1. Health data collected and its purposes

Arena's participant-management and registration features can collect allergies, medications, medical conditions, medical notes, health-insurance information and insurance-card images, and documents containing health information. Associated identifiers, participant age, emergency-contact details, registration context, acknowledgements, and records of access may also be consumer health data when linked to health information.

We use this information to maintain the participant's requested health and emergency profile; make relevant information available in authorized program and medical workflows; process requested insurance or document submissions; record the information or consent confirmed for a registration; and support appropriate safety, security, and request-handling functions. A message or uploaded attachment can also contain health information if a user supplies it, even outside a designated medical field.

Collection, use, and sharing are limited to the consent or other authorization required by the law that applies. Where the law permits processing necessary to provide a product or service you requested, that exception is limited to what is necessary for that request. When Washington law requires consent, consent to sharing must be separate from consent to collection and obtained before the corresponding processing. Agreeing to platform terms does not supply those permissions. Before collecting, using, or sharing additional categories or using health data for additional purposes, we will provide the disclosure and obtain the affirmative consent required by applicable law.

2. Sources of health data

Sources include you; a parent, guardian, or other authorized family manager; a host or staff member entering information for an authorized program workflow; documents uploaded by those people; and records produced when Arena stores, confirms, reviews, or grants access to that information. Health-related details can also be supplied in a support request, report, message, or other user submission.

3. Categories shared and recipients

Relevant health-profile, emergency, document, insurance, acknowledgement, and associated identity information may be disclosed to family managers with the appropriate access, the responsible host organization and staff authorized for the particular medical or document workflow, and the recipient you specifically direct to receive it. A general check-in or roster role is not general permission to view medical information. Authorized medical exports can create copies held by the organization.

Infrastructure and database providers process the health information stored in Arena. Cloudinary processes uploaded insurance images or other health-containing documents handled through its storage services. If you put health information in a message, attachment, support request, or email, the relevant communication or storage providers and intended recipients may also receive it. Do not include unnecessary health details in general communication channels.

Authorized personnel and service providers may process health information for necessary security, support, legal compliance, or request fulfillment subject to applicable restrictions. Relevant information may be disclosed to emergency responders or authorities where legally authorized or required. Routine marketing, referral, sponsorship, and public-discovery access does not authorize health-record access.

Any future sharing with an affiliated company will require an update identifying that company and any consent required by applicable law. This notice does not authorize a sale of consumer health data. Any such sale requires the separate valid authorization and other conditions imposed by applicable law; general promotional or AI permissions do not supply that authorization.

4. Access, withdrawal, and deletion requests

Email hello@arenasports.space with the subject Health Privacy Request, or write to the mailing address below. Identify the person and requested action without sending unnecessary medical details. We may verify your identity and authority through a secure process. You do not need to create a new account to request assistance.

Where Washington law applies, you may confirm processing, access your consumer health data and the required recipient list with contact methods, withdraw collection or sharing consent, and request deletion. We respond without undue delay, within 45 days of receipt; verification does not restart that deadline. One additional 45-day extension is available when legally justified and explained within the initial period. Information is free up to twice annually, subject to the law's exception for manifestly unfounded, excessive, or repetitive requests.

For a covered Washington deletion request, we delete the applicable records and notify the affiliates, processors, contractors, and other recipients required by law. Deletion from archives or backups may be delayed only as permitted, for no more than six months after authentication. Account recovery does not replace these duties. Withdrawing consent can limit features that depend on that processing, but we will not unlawfully discriminate against you for exercising your rights.

An authorized parent, guardian, or agent can contact us about information they are legally entitled to manage. A host may also hold records independently; we will assess any duty to notify it rather than treating its separate copy as automatically deleted. Rights, exceptions, and verification requirements under other applicable health privacy laws remain available.

• Email a health privacy request

5. Appealing a request decision

If we decline a request, email the same address with the subject Health Privacy Appeal and identify the decision. Where Washington's appeal provisions apply, we will give a written decision and explanation within 45 days. You may submit a complaint to the Washington Attorney General if the appeal is denied. Other applicable complaint and appeal rights are preserved.

• Email a health privacy appeal
• File a complaint with the Washington Attorney General

6. Changes to this notice

The Last updated date identifies this notice's current revision. We will explain material changes and obtain any required consent before a changed health-data practice begins. You can contact Arena for an accessible copy of this notice or help submitting a request. This notice supplements the general Privacy Policy; it does not reduce protections that applicable law provides.

• Arena Privacy Policy