Can Coaches Use ChatGPT With Client Information?

Can coaches use ChatGPT with client information? Yes, but only in a narrow way: tell clients in writing that you use AI tools, get their agreement, strip out anything that identifies them before you paste, keep health and other sensitive details out entirely unless you have explicit consent and a tool you have vetted for it, and check what your ChatGPT account does with conversations. Pasting a named client's raw session notes into a personal chatbot account is the version that gets coaches into trouble. The exact legal duties depend on where you and your clients live (the EU and UK have stricter rules than most US states), so treat this as a practical guide, not legal advice, and check with a privacy attorney if you handle health data or work inside an organisation.

We make Coachful, a coaching platform, so we think about this question every day: Coachful includes an AI assistant, Michelle, that works from the client records already in your account, and an AI Coach you can switch on for chosen clients. That does not change the answer above. The same consent, minimisation and judgement rules apply to any AI tool, ours included, and most of this article is about habits you can adopt today whatever software you use.

The checklist: what to do before any client detail goes into ChatGPT

Run through these eight items once when you set up your practice, and the first four again every time you open a chat window with a client in mind. If you can tick every row, you are in a defensible position for most coaching work.

The rest of this article explains why each row is there, which rules sit behind it, and gives you wording to copy for the agreement, the conversation and the opt-out.

Why does pasting client notes into ChatGPT matter at all?

It matters because the client told you, not a software company. Coaching runs on candour: people say things in sessions they have not said to their partner or their manager. When you paste a session note into a general-purpose chatbot, you move that disclosure to a third party whose storage, retention and review practices the client never agreed to. Even if nothing bad ever happens, the client's trust was built on a promise you quietly widened.

There are three concrete risks, in rough order of likelihood:

• Trust and reputation. A client sees an AI-shaped summary, asks how you wrote it, and learns their story went into a chatbot. For a coach in their first two years, living on referrals, one awkward conversation like that can cost more than any fine.
• Contract and ethics. Your own agreement probably promises confidentiality. If you hold a credential, your professional body's code almost certainly does too. Using a third-party tool without telling the client can breach both, even where no privacy law applies.
• Law. If you or your clients are in the EU or UK, privacy law applies to you as a sole trader, and health or sexuality details carry extra rules. In the US, the picture is patchier, but some state laws and some client contracts reach coaches.

A fourth risk is less obvious: quality. AI summaries can sound confident and still be wrong. If a model invents a detail ("she mentioned her divorce") and that line ends up in your notes, you have created an inaccurate record about a real person. Reviewing every output is not only courtesy; it is how you keep your records true. For a broader look at protecting what clients tell you, see our guide to client confidentiality in coaching.

What do privacy laws actually say about AI tools and client data?

No major privacy law bans coaches from using AI. What the laws do is set conditions on handing personal data to another company, and those conditions are stricter for sensitive data. The table below summarises where you are most likely to sit. It is a starting point, not legal advice: rules change, and your situation (where you live, where clients live, whether you work through an employer or health plan) decides which apply.

GDPR and UK GDPR in plain terms

According to the summary of the GDPR on Wikipedia (as listed in November 2026), the regulation requires that personal data be processed "lawfully, fairly and in a transparent manner", with at least one legal basis, and under principles including purpose limitation, data minimisation and storage limitation. Where consent is the basis, it must be specific, freely given, plainly worded and unambiguous. The same summary notes that the UK enacted its own "UK GDPR" after leaving the EU, and that controllers must report qualifying data breaches to regulators within 72 hours.

For a coach, that translates into three habits. First, say in your agreement and privacy notice that you use AI tools and for what. Second, only send what the task needs (a de-identified paragraph, not the whole file). Third, remember that health information, sexual orientation, religious beliefs and similar details belong to the GDPR's "special categories" under Article 9, which need an extra condition such as explicit consent. If a client's sessions revolve around a diagnosis, a fertility journey or a faith crisis, that is exactly the material you should keep out of a general chatbot unless the client has explicitly agreed and you have checked the provider's terms.

Under GDPR you are usually the "controller" of your clients' data, and an AI provider handling it on your behalf acts as a "processor". Controllers stay responsible for what their processors do. In practice that means reading the provider's data processing terms, which not every plan offers. Check the current terms for the plan you are actually paying for.

Does HIPAA apply to coaches?

Usually not, but it can. The Wikipedia summary of HIPAA (as listed in November 2026) explains that its privacy rules apply to "covered entities": health plans, health care clearinghouses, and health care providers that transmit health data in regulated transactions. HHS extended the privacy rule to "business associates", the contractors of covered entities. HIPAA also does not restrict what a person chooses to share about their own health with people who are not covered entities.

