DPIA Summary

Organisation: STRIIDE SPORTS LTD
Company number: 16734879
ICO registration: ZC112376
Privacy contact: privacy@striide.app
Service: StriideAi
Review date: 26 September 2026
Next review date: 26 September 2027
Owner: Data Protection Lead, privacy@striide.app

1.1 Why StriideAi maintains a DPIA

StriideAi is used by athletes, including children and young people aged 8–16, and includes:

• personalised sports training;
• age- and level-appropriate recommendations;
• user-uploaded practice video;
• parent/guardian approval;
• AI-supported recommendations;
• technical monitoring;
• payments and account services.

Because some of these activities involve children, profiling/personalisation, identifiable media and AI-supported processing, StriideAi maintains a Data Protection Impact Assessment.

The DPIA is used to identify and reduce privacy risks before and during product use.

---

1.2 Main processing purposes

StriideAi processes information to provide:

• user accounts;
• age-appropriate training;
• sports-development recommendations;
• training history and progress;
• practice-video functionality;
• coach review where enabled;
• AI-supported sporting recommendations;
• subscriptions and payments;
• customer support;
• fraud/abuse prevention;
• platform security and reliability.

---

1.3 Main categories of information

Depending on the features used, StriideAi may process:

• name;
• email;
• avatar;
• age range;
• parent/guardian approval status;
• sporting skill level;
• playing role;
• playing experience;
• training goals;
• practice-video footage;
• training history;
• support communications;
• device/technical information;
• payment/subscription identifiers;
• AI interaction data;
• security/audit metadata.

---

1.4 People affected

The processing may affect:

• children and young athletes;
• adult athletes;
• parents and guardians;
• coaches/instructors;
• users contacting support.

Children receive additional consideration because of age, vulnerability and developmental needs.

---

1.5 Data-minimisation design decisions

StriideAi's design aims to minimise unnecessary collection.

Key decisions include:

• use of avatars where practical;
• collection of age/age-range information only where needed for suitability;
• limited sports-development information;
• parent/guardian approval for users aged 8–16;
• no sale or rental of personal information;
• no advertising-driven profiling of children;
• no deliberate inclusion of direct identifiers in the current AI recommendation payload;
• practice video kept separate from the current OpenAI recommendation workflow;
• defined retention and deletion periods;
• reduced PII in technical logs.

---

1.6 Main risks and controls

Risk	Potential impact	Current control
Excessive data collection about children	Unnecessary intrusion	Data-minimisation review, limited profile design
Personalisation inappropriate for age	Unsuitable recommendations	Age-aware design, age range and level controls
AI receives unnecessary identifiers	External disclosure	Direct identifiers excluded from intended payload, PII scrubbing
User enters sensitive information into AI	Accidental disclosure	Warning text, validation and PII reduction
Practice videos identify minors	Privacy/safeguarding risk	Controlled storage, restricted access, 30-day maximum retention
Data retained too long	Increased exposure	Defined retention schedule and automated deletion/lifecycle controls
Incomplete account deletion	Residual personal information	Cascaded deletion, media cleanup, backup expiry
Unauthorised production access	Confidentiality breach	MFA, named accounts, least privilege, access review
Third-party misuse	Loss of control	Vendor due diligence, contractual safeguards, provider register
International transfer without safeguards	Reduced legal protection	Transfer mapping and approved UK transfer safeguards
Security incident not escalated	Delayed containment/notification	Formal incident-response and breach process
Unclear school roles	Governance ambiguity	Deployment-specific controller/processor assessment and DPA where required
Diagnostic tools capture too much PII	Unnecessary disclosure	PII reduction/scrubbing and logging review

---

1.7 AI-specific assessment

StriideAi's current AI recommendation processing:

• is handled through the StriideAi backend;
• uses OpenAI commercial API services;
• excludes direct identifiers from the intended payload;
• uses only relevant sporting context;
• applies input validation and PII reduction;
• is not used for legal or similarly significant decisions;
• does not send current practice videos to OpenAI;
• is subject to provider, retention and transfer review.

Residual AI risk is reviewed whenever:

• the provider changes;
• a new model is introduced;
• a new type of personal information is used;
• video/image analysis is introduced;
• recommendations become more consequential.

---

1.8 Children's interests

The DPIA considers the best interests of young users by examining:

• whether collection is necessary;
• whether privacy settings are appropriately protective;
• whether children understand the use of their information;
• whether the service encourages unnecessary disclosure;
• whether profiling is proportionate;
• whether retention is justified;
• whether parents/guardians have an appropriate role;
• whether the service creates any unfair commercial or behavioural pressure.

StriideAi's intended benefit is sporting development, not behavioural advertising or unrelated profiling.

---

1.9 Residual risk conclusion

Following the controls described above, StriideAi's identified privacy risks are considered reduced to a level appropriate for the intended service, subject to:

• ongoing monitoring;
• periodic DPIA review;
• provider review;
• security testing;
• deployment-specific assessment for schools or institutions where needed.

The full internal DPIA contains additional technical and operational detail and can be shared with appropriate institutional reviewers under controlled disclosure where justified.

---