Legal

Privacy Policy

Last updated: September 9, 2026

CoachSheets is not HIPAA-compliant. CoachSheets is not a covered entity or business associate under HIPAA and must not be used to store, transmit, or process protected health information (PHI) or any clinical, medical, or therapy records. This policy describes how CoachSheets handles non-clinical coaching data only. If you are a licensed healthcare provider, do not use CoachSheets for clinical work.

1. Overview

This Privacy Policy explains what information CoachSheets collects, how we use it, and the choices you have. "CoachSheets", "we", "us" refers to the operator of the CoachSheets service. "You" refers to the coach who holds a CoachSheets account. Your clients are data subjects whose information you enter into the service; as explained below, you are the controller of their data and CoachSheets is your service provider.

By using CoachSheets, you agree to the practices described in this policy and in our Terms of Service.

2. Who is responsible for client data

You (the coach) are the data controller for the personal data you enter about your clients — names, email addresses, phone numbers, worksheet answers, session notes, and related information. You decide what to collect, why, and on what legal basis.

CoachSheets is your service provider (data processor) for that client data. We process client data only to provide the Services to you, on your documented instructions, and under the terms of this policy and our Terms. We do not sell client data and we do not use it for our own marketing.

You are responsible for giving your clients any notice or obtaining any consent they need before their information is entered into CoachSheets, including under GDPR, CCPA, or other applicable data-protection law. We provide tools to help you export and delete client data on request.

3. What information we collect

3.1 Account information (coaches)

When you create a CoachSheets account, we collect:

  • Your name, email address, and password (stored as a one-way hash);
  • Your business name if you provide one;
  • Billing details (processed by our payment processor, Paddle — see below);
  • Account preferences and plan selection;
  • Agreement timestamps recording when you accepted our Terms and this Privacy Policy.

3.2 Client information (entered by coaches)

To deliver worksheets and track progress, CoachSheets stores information you enter about your clients:

  • Client name, email address, and optional phone number;
  • Worksheet assignments, submission answers, and AI-generated summaries;
  • Session records, comments, and timeline entries;
  • Group memberships and program enrollments.

Client phone numbers and notes are encrypted at rest using Laravel's AES-256-CBC encryption. Worksheet submission answers are also encrypted at rest. Other client fields are stored as plaintext in our database.

3.3 Usage and technical data

We automatically collect limited technical information when you use the Services:

  • IP address, browser type, and device type;
  • Access logs and approximate location derived from IP;
  • Product analytics about how features are used (aggregated, not tied to client content).

3.4 Information we do not collect

We do not knowingly collect or store protected health information, clinical records, or any information regulated by HIPAA. We do not collect payment card numbers directly — billing is handled by Paddle. We do not sell personal data to anyone.

4. How we use information

  • To operate, maintain, and improve the Services for you and your clients;
  • To deliver worksheet assignments to your clients by email and magic link;
  • To generate AI summaries of client submissions when you enable that feature;
  • To send you service notifications, account updates, and support responses;
  • To process subscription payments through Paddle;
  • To secure, monitor, and troubleshoot the platform;
  • To comply with legal obligations and enforce our Terms.

We do not use your clients' worksheet answers or session notes to train AI models. AI summaries are generated on demand by a third-party AI provider solely to produce a recap for you, as described in section 6.

Where GDPR applies, we process personal data on the following legal bases:

  • Performance of a contract — to deliver the Services you signed up for;
  • Legitimate interests — to secure, monitor, and improve the platform;
  • Legal obligation — to comply with applicable law;
  • Consent — for optional analytics or marketing communications, which you can withdraw at any time.

For client data you enter as a coach, your legal basis is yours to determine and document. You are responsible for having a lawful basis and, where required, your clients' consent before entering their data into CoachSheets.

6. Third-party service providers

CoachSheets relies on the following categories of third-party providers to operate. Each provider processes only the data necessary to perform its function and under its own applicable terms.

