The short answer
Parents see their own family. Coaches see the squads they coach. The board sees what it needs to run the club. A child's details are never public on the club website.
Clubs cannot see each other
SwimWin holds many clubs. A person's record in one club is invisible to every other club, and this is enforced in the database itself rather than by careful querying in the application. A request for another club's household comes back as "not found" — not "forbidden", because "forbidden" would confirm it exists.
Medical information is split in two
| Who | What they see | |
|---|---|---|
| Summary | Most staff on deck | A short line they can act on |
| Full record | read_medical only | Everything |
| Your own family's record | A child's parent or guardian; an adult themselves | Everything about that person, to keep it current |
Every read of a full medical record writes an audit row naming who looked, when, and on what authority — staff access or family access. Not a sample — every read, including a parent opening their own child's.
A parent's access stops at the eighteenth birthday. After that, an adult swimmer's record opens for a parent only if the swimmer grants medical access themselves.
A deck coach gets what they need to keep a child breathing. Nobody on deck needs a policy number.
Safeguarding notes are narrower still
A safeguarding note is a sentence typed about a named child. It is readable by the Safe Sport lead alone — not the board, not the treasurer, and deliberately not the owner.
The reasoning is plain: in a club where the treasurer and the board chair are also parents — which is every club — a wider capability means neighbours reading about neighbours' children.
Even the log of who read them is protected separately. A flat audit log telling a board member "the Safe Sport lead opened this child's record four times in March" discloses something about that family whether or not the note itself is readable.
What the front desk sees
The desk sees what it needs to decide entry: a name, a photo, a verdict and a reason. A medical alert shows as an alert with no public wording at all — the queue behind the counter learns nothing about that child's health.
What families see
Your own household. Everyone in it, what you owe, what you have signed, your guest allowance. Nothing about anybody else's family.
What SwimWin support can see and do
In one paragraph: SwimWin support can look a family up across clubs, can work inside your club on your behalf with your club's own screens, and can view your club as one member sees it (read-only, and the member is emailed). Every one of those acts is recorded with the operator's name — on SwimWin's own audit trail, and inside your club on yours. The details:
Looking someone up
SwimWin platform operators have a lookup console. What it reaches is your club's record and its access: the club's own row, the accounts bonded to it, and the roles those accounts hold. They can set your club up and fix who can get into it — that is how a club gets its first owner, since granting a role requires already holding one.
They can also look up a family or a person, by name or by the email address on a support ticket — and what that returns is the identifying line and nothing else: a household's name, member number, status and contact details; a person's name, email, phone and status. Not their home address, their date of birth, a medical profile, a photo consent or a waiver signature. Those are unreadable from that console at any column, enforced by the database rather than by a missing screen.
Every one of those lookups, and every change an operator makes, is recorded with who and when.
Working inside your club as SwimWin support
When you ask SwimWin support to fix something — add a family, correct a swimmer's details, take a payment, change a schedule — an operator can manage your club from the SwimWin console, using your club's own screens:
- They do it as SwimWin support, not as one of you. They are not added to your club, and nobody is impersonated. Your audit trail shows every change as "SwimWin support · their name", and SwimWin keeps its own record of every page they opened.
- They confirm their password first, and again every 30 minutes.
- Safeguarding notes need a stated reason. Opening them, filing one, or opening the protected part of the audit trail asks the operator why, and the reason is recorded with their name — even when there turned out to be nothing to read. Opening the file is what is recorded, not what was in it.
- Every page they open and every change they make is audited. Your own audit screen shows the changes under "SwimWin support · their name"; SwimWin's record has one line per request, including anything they were refused.
- Website drafts open on your own address. When support previews a page they are editing for you, it opens on your club's address exactly as a visitor would see it once published — including, before your club is live, through the same preview pass your committee's preview link uses.
- They cannot act as a family. Signing a waiver, accepting an invitation or paying with a family's saved card stays with the family; support records a paper signature through the staff screens instead.
"View as": seeing the club the way a member does
When you report something that only happens on one family's account, a SwimWin operator can view your club as that member to see exactly what they see. It is deliberately narrow:
- Read-only. Nothing can be changed while viewing as someone — no payment, no form, no message. The operator's screens refuse every change.
- Medical and safeguarding details stay hidden, even though the member themselves can see them.
- It needs a stated reason, and the member is emailed it — who looked, when, for how long, and why — the moment it starts.
- It lasts an hour at most, and the operator can only hold one at a time. A bright bar across the top of every page says whose account is being viewed and how long is left.
- Every page opened is recorded on your club's audit trail, under the operator's name as well as the member's.
- Never a SwimWin operator, and never a child's own account — the operator views as a parent instead.
It does not touch the member's own sign-ins: they stay signed in on their own devices throughout.