Children & Young People Privacy Notice

Document Information

1. About this notice

Mosa is designed for communities.

That means children and young people may be part of Mosa through schools, sporting clubs, community groups, events, volunteering and other activities.

We think children and young people deserve privacy protections that recognise something important:

A young person is their own Person, even when somebody else helps manage their participation.

This notice explains how Mosa approaches the personal information of children and young people.

It is intended for:

• children and young people;
• parents and carers;
• guardians;
• authorised representatives;
• Organisations working with children and young people;
• and other people who want to understand how Mosa works.

This notice should be read alongside our Privacy Policy and Privacy at Mosa.

Where this notice uses we, us or our, it means OSA Management Pty Ltd (ABN 62 677 945 863), trading as Sidekick Platforms, which operates Community.OS and Mosa.

2. A note for children and young people

If you're a child or young person using Mosa, the most important thing to know is:

Your Mosa profile is about you.

Your parent, guardian, school, sporting club or another Organisation may help manage parts of your participation.

That doesn't mean they own your Mosa identity.

Different people may be allowed to see or manage different information because of their relationship with you and the reason they need it.

They shouldn't automatically be able to see everything.

As you get older and are ready to manage more of Mosa yourself, your access and choices can change.

You shouldn't have to create a completely new Person and lose your participation history just because you're growing up.

If something about your privacy doesn't make sense, you should be able to ask a parent, guardian, trusted adult, your Organisation or Mosa for help.

3. Children remain their own Person

Community.OS is built around one Person, one persistent identity.

That applies to children too.

A child should not exist merely as:

Matt's child

or:

Sarah's dependant

or:

RHAC student

Those relationships may all be true.

But the child remains their own Person.

Their Mosa identity can exist independently of:

• a parent's Account;
• a Household;
• a school;
• a sporting club;
• another Organisation;
• or whether the child currently has direct access to Mosa.

This matters because relationships change.

Children grow up.

Families change.

People join and leave Organisations.

A persistent Person allows the young person's legitimate participation history and Community Story to remain connected to them through those changes.

4. A profile is not the same as an Account

A young person can have a Mosa identity without having their own Account or login.

These are different things.

A Person represents the individual.

An Account allows somebody to authenticate and use Mosa directly.

For younger children, a parent, guardian or authorised representative may initially manage relevant participation on their behalf.

As the young person develops greater independence, direct access can be introduced where appropriate without creating a second Person.

This helps avoid duplicate identities and fragmented participation history.

5. Parents, guardians and representatives

Parents, guardians and other authorised representatives can play an important role in a young person's Mosa experience.

Depending on the relationship, authority and context, a representative may be able to:

• register a young person;
• respond to invitations;
• provide availability;
• provide relevant information;
• manage some permissions;
• provide required consent where appropriate;
• agree to conditions on the young person's behalf;
• receive relevant communications;
• update appropriate information;
• or otherwise help manage participation.

But representation is contextual.

Being a parent, Household member or emergency contact does not necessarily give somebody unlimited authority over every part of a young person's identity or information.

Mosa is designed to understand who is acting, for whom, in what capacity and for what purpose.

6. Households and families

Families can be complicated.

Mosa does not assume every family has:

one child + one mother + one father + one household

A young person may:

• belong to more than one Household;
• live across different homes;
• have multiple parents or guardians;
• have a step-parent;
• have another authorised carer;
• have different people responsible for different matters;
• or have family arrangements that change over time.

A Household relationship helps Mosa understand family context.

It does not automatically create legal or representative authority.

For example:

Same Household ≠ Automatic Authority

and:

Emergency Contact ≠ Guardian

Mosa should represent legitimate relationships rather than forcing every family into the same structure.

7. What information might Mosa hold about a young person?

The information Mosa holds depends on how the young person participates.

It may include:

• name;
• preferred name;
• date of birth where required;
• profile image;
• contact information where appropriate;
• Household and family relationships;
• parent, guardian or representative relationships;
• Organisation memberships;
• school, club, team or group relationships;
• registrations;
• participation;
• availability;
• attendance;
• roles;
• qualifications or eligibility;
• Health & Safety Information;
• Accessibility & Support Information;
• emergency contacts;
• communications;
• Community Story;
• achievements or recognition;
• permissions and consent;
• and technical or security information needed to operate Mosa safely.

Not everybody connected to a young person can see all of this information.

8. Where information about a young person comes from

Information about a child or young person may come from several places.

It may be provided by:

• the young person;
• a parent;
• a guardian;
• an authorised representative;
• an Organisation;
• another legitimate participant;
• a verification provider;
• or another connected service where appropriate.