So a health coach who sells directly to the public and does not bill insurance is generally not a covered entity. A coach who delivers a wellness programme under contract with a health plan, a hospital or a medical practice may be a business associate, with a signed agreement setting out exactly what they may do with patient information. If that is you, the answer to "can I use ChatGPT with this data?" comes from that contract and the organisation's compliance team, not from this article.

Two more points for health, fitness and nutrition coaches. Coaching is not medical treatment: if a client describes symptoms, medication changes, disordered eating or thoughts of self-harm, your job is to refer them to a qualified professional, not to ask a chatbot for an interpretation. And if you are also a licensed clinician (a therapist, dietitian or nurse who coaches), your licensing board's rules on records and confidentiality apply to you as well. This is not legal or medical advice; if you are unsure whether HIPAA reaches your work, ask a healthcare attorney. More on the line between coaching and care on our page for health coaches.

What does coaching ethics expect, even where no law applies?

Professional codes ask for more than the law in most countries. The International Coaching Federation's Code of Ethics, which ICF credential holders agree to, commits coaches to maintaining confidentiality with clients and sponsors, to clear agreements about how information is shared, and to honest representation of how they work. None of that forbids AI. All of it points the same way: the client should know, the client should have a say, and you should not share more than the purpose needs. If you hold an ICF credential or are working towards one, read the current Code on the ICF's own site and map each AI use against its confidentiality and agreement standards.

Practically, ethics adds two things the law may not:

1. Disclosure even when it is not legally required. A US life coach with no state privacy law in play still owes clients honesty about who sees their words.
2. Responsibility for the output. If you send a client a reflection written by AI, it goes out under your name and your professional judgement. You should be able to stand behind every sentence.

The same honesty applies to marketing. If you use AI to draft social posts that describe client results, the FTC's guidance on endorsements says testimonials must reflect real, honest experience and must not be misleading (FTC Endorsement Guides: What People Are Asking). An AI-polished "client story" that no client actually told is a fabricated testimonial, whatever tool wrote it.

Which AI tasks are fine, which need consent, and which are off limits?

Most of the value coaches get from ChatGPT does not need client information at all. Drafting a programme outline, writing a welcome email template, brainstorming reflective questions on procrastination, planning a workshop: none of these needs a single real detail. Sort your uses into three groups and you will find the risky group is small.

If you are curious where AI fits from the client's side, our piece on what a ChatGPT life coach can and cannot do covers the same boundaries from the other direction.

How do you de-identify a client note before using AI?

De-identifying means removing anything that, alone or combined, could point to one real person. A first name alone is obvious. Less obvious is the combination of "VP of marketing at a fintech in Austin, recently divorced, two kids at the same school": no name, but anyone in that company would recognise her. Use this routine every time.

1. Start from a copy. Never edit your original notes; work on a scratch copy you will delete.
2. Replace the name with a role. "Client A" or "the client" is enough. Do the same for partners, managers, children and friends ("her manager", "his sister").
3. Remove direct identifiers. Email, phone, address, date of birth, company name, school names, social handles, exact job title if it is unique.
4. Blur indirect identifiers. City becomes region or nothing; "fintech in Austin" becomes "a tech company"; exact ages become ranges; distinctive events ("after the Hawaii offsite") become generic ("after a team trip").
5. Remove sensitive categories. Diagnoses, medication, therapy history, sexual orientation, religious practice, immigration status, criminal records, detailed debts. If the coaching question truly depends on one of these, stop and decide whether you need AI for this at all.
6. Keep only what the task needs. If you want three reflective questions for next week, the AI needs the theme ("avoids conflict with senior colleagues, wants to ask for a promotion"), not the full session.
7. Read it as a stranger would. Could a colleague, partner or neighbour of the client recognise them from this paragraph? If yes, cut more.
8. Delete the scratch copy and, if your settings keep history, the chat.

Here is the difference in practice:

Before (do not paste): "Maria Lopez, 41, head of marketing at Brightpath Finance in Austin. Separated from her husband Tom in August, on sertraline since September. Says her CEO Dan undermines her in board meetings. Wants to ask for the CMO role before Q1 planning."

After (fine to paste, with disclosure in place): "Client is a senior marketing leader in her early forties going through a stressful personal period. Feels undermined by her boss in high-stakes meetings and wants to ask for a promotion in the next few months. Suggest five open coaching questions to help her clarify what she wants and what she is afraid of."

