Club Operating Agreement

This Club Operating Agreement ("Agreement") is between CurioCore, a company organized under the laws of {STATE}, {ADDRESS} ("Company"), and the club identified at sign-up ("Club"). It takes effect when an authorized representative of the Club accepts it in the Services or signs below (the "Effective Date"). It governs the Club's use of club features in Flowbase and SportsFlow.

1. Definitions

1.1 "Athlete" means an individual with an account who has joined the Club's roster.

1.2 "Athlete Data" means data about an Athlete in the Services, including training, results, wellbeing responses, scores, readiness indicators, wearable data, messages and FlowCoach interactions.

1.3 "Authorized Coach" means a person the Club designates as a coach in the Services.

1.4 "Club Data" means personal data the Club or its personnel upload or enter about individuals, including rosters, results, reservations, damage reports, event sign-ups and fundraiser details.

1.5 "Clinical Screens" means the WHO-5 and GAD-7 questionnaires.

1.6 "Designated Personnel" means the Wellbeing Lead, Backup Lead, After-Hours Contact and Designated Safeguarding Officer named in Schedule B.

1.7 "Prohibited Decision" means any decision about an Athlete's selection, seat racing, lineup, roster status, scholarship, award, competition entry, compensation, employment, discipline or other standing.

1.8 "Threshold Event" means a Clinical Screen result at or beyond the threshold in Schedule A.

1.9 "Services" means Flowbase, SportsFlow and FlowCoach as made available to the Club.

2. Access and Fees

2.1 Company grants the Club a non-exclusive, non-transferable right during the term to use club features and to let Authorized Coaches use the Services to support Athletes.

2.2 Club features are free. Fundraising carries the platform fee in Section 8. Paid features, if any, require the Club's separate agreement.

2.3 Each Athlete has their own contract with Company under the Terms of Service. The Club does not own or control any Athlete's account.

3. Club Responsibilities

3.1 Coaches. The Club shall: (a) designate as Authorized Coaches only people it has authorized to coach and who meet its governing body's screening, background check and safeguarding training requirements; (b) remove access within 24 hours after a person stops coaching for the Club or is suspended; and (c) be responsible for its Authorized Coaches' acts and omissions.

3.2 Athlete notice. Before an Athlete joins the roster, the Club shall give the Athlete the notice in Schedule C, including that readiness indicators are shared with coaches by default.

3.3 Club Data. The Club is responsible for the accuracy and lawfulness of Club Data, including having a lawful basis and giving any notices needed to upload rosters and publish results.

3.4 Club operations. Boat reservations, damage and safety reports and event tools are records aids. They do not replace the Club's safety procedures, equipment inspections or insurance.

4. Use Restrictions

4.1 No Prohibited Decisions. The Club shall ensure that no one acting for it uses wellbeing information, or its absence, withholding or revocation, as an input to a Prohibited Decision.

4.2 Permitted training use. Section 4.1 does not stop an Authorized Coach from using readiness indicators, training data and results, or wellbeing data an Athlete has chosen to share, to adjust training sessions. Training and performance results may be used for selection as the Club's normal practice allows.

4.3 No coercion. The Club shall not request, pressure, require or reward an Athlete to share more than the Athlete has chosen.

4.4 Other restrictions. The Club shall not export or distribute Athlete wellbeing data outside the Services, except safeguarding records under Section 6; access data not made available to it; attempt to re-identify aggregated or pod data; or use the Services unlawfully.

5. Minors

5.1 No Athlete under 18 may use the Services until a guardian approves the account.

5.2 All electronic communication between an Authorized Coach and a minor about the Services takes place in the Services, which copies each message to the guardian. Authorized Coaches shall not use private channels with minors.

5.3 The Club shall follow the Safeguarding Policy on media showing minors and shall remove content at a guardian's request.

6. Safeguarding

6.1 Designated Personnel. The Club shall name its Designated Personnel in Schedule B, keep it current, and update it within 5 business days of a change. One person may not be both Wellbeing Lead and Backup Lead. Each must be an adult who has completed SafeSport Trained core training or its national equivalent and acknowledged the Safeguarding Policy.

