Skip to content

Security and health data

FightMed handles medical certificates, exams and suspensions: health data under Article 9 of the GDPR. Here is how it is protected. This is the page to send to a committee, a league or a doctor.

Health data, treated as such

  • Consent

    The fighter, or a minor's parent, consents before any upload. Each sharing with another organisation requires its own consent.

  • Audit trail

    Every view of a document is logged: who, what, when, from which organisation. The coach sees it on the file.

  • Isolation

    A coach edits their own groups. A promotion sees its card's documents, read-only, for 90 days. Enforced in the database, not just on screen.

  • Hosting and deletion

    Data and files in the European Union, encrypted. Never a PDF as an attachment. Full export and permanent deletion on request, files included.

Encoded rules

  • FFBoxe 2026-27

    Profiles : Educational, Amateur, Pro

    What is encoded : Validity by season or calendar year, 32 and 40-year thresholds, official forms and mandatory mentions, requirements by fight type (abroad, EBU, world), rest scale, concussion

  • FMMAF

    Profiles : Pro, Amateur / youth

    What is encoded : Blood tests 3 months, MRI, medical clearance, ECG, eye exam, MR angiography over 32, D-20 deadline, 30 days' rest after a KO

  • SAFE MMA (UK, Ireland)

    Profiles : M1, M3, M5

    What is encoded : Bloods 6 months, medical 1 year, D-7 cut-off

  • US and European commissions

    Profiles : Pro

    What is encoded : UFC / Bellator / PFL and Cage Warriors / Oktagon / ARES / KSW profiles, adjustable per promotion

  • FFKMDA

    Profiles : In progress

    What is encoded : Parental consent, "KO allowed" mention; full rule set to come

  • Your federation

    Profiles : On request

    What is encoded : Savate, full-contact, foreign promotion, regional rules: a profile is entered within a week from the rulebook, source cited. Nothing is hard-coded for boxing.

Every rule carries its source and the date it was checked. Every profile can be duplicated and edited by the club.

Sécurité

Chiffrement des données en transit (TLS) et au repos ; cloisonnement par structure appliqué au niveau de la base de données (politiques de sécurité par ligne) ; accès aux fichiers par liens signés à durée limitée ; journalisation des consultations ; sauvegardes [quotidiennes — à confirmer selon le plan d'hébergement]. Les emails ne transportent jamais de pièce jointe médicale.

[Point en cours d'analyse juridique : qualification au regard de la certification Hébergeur de données de santé (HDS). FightMed ne traite pas de données de santé pour le compte d'un établissement de soins ; la nécessité d'un hébergement certifié HDS est examinée avec un conseil.]

Processors

  • Supabase (base de données, fichiers, authentification) — données hébergées à Francfort, Allemagne (UE).
  • Vercel (exécution de l'application) — région Francfort (UE) ; société américaine, encadrée par les clauses contractuelles types de la Commission européenne.
  • Resend (envoi des emails de relance, d'invitation et de connexion) — société américaine, clauses contractuelles types ; les emails ne contiennent jamais de pièce médicale, seulement un lien sécurisé.
  • Sentry (suivi des erreurs techniques) — données techniques uniquement, sans contenu de document.
  • [Stripe (paiement) — à ajouter quand la facturation est activée.]
  • Aucun document médical n'est transmis à un sous-traitant situé hors de l'Union européenne.

Read the privacy policy →

A question about security or data? Write to contact@fightmed.app

Frequently asked questions

Can I import my existing list?

Yes, as CSV or Excel. FightMed detects the columns, shows a preview, spots duplicates and gives you an import report. You can also import exams already done.

How does the fighter send their documents?

Through a secure link valid for 30 days: they take a photo or pick a PDF from their phone. The document lands in your "To validate" queue. You accept it in one click.

What happens beyond 3 competitors?

You pick the plan that matches your number of active competitors. Nothing is deleted. An archived competitor doesn't count.

How does billing work?

Per season (September → June, 10 months) or per month, invoiced to your organisation. For a committee, on quote, by number of clubs.