Return-to-Sport: Product Brief

Date: 2026-05-01
Author: Daedalus (market research & brief) — for Matt review
Status: Assessment / Pre-build

1. What This Is

A communication platform that connects athletic trainers, coaches, and parents around a shared athlete injury/return-to-play timeline. Not a replacement EMR — a collaboration layer that sits on top of the tools ATs already use.

2. The Problem

Three stakeholders manage athlete injuries in three separate silos:

No single pane of glass exists where all three see the same timeline: what happened → what the assessment found → what the rehab milestones are → whether clearance has been granted.

The existing market validates this — Healthy Roster's entire landing page is built around "coaches, parents, communication." ATGenius added a parent portal and treatment reminder texts. SportsWareOnLine has coach and parent portals. Every vendor knows the gap exists. But every one of them treats parents and coaches as second-class users — a portal that's mostly a form filler, not a live shared view.

The High-WAF Lens

If Aundrea's kid gets hurt at soccer practice, here's her experience right now:
- She gets a call from a number she doesn't recognize
- An athletic trainer she's never met explains an injury she can't visualize
- She has no written plan, no timeline, no way to know if the coach is following the restrictions
- She Googles "return to play concussion protocol" at 10 PM

This is the bar. A product that fixes this experience has a built-in advocate in every parent who's ever been through it.

3. Market Context

• TAM: ~8M US high school athletes at any given time. ~23,000 public secondary schools. ~1,600 private. Each has at least one LAT (or contracts one).
• Market size: $1.6B globally (athletic training software), ~13.5% CAGR. Youth segment is fastest-growing.
• Compliance tailwind: 20+ states now have student data privacy laws. Kentucky's SB181 (June 2025) requires all adult-athlete communication to route through parents. Wisconsin's AB51/SB16 is a milder version focused on WIAA public records and openness — but the trend is clear. A compliance-native platform rides this wave.

Competitive Landscape

The positioning gap: A dedicated RTP communication layer with equal-first-class UIs for all three stakeholders. None of the incumbents offer this — they all serve the AT first and everyone else gets a portal.

4. The Product

Core Concept: Unified RTP Timeline

One shared view where:
- The AT documents the assessment, sets restrictions, defines milestones, and marks clearance
- The Coach sees who's available, what their restrictions are (full contact? non-contact? conditioning only?), and projected return dates
- The Parent sees the same timeline, understands the plan, and gets notified at each milestone

MVP Feature Set

1. Unified RTP Timeline (core, build first)
- Injury event → assessment → restrictions → rehab milestones → clearance
- Three views, same data, role-appropriate UI
- Color-coded status at a glance (🟢 full participation, 🟡 modified, 🔴 out, ⚪ cleared)

2. Role-Based Dashboards
- AT dashboard: Quick-entry status updates, treatment log summary, athlete roster with status dots
- Coach dashboard: Roster grid with availability for tonight's game, restriction details, sortable by sport/team
- Parent dashboard: Single-athlete view — timeline, milestones, AT messages, clearance status

3. Compliance-Native Communication
- All AT ↔ coach ↔ parent messages stay in-platform
- Audit trail for every message (FERPA-compliant recordkeeping)
- Parent auto-CC'd on all injury-related communication (SB181-style, even where not legally required)
- Role-based access: parents see only their athlete, coaches see only their team, AT sees all

4. Notification Engine
- Milestone alerts: "Johnny completed Phase 2 — cleared for non-contact practice"
- Daily digest for coaches: roster status for today's activities
- Parent nudges: "Rehab session today at 3:30" or "Doctor's note due"

5. Sync Connectors (v1.5 / near-term differentiator)
- Read-only integration with SWOL, ATGenius, Healthy Roster
- Pull existing injury records rather than forcing dual-entry
- If connector isn't built yet, manual entry is fine — the value is in the shared view, not the clinical docs

What It Is NOT

• ❌ A SOAP note editor (SWOL/ATGenius own this)
• ❌ An EHR/EMR replacement
• ❌ A billing system
• ❌ A forms platform (preseason physicals, etc. — use DragonFly or Magnus for that)
• ❌ A general team management tool (roster management, scheduling — use Motiv or existing tools)

What It IS

• ✅ The communication layer that makes existing EMR data visible to the people who need it
• ✅ A parent's first stop when their kid gets hurt
• ✅ A coach's pre-game checklist
• ✅ An AT's proof of impact for budget season

5. Compliance: FERPA > HIPAA

The Key Finding

For athlete health records maintained by a school-employed or school-contracted athletic trainer, HIPAA does NOT apply — FERPA does.

Per the US Department of Education / HHS joint guidance (updated December 2019):

If a person or entity acting on behalf of a school subject to FERPA maintains student health records, these records are education records under FERPA, not protected health information under HIPAA. This is the case regardless of whether the health care is provided on school grounds or off-site.