  • Cloud hosting — the server infrastructure that hosts the application and database;
  • Payment processing — Paddle processes subscription billing. Paddle collects billing details directly; we do not store your card number;
  • Email delivery — Resend delivers transactional emails (worksheet magic links, reminders, notifications) to you and your clients;
  • AI summaries — a third-party AI provider processes client worksheet answers on demand to generate a recap for you. The provider is configured not to retain submitted content for model training;
  • Calendar integrations — Google, Outlook, Zoom, and Calendly, when you connect them, to sync sessions and trigger assignments;
  • Automation — Zapier, when you enable it, to connect CoachSheets with other apps you use.

A current list of subprocessors with their purposes and locations is available on request via our contact page. We will notify you in advance before adding or replacing a subprocessor that handles client content.

7. Google Workspace API data

CoachSheets integrates with Google APIs (such as Google Calendar) to sync sessions and trigger worksheet assignments. The use of raw or derived user data received from Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained through Google Workspace APIs is used only to provide or improve user-facing features visible within CoachSheets; it is not transferred to third parties, used for advertising, or used to train AI or ML models.

8. Security

CoachSheets uses industry-standard safeguards to protect personal data, including encrypted (HTTPS/TLS) transmission, encrypted-at-rest storage for sensitive fields (client phone numbers, notes, and worksheet answers), hashed passwords, and restricted internal access.

No service is fully secure, and we cannot guarantee the absolute security of your data. You are responsible for protecting your account credentials and for choosing what client information is appropriate to enter into a cloud-based coaching tool.

CoachSheets is not HIPAA-compliant. We have not entered into business-associate agreements and our controls are not designed to meet HIPAA Security Rule requirements. Do not store PHI or clinical records in CoachSheets.

9. Data retention and deletion

We retain your account information while your account is active. Practice owners can permanently delete a client from the client profile’s More actions menu after confirming their password. This removes the client profile and linked coaching records from the live database, including worksheet answers, workbook responses, 360 feedback, goals, sessions, uploaded session notes, and linked AI summaries. Public links stop working. Archiving retains history and is reversible.

Separate Conductor conversations, unlinked support messages, downloaded exports, delivered messages and external services require separate handling. Stop integrations or remove source data to prevent new imports. We retain source identifiers without imported content to prevent replay of erased imports. This action does not immediately erase backups, operational logs or queued payloads; those follow their retention cycles. Practice billing records and records required by law are retained separately. Contact support for broader erasure requests, including help locating separate records and information about backup retention.

If you cancel your account, you retain access until the end of your billing period. After that, we may delete your account data after a 60-day grace period, unless retention is required by law. We recommend you export any data you want to keep before cancellation.

10. Cookies and tracking

CoachSheets uses essential cookies to keep you logged in and remember your preferences. We do not use advertising cookies or sell tracking data. When marketing analytics is enabled, a first-party session cookie remembers a public landing page and a broad source such as search or referral. After signup, we associate those two fields with your account to measure registrations and first worksheet sends and completions. We do not include search terms, URL query strings, worksheet answers, or client details in this acquisition record. The cookie has no persistent expiry and is cleared when signup completes. You can disable cookies in your browser settings.

11. Your rights

Depending on where you live, you may have the right to:

  • Access the personal data we hold about you;
  • Correct inaccurate personal data;
  • Delete your personal data or request its deletion;
  • Export your data in a portable format;
  • Object to or restrict certain processing;
  • Withdraw consent at any time (where processing relies on consent);
  • Lodge a complaint with your local data-protection authority.

To exercise any of these rights, contact us via our contact page.

For your clients' data-rights requests, you (as the controller) are responsible for responding. CoachSheets will assist you in exporting or deleting client data on your request.

12. Children's privacy

CoachSheets is not directed to children under 16 and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

13. International transfers

CoachSheets and its providers may process personal data in the United States and other countries. If you are outside the United States, your information may be transferred to and processed in the United States, where data-protection laws may differ from those in your country. We use standard contractual clauses or equivalent safeguards where required for such transfers.

14. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or in-app message at least 30 days before the changes take effect. Your continued use of CoachSheets after the effective date means you accept the updated policy.

15. Contact

If you have questions about this Privacy Policy or want to exercise your data rights, contact us via our contact page.