The club decides what to collect and who at the club can see it. We provide and host the software, and we hold the data on the club's behalf. We do not use athlete data for our own purposes — we don't mine it, sell it, share it, or train anything on it. We access a club's data only to keep the service running or when the club asks us for support.

Young athletes

Many athletes on the platform are under 18, and the growth and maturation features exist specifically to support adolescents. Clubs are responsible for obtaining consent from a parent or guardian before recording a young person's information, and for explaining to them what's being collected and why.

If you're a parent or guardian and want to see, correct or remove your child's information, contact the club first — they control it. If you can't get anywhere, contact us and we'll help.

3. Where your information is stored and who else sees it

Data is hosted on Amazon Web Services infrastructure in Sydney, Australia. Email — one-time login codes, notifications — is delivered through Amazon Simple Email Service. Google Analytics receives marketing-site traffic data, as described above.

Those are the only third parties involved. We don't sell personal information to anyone, and we don't share it for anyone else's advertising.

4. Keeping it safe

Every club's data sits in its own isolated database. Traffic is encrypted in transit. Passwords are hashed, never stored in readable form, and athlete access is by one-time code sent to a verified email address rather than a password.

If a breach happens that's likely to cause serious harm, we will notify the affected people and the relevant regulator — the Office of the Australian Information Commissioner, or the New Zealand Privacy Commissioner — as required.

5. How long we keep it

Club data is kept for as long as the club uses Kaha. If a club leaves, we'll return or delete its data on request, and delete it in the ordinary course once the account is closed. Trial enquiries are kept only as long as they're useful, and deleted on request.

6. Your rights

You can ask us what personal information we hold about you, ask for it to be corrected, and ask for it to be deleted. Email the Privacy Officer below and we'll respond promptly — within 20 working days at the outside.

If you're unhappy with how we've handled your information, tell us first and we'll try to fix it. If that doesn't resolve it, you can complain to the OAIC in Australia or the Privacy Commissioner in New Zealand.

7. Contact

Privacy Officer
GetKaha
hello@getkaha.app

Last updated July 2026.