Data Processing Agreement

You use the platform to run a coaching practice. In doing so you record personal data about the people you coach. You decide what is recorded and why; the platform stores it, makes it work, and does nothing else with it.

You are the controller and we are the processor. Under US state privacy law the same split is described differently - you are the business or controller and we are your service provider or processor - and under the GDPR, which reaches us where you record data about someone in Europe, this is the Art. 28(3) instrument between us. The obligations below are written once and satisfy both.

We are separately a controller for your own account data - your name, your practice, billing, support threads. That relationship is governed by the privacy policy, not by this document, and the distinction is the one everything else follows from.

We process coachee personal data only on your documented instructions. Using a feature is an instruction: sending a booking link instructs us to email that coachee; turning AI summaries on instructs us to send that text to the model provider named in the sub-processor list.

We will tell you if an instruction appears to infringe applicable data-protection law, and will not act on it in the meantime.

We will not:

• use coachee data for our own purposes, including product improvement;
• aggregate it into anything published;
• sell it, or share it for cross-context behavioural advertising - both terms carry specific meanings under US state privacy law, and both are refused;
• disclose it to a third party except a listed sub-processor, or where legally compelled;
• use it to train any model, ours or a provider's.

We retain it only for as long as clause 9 provides, and we do not combine it with personal data received from anyone else.

Everyone with any form of access is under a written confidentiality obligation that survives the end of their engagement. Access is limited to what a role actually requires.

Annex II sets out the technical and organisational measures in force. They are appropriate to the risk, and are reviewed at least annually and after any incident.

Encryption in transit and at rest is the baseline. End-to-end encryption under a coach-held key is deliberately not implemented across the product: it would make document generation, AI features and transactional email impossible, and a risk-based standard does not require it. It is implemented for portal messages, where none of those things apply - there, we hold neither the plaintext nor any key that opens it.

You give general authorisation for the sub-processors listed at /subprocessors. We will give at least 30 days' notice before a new one starts handling data, through the in-app News pane and by email.

If you object on reasonable data-protection grounds within that window, we will either provide an alternative or allow you to terminate without penalty for the remainder of any period already paid for.

Each sub-processor is bound by a written contract imposing the same obligations set out here. We remain fully liable to you for their performance.

We will assist you, taking into account the nature of the processing:

• Data-subject and consumer requests. While your account has an active paid plan, coachee data is exportable by you in bulk and per record, without needing to contact us. While it is read-only or closed, self-service export is not available; if a coachee makes a data-subject request in that period, tell us through support and we will provide that coachee's data to you so you can answer it. A request that reaches us directly is routed to you, logged, and not answered - you are their controller, and answering over your head would be us deciding something that is yours to decide.
• Security, breach notification and impact assessments, with information proportionate to what we actually hold.

We will notify you without undue delay after becoming aware of a personal data breach affecting your coachee data, with the nature of the breach, the categories and approximate number of records and data subjects, the likely consequences, and the measures taken.

We do not notify your coachees. You are their controller and that contact is yours to make. Our runbook sets out the process, including the 72-hour clock your own duty may run on.

On termination you may still sign in and read everything during the 90-day closure period; exporting requires reactivating a paid plan before it ends, and a coachee's data-subject request is answered through support as above. At the end of the period, coachee data is deleted.

Records we must keep by law - principally invoices and countersigned agreements - survive that deletion. The final closure notice says which, and it is the same list the software enforces rather than a separate one written here.

We will make available the information needed to demonstrate compliance with this agreement, and will allow and contribute to audits by you or an auditor you mandate, on reasonable notice, no more than once a year unless an incident makes more necessary. Annex II, the sub-processor list and the access register are the ordinary form this takes.

We are a Florida limited liability company, established in the United States, and we host in US regions. The service is sold in the United States, so for most coaches there is no cross-border transfer to consider at all.

Where you record personal data about someone in the EU, the EEA or the UK, that data is nonetheless transferred to the United States, and the transfer needs a basis. We rely on the European Commission's Standard Contractual Clauses (Module 2, controller to processor), together with the UK International Data Transfer Addendum where the UK GDPR applies, and a transfer impact assessment covering US government access.

The SCCs are incorporated into this agreement by reference. Where this agreement and the SCCs conflict, the SCCs prevail.

This clause exists because it is the question every procurement review asks, and because the answer is a property of the software rather than a promise about behaviour.

There is no impersonation, ever. No administrator can sign in as a coach, at any privilege level, for any reason. There is no function that does it.

The administration console cannot emit coachee personal data. Three layers make that true: its data sources are your account record and a nightly table of integers; the database client it is given throws on every row-level read or write of a coachee-owned model, so only counts and aggregates pass; and a test fails our build if any console code reaches for the unrestricted client.

What is NOT claimed. We operate the database and hold its credentials. Direct database access therefore exists, outside the console, and it is a break-glass procedure requiring a ticket, a stated reason, a time box and an entry in an access register. Only coach-held-key encryption would remove that access, and for the reasons in clause 5 it is not implemented outside portal messages. A processor claiming its staff could not reach the data would be making a claim that could be falsified - so we describe the control instead.

Liability under this agreement is subject to the limitations in the Terms of Service. Where the Terms and this agreement conflict on the processing of coachee personal data, this agreement prevails.

• Annex I - parties, processing description, sub-processors. Clause 2 above, plus /subprocessors.
• Annex II - technical and organisational measures. Available on request, and to any coach exercising the audit right in clause 10.
• Annex III - list of sub-processors. /subprocessors, as updated from time to time under clause 6.

The processor under this agreement is My Coaching Practice LLC, a limited liability company formed in Florida, United States. This agreement is written and published in English, and English is the language of the agreement.