Privacy notice
Privacy & health data notice
NAIG is a sporting event organizer collecting health information to keep participants safe on-site. This application is not a HIPAA-covered entity under U.S. law, but we treat the health information collected on Step 3 of registration (allergies, medical conditions, medications, dietary restrictions) with HIPAA-style safeguards.
How we protect your data
- Data minimization: Step 3 offers explicit "I have no allergies / conditions / medications" checkboxes and a curated multi-select for common allergies and dietary needs, so you only enter what's needed.
- Purpose limitation & consent: A consent checkbox on Step 3 explicitly authorizes use of the data by event organizers and on-site medical staff for the limited purpose of providing care during the event.
- Encryption in transit and at rest: All traffic uses HTTPS/TLS; health data is stored encrypted in our Supabase Postgres database.
- Access control: Database row-level security restricts each participant's record to themselves; only designated organizers and on-site medical staff have access for event operations.
- No sensitive data in logs: Health fields are never logged on the client.
- Minimized echo: The final review step does not display your health information back on screen.
What we collect
- Allergies from a curated list, plus optional "Other" free-text.
- Medical conditions (free text, max 500 chars) or "none" confirmation.
- Medications (free text, max 500 chars) or "none" confirmation.
- Dietary restrictions from a curated list, plus optional "Other" free-text.
- An explicit consent record.
What we do not collect
- Diagnoses, treatment plans, healthcare provider names, or insurance information.
- Family medical history.
- Biometric or genetic data.
Retention
Submitted registrations are retained for the duration of the event cycle and are subject to the NAIG 2027 organizing committee's data retention policy. Draft registrations are deleted on submission.
Support requests and attachments
When you use the public support form, we collect your name, email address, optional phone number and region, and the message you provide so the support team can respond. The public form does not accept file uploads. If a file is needed, support will provide an authenticated follow-up path rather than asking you to send it with this form.
A support request may be opened through a secure ticket link sent to the email address provided. Treat that link like a password: it gives access to the request and its messages, so do not forward it.
Authenticated requesters and support staff can attach supported files to an existing ticket. Those files are stored in private support storage and are available only as part of that ticket to people who are authorized to access it. Share only information needed to resolve the request; do not include sensitive personal, health, legal, or other unnecessary information in messages or files.
Reporting a concern
If you believe your health data has been mishandled, please contact the NAIG 2027 organizing committee through the channel listed on the official event site.