Notice what went: the name, employer, city, husband's name, medication, the CEO's name and the planning cycle. Nothing the AI needed was lost.

What should your coaching agreement say about AI?

One paragraph, in plain language, plus a choice. You do not need a separate AI policy document when you are starting out. Add the clause to your agreement and keep the signed copy on the client's record. If you are building your agreement from scratch, our coaching contracts page and templates for coaches are good starting points. Have a local lawyer review the final wording, because contract and consumer law vary by state and country.

Copy and adapt this clause:

Use of AI tools. I use some artificial intelligence (AI) tools to help me prepare for sessions, draft resources and handle administration. When I use these tools in connection with your coaching, I remove your name and details that could identify you before entering any information, and I do not enter health, medical or other sensitive information about you without asking you first. I review everything an AI tool produces before it reaches you, and I remain responsible for my coaching. I do not use AI tools to make decisions about you.

Please tick one:
[ ] I agree to the use of AI tools as described above.
[ ] I agree, and I also agree that our sessions may be recorded and transcribed so I can review them. Recordings are deleted within [30] days.
[ ] I prefer that my coaching information is not used with AI tools.

A few notes on the wording. The third option has to be real: if a client ticks it, you prepare by hand for that client. The recording option is separate because recording a session is a bigger step than pasting a de-identified line, and in some places recording a conversation needs the consent of everyone on the call anyway. The retention period in brackets is yours to set; pick something you will actually honour.

If you coach inside organisations, add a sentence covering the sponsor:

I will not enter your employer's confidential information into AI tools unless your organisation has approved that use in writing.

How do you raise AI with a client without making it awkward?

Bring it up in the onboarding call, before the client signs, in the same breath as confidentiality. Coaches who mention it casually and confidently find clients rarely object; coaches who are caught later find clients feel deceived. Three scripts for the moments that come up most.

Script 1: during the discovery or onboarding call

"One thing I tell every client: what you say in our sessions stays between us. I do use some AI tools behind the scenes, mainly to prepare and to draft worksheets. When I do, I take your name and anything identifying out first, and I never put health details in without asking you. There is a short paragraph about it in the agreement with a tick box, and you are completely free to say no. It does not change how I coach you."

Script 2: asking for consent to record and transcribe

"Would you be comfortable with me recording today's session? I use the transcript to pick out the themes for your next steps, then I delete the recording within a month. If you would rather I did not, I will just take notes as usual. Either is fine."

Script 3: when a client asks "Did ChatGPT write this?"

"Good question. I sometimes use an AI tool to get a first draft of a worksheet or summary, then I rewrite it for you. I never put your name or private details into it. If you would prefer I did not use AI at all for your materials, tell me and I will make a note on your file."

Then make a note. A preference you forget is worse than one you never asked for. If you want to tighten the other edges of the relationship too (response times, message channels, what counts as an emergency), our guide to client communication boundaries pairs well with this.

How should you set up your ChatGPT account before using it for coaching work?

Treat your AI account like any other place client information might live. AI providers change their plans, defaults and terms often, so rather than repeat settings that may be out of date by the time you read this, here is what to look for in your own account today.

• Which plan you are on. Personal plans and business or team plans usually come with different data terms. Read the terms for the plan you pay for, not a blog post about a different one.
• Model training. Look in the data controls for a setting about whether your conversations may be used to improve the provider's models, and set it deliberately.
• History and retention. Find out how long chats are kept, whether deleted chats are removed immediately or after a period, and whether you can use a mode that does not save history.
• Memory features. Some assistants remember details across conversations. Decide whether you want a tool that "remembers" anything about your clients; most coaches should turn it off or keep client material out of it.
• Connected apps and file uploads. Connecting your email, drive or calendar gives the tool access to far more client information than you ever paste. Connect only what you need.
• Who else can log in. A shared family laptop or a shared account with a virtual assistant means someone else can scroll your chat history.
• Two-factor sign-in. Turn it on. A compromised AI account with months of coaching chats is a breach.

Write down what you chose and the date. If a client or a regulator ever asks, "I checked the settings in November 2026 and turned training off" is a far better answer than "I think it was fine".

One more safeguard is worth a sentence: insurance. The SBA describes professional liability insurance as protecting service businesses "against financial loss as a result of malpractice, errors, and negligence" (SBA: Get business insurance). Ask your broker whether your policy covers data mistakes and whether it has any conditions about AI tools; some cyber or professional policies now ask.

