Privacy Policy for a Coaching Business: 7 Sections to Check
Coachful
Editorial Team
Can you use a privacy policy template for your coaching business, or will it promise things your practice does not actually do? Use a template as a structure, not as the answer. First list the information you collect, its purpose, who receives it and how long you keep it. Then write a notice that describes those decisions accurately.
A convincing privacy policy cannot rescue an unnecessary intake question, an unexpected recording or a shared folder with the wrong permissions. The useful document is the one a prospective client can read and your actual working process can support.
This guide gives coaches seven sections to check and a drafting outline. It is general educational information, not legal advice or a universal compliance template. Applicable duties depend on your location, clients, services and processing. A privacy professional should resolve your jurisdiction-specific requirements, especially for sensitive information, children or employer-sponsored coaching.
Before drafting: map the information, not just your website
Your coaching website is only the front door. Personal information may arrive through enquiries, discovery-call bookings, referrals, intake forms, client messages, assessments, payment records and session recordings. Analytics and advertising tools can add a separate stream.
For each source, record five facts: the information involved, why you need it, the system receiving it, the people or providers with access, and the retention rule or decision still needing advice. Include exports and offline copies. A spreadsheet downloaded by your assistant does not stop being personal information because it left your platform.
For example, a fictional career coach might collect a name and email to arrange a discovery call, career goals to prepare coaching, and billing details to issue an invoice. Those are separate purposes. The coach should not silently turn the career-goals response into advertising material or assume that booking the call subscribes someone to a newsletter.
If the inventory reveals a question you cannot justify, remove or narrow it before drafting a disclosure. “We collect anything you choose to tell us” is not a sensible design brief for a coaching form.
1. Identify the practice and the people the notice covers
Start with the actual business responsible for the relevant processing and a usable contact route. A trading name, legal entity and platform provider may be different organizations. Explain the relationship in plain language instead of copying the software company's identity into your own notice.
State whether the notice covers website visitors, prospective clients, individual clients, group participants or other relevant people. If an employer refers participants, describe that arrangement accurately. Do not assume the person paying for coaching is the same person whose information you hold.
Coachful's published platform privacy policy describes its own processing and responsibilities. It also explains that a coach or organization providing the service is responsible for determining its lawful basis, relevant notices and professional obligations. Linking to a platform policy can help explain a provider; it does not replace your practice's explanation.
Drafting prompt: “[Practice/legal entity] provides [services]. This notice explains how we handle personal information about [relevant audiences]. Contact [monitored business contact] about privacy questions or requests.” Replace every bracket and confirm whether additional representative or data-protection contact information is required.
2. Describe what you collect and where it comes from
Use recognizable categories rather than a vague promise to collect “necessary data.” For a coaching practice these might include contact and booking details, information supplied in an enquiry, coaching goals and agreed progress records, correspondence, payment administration, and website usage information.
Distinguish direct collection from information supplied by another person. A manager's referral email, stakeholder feedback or an assessment provider's report can create transparency duties even when the client did not type the information into your form. Identify the source and follow the applicable timing requirements.
Do not include categories simply because a template contains them. A life coach who does not record sessions should not leave in a paragraph announcing routine recording. Equally, a career coach using a transcription service should not publish a notice that mentions only names and email addresses.
Pay particular attention to free-text boxes. “Tell me everything about your situation” can invite health details, family information or allegations about identifiable colleagues before you have decided how to handle them. Ask for the minimum needed at that stage and explain what people should not submit.
Coachful's current policy states that it is not a clinical or electronic health-record system and lists prohibited clinical and emergency-response records. It also restricts submitting special-category or confidential clinical information to optional AI, broadcast, public/community and connected-integration features. Check those boundaries before designing a workflow, not after a client uploads a file.
3. Connect each use to a purpose and an applicable basis
Explain what you do with each category: respond to an enquiry, arrange a session, deliver the agreed coaching, administer payment, maintain necessary records, send separately permitted marketing, or operate website analytics. Separate purposes when the audience, expectations or legal requirements differ.
Where your law requires a lawful basis, identify the appropriate basis for each purpose. Do not paste “consent” beside every activity or assume that a service contract authorizes all future marketing. Under GDPR-style rules, processing special-category information can also require an additional condition; an ordinary Article 6 basis alone does not settle that question.
A privacy notice informs people. A coaching agreement defines the service and its confidentiality arrangements. A separate consent mechanism records a choice where consent is required. “I have read the privacy policy” should not be made to stand in for newsletter permission, session recording permission and permission to publish a testimonial.
Drafting prompt: “We use [specific information] to [specific purpose]. Where required, our lawful basis is [confirmed basis and relevant explanation]. [Separate optional use] is handled through [actual choice mechanism].” This is a prompt for a verified decision, not a legal basis you can select because it sounds convenient.
For analytics and advertising, check both data-protection and applicable device-storage or tracking rules. A paragraph saying “we use cookies” does not make a tag's behavior lawful. Review the actual tools, settings, visitor choices and jurisdictional requirements with an appropriate adviser.
4. Explain sharing, providers and confidentiality boundaries
Describe the recipients or recipient categories required by your applicable rules. Include the services that actually process information for your practice: hosting or coaching platforms, payment services, calendar or video providers, email systems, relevant contractors and any assessment suppliers.
Do not guess their roles or storage locations. A provider may act on your instructions for one activity and make independent decisions for another. Review its current terms, data-processing documentation, recipient information and any relevant international-transfer arrangements. “Cloud-based” is not a country or a safeguard.
Separate routine service-provider processing from disclosures to employers, sponsors, group participants or a coach's supervisor. If an employer receives attendance or an agreed progress summary, explain that specifically. Payment for coaching is not blanket permission to receive private reflections or complete session notes.
