Roles and permissions

Institution administrator

Manages memberships, groups, assignments and operations within current authorization. The first super admin controls branding. Administration does not grant universal access to private conversations or health details.

Trainer / coach

Works with currently assigned athletes, programs, attendance, groups and tasks. Current membership and responsibility govern access. Coaches see only authorized current participation status, not injury details.

Athlete

Uses assigned training, records own activity and accesses own authorized records. Diary sharing is explicit; personal data does not automatically become a staff resource.

Boundaries

Each institutional membership has one role. Legacy combined roles and standalone coach routes are retired from the web experience. Server checks and resource scope enforce permissions. No health-staff role or hidden universal administrator is promised.

Limited participation status

The implemented participation-status workflow is athlete-authored and non-diagnostic. After the institution records the required consent prerequisites and the athlete assents, the assigned coach can see only the current authorised participation status and effective date. It does not grant access to diagnoses, treatment, attachments or clinical history.

Administrators manage the prerequisites rather than reading injury records; there is no health-staff role in the accepted v1 scope. The athlete can review, correct, close and export their own status/history through the supported workflow. Withdrawal stops coach visibility and new entries. The current product rule deletes closed record content and linked history/audit after 12 months, with a non-identifying aggregate cleanup checkpoint; deployment alert delivery still needs verification.

This gives an institution a deliberately narrow way to communicate an athlete’s permitted participation status without turning general administration into medical-record access. It is not medical advice or a replacement for university consent, safeguarding and privacy/security approval. Do not put clinical details in messages, tasks or ordinary session notes to work around these limits.

Source and scope

Reviewed against the maintained local university branch on 17 October 2026. docs/requirements/README.md.