Information may also be created through participation.

For example, Mosa may record that a young person:

• joined a team;
• attended an activity;
• completed a volunteering role;
• received recognition;
• or participated in an event.

Where possible, Mosa should preserve where important information came from.

An Organisation saying something about a young person does not automatically make that information part of the young person's verified identity.

9. Why Mosa uses information about young people

We may use a young person's information to:

• establish and maintain their Mosa identity;
• support family and representative relationships;
• connect them with Organisations;
• manage registrations and participation;
• manage teams, groups and activities;
• record attendance and participation;
• communicate appropriately;
• verify requirements;
• support health and safety;
• provide accessibility or other support;
• protect participants;
• prevent misuse;
• maintain security;
• build their Community Story;
• provide and improve Mosa;
• and comply with legal or safeguarding requirements.

We should not collect information about a young person simply because it might be useful one day.

There should be a legitimate reason for collecting and using it.

10. Who can see a young person's information?

There isn't one universal answer.

Mosa is designed so access depends on context.

For example:

A team coach might need to know whether a player is available.

An authorised first-aid role may need particular Health & Safety Information.

A volunteer coordinator may need to know whether a requirement has been satisfied.

Another participant may only need to see the young person's first name and limited profile information.

An Organisation administrator does not automatically need access to everything about every young person.

Access may depend on:

• the relationship;
• the Organisation;
• the person's role;
• their authority;
• the information involved;
• why they need it;
• safeguarding requirements;
• the activity;
• the young person's age and circumstances;
• parent, guardian or representative authority;
• participant controls;
• and applicable law or policy.

Knowing a young person through Mosa does not mean being entitled to know everything about them.

11. Information from different Organisations

A young person may participate with several Organisations.

For example, they might attend a school, play football, play netball and volunteer with another community group.

Those Organisations do not automatically receive access to one another's information about the young person.

Mosa may allow trusted information to be reused where that is appropriate.

For example, an Organisation might need to know that a requirement has been satisfied without needing every piece of evidence behind that outcome.

Our principle is:

Reuse trust, not unnecessary sensitive information.

12. Health, safety and support information

Some information about young people can be particularly sensitive.

This includes Health & Safety Information and, depending on the circumstances, information about accessibility or support needs.

An Organisation may genuinely need some of this information to help a young person participate safely.

That does not mean everybody within the Organisation should be able to see it.

Access should be limited according to legitimate need, role, context and safeguarding requirements.

Where an Organisation only needs an outcome or instruction rather than the underlying sensitive information, Mosa should prefer the minimum information necessary.

13. Emergency contacts

An emergency contact exists for a particular purpose.

They may be somebody who should be contacted if something happens to the young person.

That does not automatically mean the emergency contact:

• is the young person's guardian;
• can manage their Mosa profile;
• can consent for them;
• can see their information;
• or can act for them generally.

Mosa keeps those concepts separate because they mean different things.

14. Communication with children and young people

Communication is an important part of community participation.

It can also create safeguarding risk.

Mosa therefore does not assume that somebody should be able to privately contact a young person simply because they hold an Organisation role.

For example:

Coach Authority ≠ Automatic Private Communication Authority

The appropriate communication behaviour may depend on:

• the young person's age;
• the relationship;
• the Organisation;
• the activity;
• the type of communication;
• parent or guardian involvement;
• Organisation safeguarding policy;
• applicable law;
• and other safeguarding requirements.

Depending on the context, Mosa may restrict communication, involve an authorised adult, change the communication mode or apply another safeguard.

Safeguarding can restrict an action even where a general role or permission would otherwise allow it.

15. Visibility and discovery

Children and young people should not automatically become broadly discoverable merely because they participate through Mosa.

Profile, Organisation, group, team and participation visibility may differ according to context.

Mosa should favour appropriate visibility rather than maximum visibility.

The appropriate setting may depend on:

• age;
• relationship;
• Organisation;
• activity;
• safeguarding;
• participant or representative choices;
• and applicable policy.

A young person's Community Story should not automatically become a public record.

16. Consent and privacy decisions

Not every use of a young person's information depends on consent.

Sometimes information is required to provide a service, manage participation, protect safety or meet another legitimate or legal requirement.

Where consent is required, Mosa should determine who can appropriately provide it.

Australian privacy law does not set one universal age at which every young person suddenly becomes capable of making every privacy decision themselves.

A young person's ability to make a decision can depend on their understanding, maturity and the nature of the decision.

This means Mosa should not reduce privacy authority to a single rule such as:

Under X = Parent decides

Over X = Young person decides everything

The appropriate interaction may involve:

• the young person;
• their parent;
• their guardian;
• another authorised representative;
• or more than one of them

depending on the circumstances.

