Privacy Policy

1. Who runs SportSlip

SportSlip is a service operated by SickSlip, Inc., a Delaware corporation. Our headquarters is 8605 Santa Monica Blvd, Suite 227120, West Hollywood, CA 90069. Clinical services are provided by SickSlip P.A., a Florida professional association. The physician-of-record on all SportSlip clearances is Adam Z. Kawalek, MD (NPI 1326223306; licensed in 29 U.S. states — see About Dr. Kawalek for the full list).

2. What we collect

To complete a sports physical clearance for your child we collect:

• Identity: child's name, date of birth, sex; parent/guardian name, email, phone, relationship to the child; emergency contact name + phone.
• Activity context: the sport, organization, school, camp, or league the clearance is for; the state where the child lives.
• Health information: answers to our 29-question pre-participation screening (AAP PPE-5 + AHA 14-element cardiovascular history); height, weight, blood pressure, heart rate; allergies, current medications, prior injuries, prior concussions, family history of cardiac conditions.
• Telehealth artifacts: a 30-second video of your child performing musculoskeletal movements; a photo or PDF of your camp/school's PPE form; a photo of the child's immunization card.
• Optional ECG: if you add the ECG cardiac-rhythm screen, the exported reading from your device (Apple Watch, Galaxy Watch, Kardia, Fitbit, Withings).
• Payment: Stripe processes card information; we never see or store your card number. We retain the Stripe payment intent ID and the last four digits of the card.
• Operational data: IP address, user agent, timestamps on consent, audit logs of access to the medical record.

3. How we use it

Everything above is used for the single purpose you provided it for: giving your child a physician-reviewed sports/camp/school clearance.

Specifically:

• Dr. Kawalek reviews the chart + uploads + video + (optionally) ECG and decides whether to clear or refer.
• Our AI-assisted form-fill tool reads your camp's PPE form and pre-fills our PDF generator so the issued letter matches what your camp requires.
• The signed clearance PDF is emailed to you.
• A QR code on the PDF lets camp/school staff verify the clearance via our verify endpoint without exposing your child's clinical detail.
• We send PHI-free transactional emails ("your clearance has been updated, open dashboard") for status changes + amendment requests + thread messages.

4. Who we share it with

Information is not sold, rented, or shared with marketing partners. The third parties involved in delivering the service are:

• Supabase — database + file storage for the medical record.
• Resend — transactional email delivery.
• Stripe — payment processing.
• Anthropic — AI form-fill and screening categorization (Claude Vision).
• Twilio — SMS reminders (currently disabled pending verification).
• Render / Vercel — hosting infrastructure.
• Sentry — error monitoring with PHI scrubbing.

Each of these is contractually bound to handle protected health information in line with the same standards we apply (see our HIPAA Notice for details).

We disclose information only as required by law — for example in response to a subpoena, court order, or to report a public-health threat. Our internal disclosure log records every release of PHI for defensibility.

5. Your rights

• Access: request a copy of everything in your child's record at any time by emailing adam@sportslip.co. You can also download issued PDFs from your dashboard whenever.
• Amendment: request a change to the record if something's wrong. Dr. Kawalek reviews + accepts or declines with a reason. See HIPAA Notice §5 for the workflow.
• Deletion: request deletion of the account + record. We honor on a case-by-case basis after verifying identity. Retention floor: per the medical-records statute of your state of residence. As a baseline applied to all customers regardless of state, we retain records until the patient reaches age 25 or 7 years post-last-encounter (whichever is longer) for minors — meeting or exceeding the Massachusetts standard. State-specific overrides apply (e.g., Texas has longer minimum retention for minors).
• Withdraw consent: revoke consent for telehealth at any time by emailing us. We will stop providing the service and refund unconsumed fees.
• Opt out of marketing: we don't do marketing emails. If we ever start, every email will have an unsubscribe link.

6. Children's privacy (COPPA)

SportSlip serves children 5–18 but they don't use the platform directly — a parent or legal guardian creates the account, provides the information, and consents on the child's behalf. We do not knowingly collect information directly from children under 13. If you believe a child contacted us without parental consent, email adam@sportslip.co and we will investigate + delete.

7. Security

All data in transit uses TLS 1.2+. All data at rest is AES-256 encrypted by our infrastructure providers. Access controls are documented in our internal security posture (HIPAA Notice §3). We have an incident response playbook for breach events (Breach Policy).

8. State-specific rights

California residents have additional rights under CMIA + the California Consumer Privacy Act. Massachusetts residentsare covered by M.G.L. ch. 111 § 70E and the state breach notification statute. Other states have their own analogs. To exercise any state-specific right, email adam@sportslip.co with your request and your state of residence — we'll respond per that state's rules.

9. Changes to this policy

We update this page when our practices change. Material changes will be communicated by email to active customers. The "Last reviewed" date at the top of this page tracks the most recent update.

10. Contact

Privacy questions: adam@sportslip.co. Phone: (833) 549-6401.