6.2 Activation. Clinical Screens are enabled only after this Agreement is accepted, Schedule B is complete, each Designated Person has acknowledged the Safeguarding Policy, and the Club has completed the tabletop exercise in the Safeguarding Policy. Company may disable them if these conditions stop being met.

6.3 Threshold Events. Company notifies the Wellbeing Lead that a Threshold Event occurred, without the score or answers, and notifies the Athlete at the same time. The Club shall respond under the Safeguarding Policy and shall not try to obtain the score or answers except as the Athlete chooses to share.

6.4 Records. The Club shall keep safeguarding records under its policy or, if none, the Data Retention Schedule. Athletes and coaches cannot delete them.

6.5 No monitoring. Company delivers notifications only. It does not assess, triage or respond to Threshold Events, and does not provide clinical, crisis or emergency services.

6.6 Legal duties. Nothing here limits the Club's obligations under law or its governing body's rules, including mandatory reporting. Where those are more protective, they prevail.

7. Results and Competitions

7.1 Results the Club uploads are published under the Terms of Service. The Club confirms it may publish them and will correct errors promptly.

7.2 The Club may enter leagues and challenges run by Company. League rules published by Company apply.

8. Fundraising

8.1 To run fundraisers, the Club must open a Stripe connected account and accept Stripe's Connected Account Agreement. Stripe pays funds to the Club.

8.2 Company charges a platform fee of 5% of each donation, deducted before payout, in addition to Stripe's processing fees.

8.3 The Club is solely responsible for each fundraiser's purpose and description, its use of funds, donor receipts, tax treatment, refunds, and compliance with charitable solicitation, gaming and tax laws in its jurisdiction.

8.4 Company may pause or remove a fundraiser that appears misleading, unlawful or unsafe.

9. Data Protection

9.1 Athlete Data. Company is an independent controller of Athlete Data held in Athletes' accounts.

9.2 Club Data. For Club Data, the Club is the controller and Company processes it on the Club's behalf under the Data Processing Addendum in Schedule E.

9.3 Safeguarding records. Once exported to the Club, safeguarding records are the Club's, as an independent controller.

9.4 Security incidents. Company shall notify the Club without undue delay, and within 72 hours, after confirming a security incident affecting its Athletes or Club Data.

10. Confidentiality

Each party shall use the other's non-public information only to perform this Agreement and protect it with at least reasonable care. This does not apply to information that is public, already known, independently developed or lawfully received from a third party. A party may disclose information when legally required, after notice where lawful.

11. Term and Termination

11.1 This Agreement continues until terminated.

11.2 Either party may terminate on 30 days' written notice.

11.3 Company may suspend access immediately, and terminate on notice, if the Club materially breaches Section 4, 5 or 6 and does not cure within 10 days, or at once if the breach cannot be cured or puts an Athlete at risk.

11.4 On termination: Authorized Coach access ends; Athletes keep their accounts and data; Clinical Screens stop for the Club's Athletes; Company provides an export of open safeguarding records and, on request made within 30 days, Club Data; open fundraisers close and pending payouts are completed through Stripe. Sections 4, 6.4, 8.3, 9, 10, 12, 13 and 14 survive.

12. Warranties and Disclaimers

Each party represents it has authority to enter this Agreement. EXCEPT AS EXPRESSLY STATED, THE SERVICES ARE PROVIDED "AS IS." COMPANY DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. COMPANY DOES NOT WARRANT THAT THE SERVICES WILL DETECT ANY RISK TO AN ATHLETE. THE SERVICES ARE NOT A MEDICAL DEVICE OR A SUBSTITUTE FOR PROFESSIONAL CARE OR FOR THE CLUB'S SAFETY PROCEDURES.

13. Liability and Indemnity

13.1 NEITHER PARTY IS LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES.

13.2 EACH PARTY'S TOTAL LIABILITY UNDER THIS AGREEMENT IS LIMITED TO US$1,000.

13.3 Sections 13.1 and 13.2 do not apply to the Club's breach of Section 4, either party's indemnity obligations, or liability that cannot be limited by law.