A fictional example: one week of AI use done properly

The following is a fictional example built to show the workflow. Priya and her clients are not real people.

Priya is a career coach in her second year, working from Leeds with a mix of UK and EU clients. Because she is in the UK and some clients are in Ireland and the Netherlands, UK GDPR and the EU GDPR both matter to her. Here is how a normal week runs.

Monday. A new client, a product manager in Dublin, books an onboarding call. Priya uses Script 1, and the client ticks the first box in her agreement (AI use, no recordings). Priya adds "AI: yes, no recording" to the client's record.

Tuesday. Priya wants fresh exercises for a group workshop on career pivots after 40. She uses ChatGPT with a generic prompt. No client data, nothing to think about.

Wednesday. Before a session with a long-term client who ticked "no AI", Priya prepares by rereading her notes and writing three questions herself. It takes twenty minutes longer. She does not cut the corner.

Thursday. A client who agreed to recording mentions, mid-session, a recent anxiety diagnosis. After the call, Priya edits the transcript before using it: the diagnosis comes out, as do names of colleagues. She asks the AI only for themes about confidence in interviews. The raw recording is set for deletion at 30 days.

Friday. Priya's monthly clean-up: she deletes old chats that touched client work, checks that her data settings have not changed after an app update, and confirms that recordings older than 30 days are gone. Fifteen minutes.

Nothing in Priya's week is exotic. The difference between her and a coach who pastes everything is about an hour a week and a paragraph in an agreement.

Setting it up in Coachful when you are starting out

If you are building your practice now, it helps to have one place where the agreement, the consent tick, the notes and any AI help all live together, rather than client details spread across a document folder, an email inbox and months of chatbot history. That is the job Coachful does. Coachful is a coaching platform with booking, payments, contracts, programmes, client records, a community and an AI assistant behind one login for you and one branded app for your clients. It suits coaches who deliver programmes and want to replace four to six separate tools; it is not a clinical records system.

Here is how the checklist maps onto it:

• Agreement and consent. Coaching agreements with e-signature go out before the first call and are stored on the client record, so your AI clause and the client's choice sit next to their notes. See coaching contracts.
• Notes in one place. The client record holds goals, check-ins, habits, notes, intake answers, tags, payments and sessions, so you are not pasting histories between apps to get context.
• AI that works from your records. Michelle, the built-in AI assistant, works from your live practice data: it briefs you before sessions, summarises recorded sessions and drafts emails and content. Your consent rules still apply: only use session summaries for clients who agreed to recording, and review every draft. More on the AI coaching assistant page.
• AI Coach only for chosen clients. The AI Coach, an AI version of you that clients can chat with between sessions, is something you switch on per client. Offer it only to clients who have agreed to it.
• Exports and portability. You can export full client data as a ZIP (roster, notes, check-ins, goals, habits, sessions, form responses), which helps when a client asks what you hold about them. Coachful describes itself as GDPR-ready.

The client profile above is where a consent note belongs: alongside the progress summary, engagement status and next session, where you will see it before you prepare.

The AI Coach settings let you pick exactly which clients get it, which makes the "only with consent" rule easy to keep. This short walkthrough shows how client records are organised:

What Coachful does not do matters just as much here. Coachful is not HIPAA-certified and does not sign business associate agreements, so it is not the place for clinical records or insurance billing; a coach working under a health plan contract needs that organisation's approved systems. The client app runs under the Coachful listing with your branding, not under your own App Store account.

Why Coachful stands out: a free white-glove service. From Create, choose "We'll build it for you" and describe what you need, such as your coaching agreement form, an intake form or an onboarding programme, and attach up to 8 reference links and 10 files. The Coachful team builds it inside your account, usually within about 24 hours, and leaves gaps for you rather than inventing details. Read how it works in our post on the white-glove service. You can start with a free trial; current plans: Lite: $29/month for up to 5 clients; Solo: $49/month for up to 20 clients; Pro: $99/month with unlimited clients; Studio: $199/month with unlimited clients. If you are new to practice, the page for new coaches shows what to set up first.

What mistakes do coaches make with AI and client data?

Most problems come from habits, not bad intentions. These are the ones to watch for.

