AI Features Addendum

Parties: Experiential Technologies Ltd ("Processor" / "Rowbot") and the subscribing Club ("Controller" / "Club")

This Addendum supplements the Rowbot Data Processing Agreement ("DPA") and the Rowbot Privacy Policy. It applies only when the Club activates AI Features within the Rowbot platform.

Part A: DPA Schedule - AI Processing

A1. Activation and Scope

A1.1. AI Features are disabled by default for all Clubs. The Club may activate AI Features through the platform's administration settings at any time, and may deactivate them at any time.

A1.2. Certain AI Features that process Special Category Data (as defined in UK GDPR Article 9) - including but not limited to facial recognition and photo tagging - additionally require explicit consent from each individual Member before processing their data. The Club is responsible for ensuring this consent is obtained through the platform's built-in consent mechanisms.

A1.3. Upon deactivation of AI Features by the Club, all AI-specific processing shall cease. Any derived data (such as facial recognition vectors) shall be deleted within 30 days of deactivation. Standard Club data processed prior to deactivation remains unaffected.

A2. Purposes of AI Processing

The Processor shall process Club Data using AI services only for the following purposes, and only to the extent enabled by the Club:

AI Feature	Purpose	Data Inputs	Club Opt-In	Member Opt-In Required
Reporting & Analytics	Generate insights, summaries, and reports from club operational data	Aggregated membership, attendance, equipment usage, event data	Yes	No
Training & Health Recommendations	Provide personalised training suggestions and health/fitness insights to members	Activity logs, training history, fitness sync data (Strava, Apple Health), member profile	Yes	No (uses data members have already provided)
Photo Tagging & Recognition	Identify and tag members in club photos using facial recognition	Club photos, member profile photos	Yes	Yes - explicit consent
Natural Language Queries	Allow administrators to query club data using natural language	Club operational data as relevant to the query	Yes	No

A2.1. The Processor shall not use Club Data processed through AI Features for any purpose other than those listed above, unless agreed in writing with the Club.

A2.2. The Processor shall not use Club Data (or any data derived from it) to train, fine-tune, or improve any AI or machine learning models. This restriction applies to both the Processor's own models and those of any sub-processor.

A3. AI Sub-Processors

The following sub-processors are engaged specifically for AI Features processing, in addition to those listed in the main DPA sub-processor schedule:

Sub-Processor	Service	Data Processed	Processing Location	Training on Customer Data
Amazon Web Services (AWS)	AWS Bedrock - managed AI inference service	Club data as submitted to AI features (prompts, context data)	eu-west-2 (London, UK)	No
Anthropic PBC	Foundation model provider (Claude) - accessed via AWS Bedrock, not directly	Content of AI prompts and responses processed through Bedrock	eu-west-2 (London, UK) via AWS Bedrock	No - Anthropic does not receive, store, or train on data processed through AWS Bedrock
Amazon Web Services (AWS)	AWS Rekognition - image analysis and facial recognition	Club photos, member profile images, derived facial vectors	eu-west-2 (London, UK)	No

A3.1. Anthropic's role. Anthropic PBC provides the foundation AI models (Claude) that power Rowbot's AI features. These models are accessed exclusively through AWS Bedrock, which means Anthropic operates as a sub-processor of AWS rather than a direct sub-processor of the Processor. Under the AWS Bedrock service terms, Anthropic does not receive customer data directly, does not store prompts or responses, and does not use customer data for model training or improvement.

A3.2. No direct data transmission to Anthropic. The Processor does not transmit Club Data directly to Anthropic at any point. All AI model inference is conducted through the AWS Bedrock managed service within the UK (eu-west-2) region.

A3.3. The Club's general consent to the sub-processors listed in the main DPA shall extend to the AI-specific sub-processors listed in this section upon activation of AI Features. The Processor shall notify the Club of any changes to AI sub-processors in accordance with the notification procedures set out in the main DPA.

A4. Data Handling and Retention

A4.1. Prompt and response data. AI prompts and responses are processed in real-time and are not stored by the AI sub-processors (AWS Bedrock, Anthropic) after processing is complete. The Processor may store AI outputs (such as generated reports or recommendations) as part of standard Club Data, subject to the retention terms in the main DPA.

A4.2. Facial recognition data. Facial feature vectors generated by AWS Rekognition are stored as Club Data and are subject to the following additional controls:

Vectors are associated with the individual Member's profile and are scoped to the Club
Vectors are deleted immediately upon a Member withdrawing consent for photo tagging
Vectors are deleted within 30 days of the Club deactivating the photo tagging feature
Vectors are deleted upon deletion of the Member's club membership, in accordance with the main DPA

A4.3. AI-generated content. Reports, recommendations, summaries, and other content generated by AI Features are treated as Club Data and retained in accordance with the main DPA. The Club may delete AI-generated content at any time.

