Policies

Data Policies & Documents.

Last Updated
October 2026
Company
GoFathom Ltd
Company Number
14466293
ICO Registration
ZB631188
Contact
[email protected]

The documents that set out how GoFathom collects, protects and processes personal data, in one place. If you are an organisation reviewing GoFathom, or a parent with a question, and you cannot find what you need here, email [email protected].

Privacy Policy

How GoFathom collects, uses, stores and protects personal information. It covers who is responsible for which data, player profiles, wellbeing check-ins, assessments and leaderboards, media of children, AI processing, deletion timelines and your rights.

Read the Privacy Policy

Data Processing Agreement

The agreement between GoFathom and each organisation that uses it. It explains that the organisation is the controller of the information it records about its players, with GoFathom as its processor, and that the two are joint controllers of the player feed. It also sets out GoFathom’s security measures, our sub-processors, and how we handle breaches, international transfers and deletion.

Read the Data Processing Agreement

Data Protection Impact Assessment

Because GoFathom processes children’s data, including health information from wellbeing check-ins, we carry out a Data Protection Impact Assessment (DPIA) under Article 35 of the UK GDPR. It identifies the risks to players, parents and coaches, and the measures we take to reduce them. It was last revised in October 2026 to cover wellbeing check-ins, assessments and leaderboards, internal coach notes and AI processing.

The DPIA covers, among other risks:

  • unauthorised access to children’s data, including health information and media
  • inappropriate media
  • sharing of feed content between organisations
  • misuse of wellbeing information, and wellbeing concerns being missed
  • comparison between players through leaderboards
  • AI processing by a third party

Key safeguards include:

  • parental consent, given in the app at registration and withdrawable from the parent’s profile, and parental control, including over all media of a child
  • wellbeing check-ins that organisations choose to turn on, that parents consent to at registration, and that players complete only if they choose to, visible only to the player’s coaches and the organisation’s administrators (and its safeguarding lead if there is a safety worry), and never to other players or other organisations
  • wellbeing flags that prompt a coach to follow up, with nothing happening to a player automatically
  • leaderboards only where an organisation chooses them, showing only results from assessments the organisation has set up, and group averages only where at least three players have a result
  • access enforced in the database itself, encryption in transit and at rest, and private media storage
  • coach review of all AI-assisted content, and no training of AI models on GoFathom data

The full DPIA contains detailed security information, so it is not published. Organisations and regulators can request a copy from [email protected].

Google Data Processing Terms

GoFathom uses Google services for two things:

  • Gemini (paid API) for AI-assisted coaching: drafting reports, transcribing coach voice notes and analysing coaching media. Every piece of AI-assisted content is reviewed by a coach before it reaches a player’s feed.
  • Firebase to deliver push notifications.

Google processes this data on our behalf under its own data processing terms, which include Standard Contractual Clauses and the UK International Data Transfer Addendum for any processing outside the UK and EU. Google is contractually prohibited from using GoFathom data to train its AI models.