1. Who we are
Goal Health Ltd is a UK-registered company providing epigenetic testing and performance optimisation services to elite football organisations. Our registered office is in London, England. We act as the data controller for all personal data collected through our laboratory and clinical services.
2. What data we collect
We collect and process only the data necessary to deliver our services. This includes:
- Biological data: DNA methylation profiles, miRNA expression data, histone modification markers, and derived biological age estimates from saliva or blood samples.
- Health and performance data: Injury history, training load records, nutritional intake, sleep metrics, and recovery markers provided by the club or player.
- Identity data: Name, date of birth, contact details, and club affiliation, collected solely for service delivery and reporting.
- Technical data: IP addresses and browser information when you use our secure client portal.
3. How we use your data
We process personal data for the following lawful bases under Article 6 UK GDPR:
- Contractual necessity: To perform our epigenetic testing and clinical advisory services under agreement with the club or player.
- Legitimate interests: To improve our testing panels, validate methodologies, and publish anonymised research, always with player consent and never in an identifiable form.
- Legal obligation: To comply with WADA anti-doping regulations, UK health and safety law, and statutory reporting requirements.
- Consent: Where explicit consent is required for research participation or data sharing beyond the core service.
4. Data ownership and player rights
Goal Health Ltd operates a player-first data model. The biological data generated from a player's sample remains the property of the player, not the club. Players retain the following rights at all times:
- The right to access their full epigenetic report and raw data.
- The right to request deletion of their data (subject to legal retention periods).
- The right to restrict processing or object to research use.
- The right to data portability in a standard machine-readable format.
- The right to withdraw consent for research participation at any time.
Clubs receive only the analysed, actionable insights agreed in the service contract. Raw genetic or epigenetic data is never shared with clubs without explicit player consent.
5. Data security
We employ enterprise-grade security measures:
- All biological samples are processed in our private London laboratory under ISO 27001-aligned information security protocols.
- Genetic data is stored on encrypted servers with AES-256 encryption at rest and TLS 1.3 in transit.
- Access is restricted to named laboratory and clinical personnel bound by confidentiality agreements.
- We conduct annual penetration testing and third-party security audits.
- Biological samples are destroyed after analysis unless the player explicitly consents to long-term storage for longitudinal monitoring.
6. Data retention
We retain personal data only for as long as necessary:
- Active clients: Data retained for the duration of the service agreement plus 7 years for medical and legal compliance.
- Research data: Anonymised datasets may be retained indefinitely for scientific validation, provided all identifiers have been irreversibly removed.
- Withdrawal: Upon service termination or player request, identifiable data is deleted within 30 days unless legal obligations require retention.
7. Third parties and international transfers
We do not sell personal data. We share data only with:
- The player's registered club, under the terms of the service contract and with player consent.
- Accredited research institutions, in fully anonymised form for peer-reviewed publication.
- Regulatory bodies, where legally required (e.g., WADA, UK Anti-Doping, Information Commissioner's Office).
All data processing occurs within the United Kingdom. We do not transfer personal data outside the UK unless adequate safeguards (UK adequacy decisions or Standard Contractual Clauses) are in place.
8. Cookies and tracking
Our website uses only essential cookies necessary for security and functionality. We do not use third-party analytics, advertising cookies, or tracking pixels. No behavioural profiling occurs.
9. Your rights and how to exercise them
To exercise any of your data protection rights, or to raise a concern about how we handle your data, please contact our Data Protection Officer:
Email: info@goalhealth.co.uk
Post: Goal Health Ltd, Data Protection Officer, London, United Kingdom
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).
10. Changes to this policy
We may update this privacy policy to reflect changes in law or our services. Material changes will be notified to all active clients and published on this page with an updated date.