A4.4. Logging. The Processor may log metadata about AI feature usage (such as feature type, timestamp, and requesting user) for the purposes of platform security, abuse prevention, and debugging. Logs do not contain the content of prompts or responses and are retained for no more than 90 days.

A5. Accuracy and Limitations

A5.1. AI-generated content (including reports, recommendations, and photo tags) is provided on an advisory basis only. The Processor does not warrant the accuracy, completeness, or fitness for purpose of any AI-generated output.

A5.2. Health and training recommendations generated by AI Features are general in nature and do not constitute medical, physiological, or coaching advice. The Club and its Members acknowledge that such recommendations should not replace professional guidance.

A5.3. Photo tagging may produce incorrect identifications. The Club is responsible for reviewing and correcting any inaccurate tags. Members may dispute and remove incorrect tags at any time.

A6. Automated Decision-Making

A6.1. AI Features are used to assist and inform human decision-making. No AI Feature within Rowbot produces decisions that have legal or similarly significant effects on individuals without human review.

A6.2. Specifically, AI Features are not used to: make or influence membership decisions; determine crew selection (AI may surface data, but selection decisions are made by coaches); assess individual performance for disciplinary purposes; or make any financial decisions affecting Members.

A6.3. Members retain the right under UK GDPR Article 22 to not be subject to solely automated decision-making. In the event that any AI Feature is developed that could constitute automated decision-making with significant effects, the Processor shall implement appropriate safeguards, including the right to obtain human intervention, and shall update this Addendum accordingly.

Part B: Privacy Policy - AI Features Supplement

How We Use Artificial Intelligence

Some features within Rowbot are powered by artificial intelligence (AI). These features are optional - your club chooses whether to enable them, and some features additionally require your individual consent before they process your data.

What AI features are available:

Reporting and analytics - helping club administrators generate insights from club data such as attendance patterns, equipment usage, and membership trends
Training and health recommendations - providing personalised suggestions based on your activity history and training data
Photo tagging - using facial recognition to identify and tag members in club photos
Natural language queries - allowing administrators to ask questions about club data in plain English

How it works technically:

We use AWS Bedrock, a managed AI service hosted in London (UK), to process AI requests. The AI models are provided by Anthropic (Claude). Importantly:

Your data is processed in the UK (AWS eu-west-2 region, London)
Your data is never used to train AI models - not by us, not by AWS, not by Anthropic
AI prompts and responses are processed in real-time and are not stored by the AI providers after processing
For photo tagging, we use AWS Rekognition, also hosted in the UK

What requires your consent:

Most AI features operate on data you have already provided to the platform (your activity logs, attendance records, etc.) and are covered by your club's existing basis for processing your data.

However, photo tagging and facial recognition involves processing your biometric data, which is a special category of personal data under UK GDPR. This feature requires your explicit consent before we process your photos for facial recognition purposes. You can:

Choose whether to opt in to photo tagging when prompted
Withdraw your consent at any time through your account settings
Request deletion of your facial recognition data at any time

If you withdraw consent, your facial recognition data (facial feature vectors) will be deleted immediately, and you will no longer be tagged in new photos. Existing tags on past photos will be removed.

Accuracy:

AI-generated content - including reports, recommendations, and photo tags - is provided for informational purposes only. Training and health recommendations are general in nature and should not be treated as professional medical or coaching advice. Photo tagging may occasionally produce incorrect results; you can correct or remove any inaccurate tags.

Your rights:

No decisions with legal or significant effects on you are made solely by AI within Rowbot. AI features assist club administrators and coaches in making decisions, but humans always make the final call. You have the right under UK GDPR not to be subject to solely automated decision-making that significantly affects you.

Part C: Sub-Processor Schedule Update

The following entries are added to the existing sub-processor schedule in the main DPA when AI Features are activated.

Sub-Processor	Service	Purpose	Location	Applies When
AWS (Bedrock)	Managed AI inference	AI-powered reporting, recommendations, natural language queries	London, UK (eu-west-2)	Club enables any AI Feature
Anthropic PBC	Foundation AI model (via AWS Bedrock)	Language model powering AI features	London, UK (via AWS Bedrock eu-west-2)	Club enables any AI Feature
AWS (Rekognition)	Image analysis and facial recognition	Photo tagging and member identification	London, UK (eu-west-2)	Club enables Photo Tagging feature

Note: Anthropic PBC does not receive data directly from Rowbot. All data is processed through the AWS Bedrock managed service. Anthropic is listed here for transparency.

For questions about AI Features and data processing, contact us at privacy@rowbot.app.