The short answer
Parents see their own family. Coaches see the squads they coach. The board sees what it needs to run the club. A child's details are never public on the club website.
Clubs cannot see each other
SwimWin holds many clubs. A person's record in one club is invisible to every other club, and this is enforced in the database itself rather than by careful querying in the application. A request for another club's household comes back as "not found" — not "forbidden", because "forbidden" would confirm it exists.
Medical information is split in two
| Who | What they see | |
|---|---|---|
| Summary | Most staff on deck | A short line they can act on |
| Full record | read_medical only | Everything |
Every read of a full medical record writes an audit row naming who looked and when. Not a sample — every read.
A deck coach gets what they need to keep a child breathing. Nobody on deck needs a policy number.
Safeguarding notes are narrower still
A safeguarding note is a sentence typed about a named child. It is readable by the Safe Sport lead alone — not the board, not the treasurer, and deliberately not the owner.
The reasoning is plain: in a club where the treasurer and the board chair are also parents — which is every club — a wider capability means neighbours reading about neighbours' children.
Even the log of who read them is protected separately. A flat audit log telling a board member "the Safe Sport lead opened this child's record four times in March" discloses something about that family whether or not the note itself is readable.
What the front desk sees
The desk sees what it needs to decide entry: a name, a photo, a verdict and a reason. A medical alert shows as an alert with no public wording at all — the queue behind the counter learns nothing about that child's health.
What families see
Your own household. Everyone in it, what you owe, what you have signed, your guest allowance. Nothing about anybody else's family.
What SwimWin staff can see
SwimWin platform operators have a lookup console. What it reaches is your club's record and its access: the club's own row, the accounts bonded to it, and the roles those accounts hold. They can set your club up and fix who can get into it — that is how a club gets its first owner, since granting a role requires already holding one.
They can also look up a family or a person, by name or by the email address on a support ticket — and what that returns is the identifying line and nothing else: a household's name, member number, status and contact details; a person's name, email, phone and status. Not their home address, their date of birth, a medical profile, a photo consent or a waiver signature. Those are unreadable from that console at any column, enforced by the database rather than by a missing screen — and no operator can change any of them.
Every one of those lookups, and every change an operator makes, is recorded with who and when.
Signing in as one of your members — impersonation — does not exist, and when it does it will require a stated reason, a bounded expiry, and a notification to the person impersonated. It will not appear as a side effect of something else.