17. Listening to the young person

Having an authorised adult involved does not mean the young person's views stop mattering.

Where appropriate, Mosa should help children and young people understand:

• what information is being collected;
• why it is needed;
• who may see it;
• what choices they have;
• and what happens next.

As a young person develops greater understanding and independence, their involvement in privacy decisions should increase.

We call this progressive autonomy.

Growing independence should increase a young person's agency, not require them to start again.

18. Growing into direct Mosa access

A young person's relationship with Mosa may evolve over time.

Initially:

```text Person exists ↓ Representative manages appropriate participation ```

Later:

```text Person exists ↓ Young person receives appropriate direct access ↓ Representative relationship evolves ```

The Person does not need to be recreated.

Their participation history does not need to disappear.

Their identity does not need to move from a parent's profile into a new profile.

Instead, authority and access can change around the same Person.

Where representative authority should reduce or end, Mosa should update that authority rather than leaving historical access in place indefinitely.

19. What happens when a young person becomes an adult?

Turning 18 is important, but Mosa should not treat a birthday as permission to carelessly rewrite every relationship.

As a young person approaches adulthood, the platform should be capable of reviewing:

• direct Account access;
• representative authority;
• Household relationships;
• contact information;
• privacy choices;
• information visibility;
• communications;
• existing consent;
• and other relevant permissions.

Some family relationships may continue.

Some representative authority may end.

Some authority may continue for another legitimate reason.

The underlying Person and their legitimate Community Story remain the same.

20. Parents and guardians do not automatically see everything forever

A parent or guardian may legitimately need substantial access while managing a younger child's participation.

That does not mean the same access should necessarily continue forever.

As circumstances change, Mosa may adjust:

• what the young person can manage;
• what the representative can manage;
• what information each can see;
• and whose authority is required for particular actions.

This should happen carefully and in accordance with applicable law, safeguarding requirements and the young person's circumstances.

21. What Organisations are responsible for

Organisations using Mosa may have their own responsibilities toward children and young people.

For example, a school, sporting club or community Organisation may have obligations relating to:

• safeguarding;
• child safety;
• appropriate communications;
• staff and volunteer conduct;
• information collection;
• health and safety;
• permissions;
• and record keeping.

Using Mosa does not remove those responsibilities.

Organisation policy can add appropriate safeguards.

It cannot use Mosa to bypass the platform's underlying privacy and safeguarding protections.

22. Commercial partnerships and young people

Mosa is a commercial platform, but it is not being designed around turning people's participation into advertising inventory.

That principle is particularly important for children and young people.

Commercial activity involving young people should receive additional care.

A commercial relationship does not automatically give a partner access to a young person's personal information or Community Story.

Where Mosa presents benefits, offers, commerce or sponsored programs that may involve young people, we should consider:

• the young person's age;
• the nature of the opportunity;
• whether it is appropriate for young people;
• what information is required;
• whether a parent or guardian should be involved;
• whether consent is required;
• safeguarding;
• and applicable law.

We do not want Mosa to become an experience where young people's attention or participation is treated primarily as advertising inventory.

23. Targeted advertising

Mosa is not being designed as a targeted advertising platform for children.

We will review any advertising or commercial capability involving children's personal information against applicable privacy law and the protections applying to children at the time the capability is introduced.

Where consent or another specific protection is legally required, the relevant capability must respect that requirement.

24. Research and surveys

Mosa may support surveys, research or community insights over time.

Research involving children or young people's information should be treated according to its purpose, information requirements, sensitivity, participant age, required authority and applicable law.

Where appropriate, information may be aggregated or de-identified.

A research opportunity should not create a hidden pathway to unrelated access to a young person's profile or Community Story.

25. Integrations and external systems

An Organisation may connect Mosa to another system.

Mosa may also use service providers to operate the platform.

Those are different relationships.

Connecting an external system should not automatically provide that system with unrestricted access to information about children or young people.

External access should be limited to the legitimate purpose and authority of the integration.

Where information about a young person is shared with another independent provider, additional privacy information may apply.

26. Keeping young people's information safe

Privacy depends on security.

Community.OS is designed so access to information should follow legitimate operational authority.

Simply working for Sidekick Platforms does not create a general entitlement to inspect a young person's information.

Sensitive information, safeguarding information and information involving children may require stronger controls and escalation because inappropriate access can have greater consequences.

We use security measures appropriate to the nature of the information and the systems involved.

No online platform can guarantee absolute security, but protecting children and young people's information is an important part of our security and privacy architecture.