1. Pasting the whole session. A full transcript carries names, third parties and asides the client never meant as coaching material. Extract only what the task needs.
2. Assuming "no name" means anonymous. Role plus employer plus city plus life event identifies people. Run the "would a colleague recognise them?" test.
3. Using a personal account for business work without reading its terms. The plan you signed up for years ago to plan holidays may not suit client work.
4. Forgetting third parties. Clients talk about partners, bosses and children who never agreed to anything. Their details deserve the same care.
5. Sending AI drafts unedited. A message in your voice that misremembers a client's goal does more damage than a late reply.
6. Recording without a clear yes. In some places recording a call needs everyone's consent; in every place it needs a conversation.
7. Keeping everything forever. Chat histories, transcripts and downloads pile up. Set a retention rule and keep it.
8. Treating AI as a supervisor. If you are worried about a client's safety or wellbeing, talk to a human: a mentor coach, a supervisor or the appropriate professional. Refer when it is outside coaching.
9. Corporate work in personal tools. A sponsor's confidential slides in a consumer chatbot can break your contract on the first upload.

One habit that prevents several of these at once is keeping a human approval step on anything AI writes for a client. In Coachful's Client Lab, for example, drafted check-in messages for quieter clients wait for the coach to approve and send them, rather than going out automatically.

What does a sensible AI policy look like for a solo coach?

Write it once, on one page, and keep it in your own files. It is for you as much as for anyone who asks. Here is a template you can copy:

• Tools I use: [name the AI tools and the plan you are on].
• What I use them for: preparing for sessions from de-identified notes, drafting worksheets and templates, content ideas, administration.
• What I never enter: client names, contact details, employer names, health or medical information, sexuality, religion, finances in detail, legal matters, or a sponsor's confidential material.
• Consent: AI clause in every agreement; recording only with a separate yes; opt-outs noted on the client record.
• Settings: training [on/off], history [kept/not kept], memory [on/off], two-factor on. Last checked: [date].
• Retention: client-related chats deleted [monthly]; recordings deleted within [30] days.
• Review: I read and edit every AI output before a client sees it.
• If something goes wrong: tell the affected client promptly, delete what I can, and get advice on any legal notification duty (in the EU and UK, some breaches must be reported to the regulator within 72 hours).

That is the whole policy. If your practice grows to include associate coaches, give them the same page and ask them to follow it. For how this fits alongside the rest of your client systems, see our overview of coaching client management software and the client portal onboarding checklist.

Frequently asked questions

Is it illegal for a coach to put client information into ChatGPT?

Not in itself, in most places. It becomes a problem when you share identifiable or sensitive data without telling the client, without a lawful basis (in the EU and UK), or against a contract you signed. De-identify, disclose and check your account terms, and get legal advice if you handle health data.

Do I need written consent, or is a verbal yes enough?

Written is far better, because you can show it later. A clause in your coaching agreement with a tick box is enough for most coaches. Under GDPR, consent for special category data such as health must be explicit, which in practice means written.

Is a client's first name alone identifying?

On its own, rarely, but combined with a job, city or life event it often is. Use a role ("the client") instead of any name; it costs nothing and removes the question.

Can I use AI to transcribe and summarise coaching sessions?

Yes, with a separate, explicit yes from the client before you record, a tool whose data terms you have read, and a short retention period for the raw recording. Remove sensitive details from the transcript before asking for anything beyond a summary.

Does HIPAA apply to my health coaching business?

Generally not if you sell directly to clients and do not bill insurance, because HIPAA applies to covered entities and their business associates. If a health plan, hospital or practice contracts you and shares patient data, you may be a business associate and that contract governs AI use. Ask a healthcare attorney if you are unsure; this is not legal advice.

Is Coachful HIPAA compliant?

No. Coachful is not HIPAA-certified and does not sign business associate agreements, so it should not hold clinical records or be used for insurance billing. It suits coaching records: goals, check-ins, habits, notes and agreements.

What if a client says no to AI?

Then you do not use AI with anything about them, and you note the preference on their record. You can still use AI for generic work, like a worksheet template, as long as nothing about that client goes in.

Should I tell clients if AI helped write their worksheet or summary?

If your agreement already says you use AI to draft materials, you have told them. If a client asks directly, answer honestly. What matters most is that you reviewed it and stand behind it.

What is Coachful's white-glove service?

It is a free build service on every plan: you describe what you want (an agreement form, intake form, programme, website or funnel), attach references, and the Coachful team builds it in your account, usually within about 24 hours. It does not invent credentials, testimonials or prices, and it does not include video recording or ongoing marketing.

How often should I review my AI settings?

When you sign up, after any major app update, and every few months otherwise. Write down the date and what you chose so you can answer a client's question with facts.

This article is general information, not legal, tax or medical advice. Privacy and recording laws vary by country and state; check with a qualified attorney or data protection adviser for your situation.