13.4 The Club shall defend and indemnify Company against third-party claims arising from the Club's or its Authorized Coaches' breach of Sections 4, 5, 6 or 8, or misuse of Athlete Data.

14. General

This Agreement is governed by California law, and disputes are heard in the state or federal courts in Santa Clara County, California, except that a Club established outside the United States may bring claims in its home courts where local law requires. Company may update this Agreement with 30 days' notice. If the Club does not agree, it may terminate before the change applies. Neither party may assign this Agreement without consent, except to a successor in a merger or sale of assets. This Agreement, with its Schedules, the Terms of Service, the Privacy Policy and the Safeguarding Policy, is the entire agreement on its subject. Severability, waiver, force majeure, independent contractors and no third-party beneficiaries apply in the usual way. Notices go to the email addresses on file.

Accepted for the Club: Name ______ · Title ______ · Club ______ · Date ______

Accepted for CurioCore: Name ______ · Title ______ · Date ______

Schedule A. Clinical Screen Thresholds

Schedule B. Designated Personnel

Schedule C. Athlete Notice

When you join this club on Flowbase and SportsFlow: your coaches see your training, results and a daily readiness word (Ready, Hold or Back off). They never see your questionnaire answers. You choose whether they see any wellbeing score, and you can change that at any time. If the club uses wellbeing screening and a result shows you may be struggling, the club's Wellbeing Lead is told that it happened, never the score, and you are told at the same time. Nothing about your wellbeing may be used to decide selection. If you are under 18, your guardian gets a copy of messages between you and your coaches.

Schedule D. Code of Conduct for Coaches

Authorized Coaches shall: communicate with minors only through the Services; never request, pressure or reward an athlete for sharing wellbeing data; never use wellbeing data for selection; keep athlete information confidential; share media of minors only for a sporting purpose and never content prohibited by the Safeguarding Policy; and report safeguarding concerns under the Safeguarding Policy and the law.

Schedule E. Data Processing Addendum

E.1 Scope. This Addendum applies when Company processes Club Data for the Club. It meets GDPR Article 28, UK GDPR, and the service provider requirements of the California Consumer Privacy Act.

E.2 Details of processing.

E.3 Instructions. Company processes Club Data only on the Club's documented instructions, which are this Agreement and the Club's use of the Services, unless the law requires otherwise. Company will inform the Club if it believes an instruction breaks the law.

E.4 Service provider terms. Company shall not sell or share Club Data, retain, use or disclose it outside the direct business relationship or for any purpose other than providing the Services, or combine it with other data except as the CCPA permits.

E.5 Confidentiality. Personnel with access to Club Data are bound by confidentiality.

E.6 Security. Company maintains encryption in transit and at rest, role-based access controls, access logging, secure development practices, backups and incident response procedures appropriate to the risk.

E.7 Subprocessors. The Club authorizes the subprocessors listed in the Privacy Policy Appendix. Company will give 30 days' notice of new subprocessors by updating that list and notifying the Club by email. The Club may object on reasonable data protection grounds. If the parties cannot resolve the objection, the Club may terminate. Company imposes equivalent data protection terms on each subprocessor and remains responsible for them.

E.8 Assistance. Company will help the Club respond to data subject requests, carry out data protection impact assessments and consult regulators, taking into account the nature of the processing.

E.9 Breaches. Company will notify the Club of a personal data breach affecting Club Data without undue delay, and within 72 hours, with the information the Club reasonably needs.

E.10 Return and deletion. At the end of the Agreement, Company will return Club Data on request made within 30 days, then delete it under the Data Retention Schedule, except published race results and data the law requires Company to keep.

E.11 Audits. Company will provide information reasonably needed to demonstrate compliance, including answers to a reasonable security questionnaire once a year. Any on-site audit requires 30 days' notice, takes place in business hours, and is at the Club's cost.

E.12 International transfers. Where Club Data is transferred from the EU/EEA, UK or Switzerland to the United States, the EU Standard Contractual Clauses (Module 2, controller to processor) and the UK International Data Transfer Addendum are incorporated by reference, with Company as data importer. The governing law and forum for the Clauses are those of Ireland, and for the UK Addendum, England and Wales.