27. If something goes wrong

If we become aware of a privacy or security incident involving a child or young person's information, we will assess the incident according to its circumstances and applicable requirements.

Incidents involving children, sensitive information or safeguarding may require additional or faster escalation because the potential consequences can be greater.

Where notification is required by law, we will comply with those requirements.

Where appropriate, communication should help the affected young person and their parent, guardian or representative understand:

• what happened;
• what information may be affected;
• what we have done;
• what they should do;
• and where they can get help.

28. Accessing a young person's information

A young person may have rights to access personal information held about them.

A parent, guardian or authorised representative may also be able to request information on their behalf where they have appropriate authority.

We may need to establish:

• who is making the request;
• which Person the information concerns;
• the relationship between them;
• the authority relied upon;
• the young person's circumstances;
• and whether providing the requested information is appropriate and lawful.

Representative status does not necessarily create unlimited access to every category of information.

29. Correcting information

If information about a child or young person is wrong, they or an appropriately authorised representative may be able to correct it or ask us to correct it.

Different information may need to be treated differently.

For example, correcting a misspelled name is different from changing:

• an Organisation's historical attendance record;
• an eligibility result;
• an incident record;
• or another legitimate historical record.

Where information is disputed, Mosa may preserve its source and record the dispute rather than silently rewriting history.

30. Leaving an Organisation

A young person may leave a school, club, team or other Organisation.

That does not necessarily mean their Mosa identity should be deleted.

It also does not mean the former Organisation should continue having the same access to the young person's current information.

Where a relationship ends, ongoing access should be removed or reduced where it is no longer justified.

Legitimate historical records may remain where there is a proper reason to retain them.

31. Closing or deleting a Mosa Account

Closing an Account is different from deciding what happens to the underlying Person and historical records.

Where deletion or de-identification is appropriate, Mosa should take reasonable steps consistent with applicable law and legitimate retention requirements.

Some records may need to remain for reasons such as:

• safety;
• safeguarding;
• participation history;
• legal obligations;
• disputes;
• security;
• or legitimate Organisation records.

That does not mean every former Organisation should retain continuing access to the young person's current identity or contact information.

32. Privacy information should make sense to young people

Children and young people should not have to understand a lawyer's document before they can understand what is happening to their information.

Mosa should use age-appropriate and understandable privacy information where appropriate.

This may mean presenting information differently for:

• younger children;
• teenagers;
• parents and guardians;
• and adults.

The underlying privacy protections should remain consistent even where the explanation changes.

33. Australia's Children's Online Privacy Code

Australia is introducing a Children's Online Privacy Code that will create additional privacy requirements for certain online services accessed by children.

At the date of this notice, the final Code has not yet been registered.

We are monitoring its development and will review Mosa, this notice and our relevant privacy practices against the final Code when it is made.

Our intention is not merely to wait for new rules before thinking about children's privacy.

Community.OS is already designed around principles including:

• children remaining their own Person;
• minimum necessary access;
• contextual authority;
• age-appropriate experiences;
• safeguarding by design;
• progressive autonomy;
• careful communication;
• appropriate visibility;
• and stronger protection for sensitive information.

Where the final Code requires additional or different protections, we will update our practices and documentation as required.

34. Privacy questions or concerns

Children and young people should be able to raise privacy concerns.

If you're a young person and something about Mosa makes you uncomfortable or doesn't make sense, you can ask a trusted adult for help, but you can also contact us directly.

Parents, guardians and representatives can also contact us.

Privacy enquiries, access requests, correction requests and complaints can be sent to:

hello@oncommunityos.com

Mosa and Community.OS are operated by:

OSA Management Pty Ltd ABN 62 677 945 863 Trading as Sidekick Platforms

You can find more information in:

Privacy at Mosa

Our plain-language explanation of privacy across Mosa.

Mosa Privacy Policy

Our formal Privacy Policy.

Security at Mosa

Our plain-language explanation of platform security and trust.

A child is a Person, not a sub-profile belonging to an adult or an Organisation.

Being responsible for a young person does not automatically mean unlimited access to everything about them.

As young people grow, Mosa should help their independence and privacy grow with them.

Where there is uncertainty about access, authority or safeguarding, uncertainty should not become a reason to expose more information.

Our goal is for young people to be able to build a Community Story that can grow with them throughout their lives, while the people supporting them have the information and authority they legitimately need at the time.

Protect the Person. Respect the relationship. Grow their agency. Keep participation safe.

Document Status

Document: Children & Young People Privacy Notice Version: v1.0 Status: Approved Reviewed: 27 September 2026 Parent Company: Sidekick Platforms Platform: Community.OS Product: Mosa