Wisconsin statute § 118.125 is explicit: an athletic trainer licensed under ch. 448 subch. VI is a health care provider, and records containing diagnoses, opinions, and judgments made by that AT are "patient health care records" under state law. These are governed by Wis. Stat. § 118.125(2m) + § 146.81-84, which define strict consent, access, and disclosure requirements — including that parents have a right to inspect these records and that disclosure without consent is limited to specific statutory exceptions.

What This Means for the Product

Communication Strategy

Do NOT claim HIPAA compliance. It's technically incorrect (FERPA applies, not HIPAA) and a legal liability if anyone reads the ToS carefully.

DO claim:
- "FERPA-compliant"
- "Built to exceed Wisconsin pupil records confidentiality requirements (Wis. Stat. § 118.125)"
- "Role-based access — parents see only their athlete, coaches see only their team"
- "End-to-end encrypted. Data stays in the US. We never sell student data."
- "Full audit trail — every access and disclosure is logged"

This is actually a marketing advantage: every competitor says "HIPAA-compliant" which is technically wrong for school settings and sounds like hospital software. "FERPA-compliant" signals you actually understand the education space.

Wisconsin-Specific Landscape

• 118.125 — Comprehensive pupil records law. Three categories of records (progress, behavioral, patient health care). Specific parent access rights, consent requirements for disclosure, recordkeeping obligations.
• 118.293 — Concussion and head injury specific statute. Requires immediate removal from play, written clearance from a health care provider before return. An RTP tracking tool with milestone documentation perfectly maps to this requirement.
• AB51 / SB16 (2025-2026 session) — Proposed bill extending public records and open meetings laws to the WIAA. Failed to pass per Senate Joint Resolution 1, but signals legislative interest in athletic oversight. Not a compliance driver yet, but worth watching.
• No SB181 equivalent in Wisconsin yet — but the national trend (20+ states with student data privacy laws) makes this a when-not-if proposition. Building compliance-native from day one is future-proofing.

Practical Compliance Architecture

┌─────────────────────────────────────────┐
│              Parent Consent              │
│  Signed once during athlete onboarding  │
│  Covers: AT records, coach view,        │
│  notification delivery preferences      │
└─────────────────────────────────────────┘
                    │
    ┌───────────────┼───────────────┐
    ▼               ▼               ▼
┌────────┐    ┌──────────┐    ┌──────────┐
│  LAT   │    │  Coach   │    │  Parent  │
│ view:  │    │  view:   │    │  view:   │
│  all   │    │ assigned │    │ own kid  │
│ sports │    │ teams    │    │  only    │
└────────┘    └──────────┘    └──────────┘

6. Infrastructure

Soverign Stack Option (your architecture)

┌──────────────────────────────────────────────────┐
│                   Cloudflare                       │
│  DNS: rtsport.com / app.rtsport.com               │
│  Tunnel: → titanium-butler Beelink                │
│  WAF: rate limiting, bot protection               │
│  Pages: static marketing site (optional)          │
└────────────────────┬─────────────────────────────┘
                     │
┌────────────────────▼─────────────────────────────┐
│            titanium-butler (Beelink)               │
│                                                    │
│  ┌──────────┐  ┌──────────┐  ┌──────────────────┐ │
│  │ FastAPI  │  │ Postgres │  │ Redis (cache +    │ │
│  │ backend  │  │ (primary │  │ session store)   │ │
│  │          │  │  store)  │  │                  │ │
│  └──────────┘  └──────────┘  └──────────────────┘ │
│                                                    │
│  ┌──────────────────────────────────────────────┐ │
│  │ Static files: Jinja2 templates + Tailwind    │ │
│  │ (HTMX for dynamic interactions)              │ │
│  └──────────────────────────────────────────────┘ │
└──────────────────────────────────────────────────┘

Rationale

• FastAPI — you already know it, runs on your Beelink, serves both API and HTML
• Postgres — FERPA audit trail is relational by nature. SQLite works for MVP but Postgres is one migration away.
• Redis — session management, rate limiting, notification queue
• HTMX + Jinja2 + Tailwind — your sovereign stack, no JS frameworks, zero third-party CDN dependencies
• Cloudflare Tunnel — no open ports on the Beelink, DDoS protection, free tier is generous

Alternative: Cloud-Native (if you want separation from HoffDesk infra)

Supabase (Postgres + Auth) 
  → Railway/Render/Fly.io (FastAPI) 
  → Cloudflare Pages (static frontend)

This separates RTSport from your home infrastructure — useful if it becomes a business rather than a side project. Supabase handles auth, Postgres, and row-level security (which maps beautifully to "parent sees only their kid"). Free tiers cover MVP.

