In professional football clubs and academies, health information moves fast — often across channels never designed for special-category personal data. Sending a muscle injury diagnosis over consumer chat apps or storing medical notes in a shared drive violates both medical confidentiality and GDPR Article 9.
At the same time, player unions and FIFPRO’s global data standards emphasize transparent, consent-based governance and data portability for professional footballers. A dedicated medical data platform protects both the player and the club.
Club as Controller, Omen as Processor, and strict role-based separation
Under GDPR, the football club remains the Data Controller while Omen acts as Data Processor under a formal Data Processing Agreement (DPA). Omen enforces four technical safeguards out of the box:
- Field-level role-based access control: coaches see availability status and training constraints, never confidential clinical diagnoses or imaging reports.
- Immutable access and modification audit log: every view, entry, protocol edit and sign-off is timestamped and tied to an authenticated staff member.
- Western European hosting and encryption: application servers and databases run in EU West (europe-west4, Netherlands) with encryption in transit and at rest, plus consent-gated analytics in Frankfurt (PostHog EU).
- Data portability and retention controls: structured player record export on request and club-defined retention schedules.