Data Model (Core)

┌──────────────┐     ┌──────────────┐     ┌──────────────┐
│    School    │     │    Athlete   │     │   Guardian   │
├──────────────┤     ├──────────────┤     ├──────────────┤
│ id           │────→│ school_id    │     │ id           │
│ name         │     │ id           │←───→│ athlete_id   │
│ district     │     │ name         │     │ name         │
│ state        │     │ sport        │     │ email        │
└──────────────┘     │ team         │     │ phone        │
                     └──────────────┘     └──────────────┘
                            │
                            ▼
                     ┌──────────────┐
                     │ InjuryCase   │
                     ├──────────────┤
                     │ athlete_id   │
                     │ status       │ (active / resolved)
                     │ severity     │
                     │ body_part    │
                     │ diagnosis    │
                     │ created_by   │ (AT user)
                     └──────────────┘
                            │
                            ▼
                     ┌──────────────┐
                     │  Milestone   │
                     ├──────────────┤
                     │ case_id      │
                     │ phase        │ (acute / rehab / RTP / cleared)
                     │ restrictions │ (json: contact, cardio, etc.)
                     │ target_date  │
                     │ completed_at │
                     │ notes        │
                     └──────────────┘
                            │
                            ▼
                     ┌──────────────┐
                     │ Notification │
                     ├──────────────┤
                     │ case_id      │
                     │ recipient    │ (coach / parent)
                     │ type         │ (injury / milestone / clearance)
                     │ sent_at      │
                     │ read_at      │
                     └──────────────┘

┌──────────────┐     ┌──────────────┐
│   AT User    │     │ Coach User   │
├──────────────┤     ├──────────────┤
│ id           │     │ id           │
│ school_id    │     │ school_id    │
│ name         │     │ name         │
│ license_no   │     │ sports[]     │
│ email        │     │ teams[]      │
└──────────────┘     └──────────────┘

7. Business Model

Revenue Path

Free tier drives adoption (Motiv proved this works in the same buyer demographic). ATs are the champions — they bring it to their AD. If the AT loves it and the AD doesn't buy, the AT can buy the solo tier. Parent premium is upside only, never gated on the free tier for core functionality (a parent who can't pay still sees their kid's timeline).

8. Risks

9. Assumptions Worth Testing

1. ATs actually want this. Talk to 5 Wisconsin high school ATs. Show them a mock. Ask: "Would you use this if it were free? Would your AD pay for it?"
2. Parents will sign up. The WAF test — text 5 parents who have student-athletes. Describe the product. Ask if they'd download it.
3. Coaches will check it. Coaches are the least predictable user. They're time-starved and phone-averse during practice. The mobile coach view has to be faster than a text message.
4. Schools will pay. Free tier covers the AT. Parent premium covers individual families. But does a high school AD have $1,500 discretionary budget for this? Green Bay area schools: ask.
5. FERPA consent model works in practice. The product needs parental consent before an AT can put an athlete in the system. Does this create friction that kills adoption? Test with a manual process before building software.
6. The connector strategy is viable. Do SWOL/ATGenius have APIs? (Probably not open/public.) Is CSV export + import acceptable for v1? Talk to ATs about how they'd handle dual-entry.

10. Build vs Buy Check

• Build: Core RTP timeline, dashboards, notification engine, consent management — this is the product, you build it.
• Buy/Use: Auth (Supabase Auth or similar — don't roll your own), hosting (Cloudflare Tunnel + Beelink), email delivery (Resend or Postmark), SMS (Twilio, but only at Pro tier), error monitoring (Sentry free tier).
• Don't build yet: EMR connectors, parent premium billing, district dashboard, advanced reports.

11. Next Steps (in order)

1. Talk to 5 ATs — 30-minute calls. Validate pain. Show mock (I can build this).
2. Talk to 5 parents — especially moms of multi-sport kids. Validate WAF.
3. Build clickable mock — HTMX + Tailwind, looks real, no backend. 3 dashboards + timeline. Show it to ATs and parents.
4. Build MVP — if conversations validate the assumptions.
5. Onboard 3 pilot schools — Green Bay area, free. AT at each school uses it for a full sports season.
6. Decide — based on pilot data: scale or kill.

12. My Take

This is a real gap in a real market with real regulatory tailwinds. It's not a billion-dollar idea — the TAM is too small and the incumbents are too entrenched. But it could absolutely be a $50-150K ARR lifestyle business if it captures 50-100 schools in Wisconsin and neighboring states.

The FERPA finding is the most important strategic insight here: you don't need HIPAA compliance. You need FERPA + state law compliance, which is meaningfully less onerous. That lowers the build cost and speeds time-to-launch. It also positions you as someone who gets the education space — unlike every competitor who just slaps "HIPAA" on their marketing page.

The biggest risk isn't technical or competitive — it's Matt's time. If this is a side project, it needs brutal scope discipline. The MVP I've outlined above (timeline + dashboards + notifications, no connectors, no SMS, no advanced reports) is 6-8 weeks of nights-and-weekends work. If that's not realistic, the mock + customer conversations step is still worth doing — it validates whether to revisit this when bandwidth opens up.

End brief. For Socrates' review if/as needed; no backend dependency yet. All frontend UI is Daedalus' domain.