For groups, distinguish what your team can control from what other participants can see or repeat. A private channel is still a place where information is shared with its members. Explain the intended audience and establish group confidentiality expectations without promising that you can technically prevent every participant from copying a message.
Avoid “we never share your data” when you rely on providers to deliver the service. Avoid absolute confidentiality promises that contradict your agreement, legal duties or safeguarding process. Have qualified advice on applicable exceptions; do not invent a universal mandatory-reporting duty for every coach in every country.
5. State retention rules you can actually operate
A useful notice explains the retention period or the criteria used to determine it, as required by the applicable regime. Different records can need different decisions. An unsuccessful enquiry, a paid invoice, a coaching reflection and a recording should not automatically inherit the same period.
Start with your obligations and purposes, then confirm that your tools and internal process can implement the decision. Consider professional and contractual requirements, tax records, legal claims, client requests, backups and necessary marketing-exclusion records. Do not copy another coach's number of years as if it were a universal rule.
Drafting prompt: “We keep [category] for [verified period or understandable criteria] because [specific reason]. When that period ends, we [actual deletion, anonymization or review process], subject to [relevant exceptions].” If the process does not exist, make the operational decision before publishing the promise.
Be especially careful with software subscriptions. Coachful's current policy says cancelling a subscription does not itself delete the stored account and content; account deletion is a separate process. Do not promise clients that their information automatically disappears when you stop paying for a tool.
For a deeper operational decision, use our client record retention and deletion guide. The privacy notice should explain your verified policy, not substitute for creating one.
6. Give people a workable rights and contact route
Describe the applicable rights and how someone can exercise them. Depending on the regime and circumstances, these may include access, correction, deletion, restriction, objection, portability, withdrawal of consent and a complaint route. Do not imply that every right is unconditional or identical everywhere.
Under UK GDPR guidance, the information to provide includes relevant rights and the right to complain to the supervisory authority. Other regimes have their own scope, exemptions and requirements. Identify the rules that actually apply to your practice rather than combining every country's wording into an unreadable global promise.
The public contact method needs an owner. Decide who monitors the inbox, how identity is verified proportionately, where related information is located and when specialist advice is needed. A client should not have to post a privacy request into a group coaching channel.
Do not publish “we delete everything immediately on request” unless that is both lawful and operationally true. Some information may need to be retained for a documented reason. Explain the outcome clearly and follow applicable deadlines instead of inventing your own universal response period.
7. Make the notice accessible at the right moment
Give the current notice a stable public page, a meaningful title and a visible update date. Link to it where people expect to find it, including the website footer. Then check the moments when you actually collect information: enquiry forms, booking flows, newsletter signup and client onboarding.
A short collection explanation can sit beside a form with a link to fuller information. It should identify the relevant use without forcing someone to read a wall of legal prose before asking a simple question. A notice link hidden after submission is not the same as timely information.
Test the page without signing in, on a phone and with images disabled. The policy's substance must be readable text, not a tiny image or an inaccessible PDF. Confirm that the contact method works and that links lead to the current notice rather than a draft, expired domain or another company's policy.
Review the notice when the underlying processing changes: a new recording tool, a new marketing channel, an employer reporting arrangement, an additional provider or a change in retention. Updating the date alone is not a meaningful review. Where required, give people appropriate information before a new use begins.
A coaching privacy policy outline to take to your adviser
Use this as a drafting brief, not as a finished legal document. Keep unsupported claims and unresolved placeholders out of the version you publish.
- Who we are and scope: responsible business, relevant audiences and contact information.
- Information and sources: categories collected directly, from third parties and through website technologies.
- Uses and applicable bases: each purpose, the verified legal position and any additional sensitive-data conditions.
- Recipients and transfers: actual provider and other sharing arrangements, with the information and safeguards your rules require.
- Retention: category-specific periods or criteria that match operational practice.
- Rights and complaints: applicable choices, request route, limitations and supervisory contact where relevant.
- Access and updates: collection-point explanations, public notice location, date and change process.
Add any disclosures your circumstances require, such as relevant automated decision-making, consequences of not providing required information, or information about a representative. Seven headings are an editorial structure, not a guarantee that seven paragraphs satisfy every law.
Frequently asked questions
Can I copy another coach's privacy policy?
No. It may describe different laws, providers, retention periods and client services, and may itself be wrong. Use an appropriately licensed template or professional drafting process, then verify every statement against your own practice. Copying a platform's policy also confuses whose processing is being explained.
Does a privacy policy make my coaching business GDPR compliant?
No. Transparency is one part of compliance. Your collection, purposes, access, contracts, security, retention and handling of requests must also meet applicable obligations. Our broader data protection guide for coaches covers that operational work.
Is this the same as a coaching confidentiality clause?
No. The documents relate, but answer different questions. A confidentiality clause defines agreed boundaries around the coaching relationship. A privacy notice explains personal-information processing and applicable rights. Check that neither promises something the other contradicts.
Should I promise that client information never goes into AI?
Only if that accurately describes your tools, settings and working process. Review optional recording, transcription and AI features before making any statement. An assurance in a notice is not a substitute for checking provider terms or prohibitions on sensitive information.
Make the written promise match the workflow
Choose one real enquiry or client journey and follow the information from collection through use, sharing and retention. Fix one mismatch before adding more policy language. A specific, maintainable notice is more useful than an impressive document nobody can operate.
If you are evaluating Coachful, try the interactive demo to inspect the intake, communication, payment and integration surfaces you would need to include in that inventory. Then review the provider's current privacy documentation and your practice's own obligations before moving client information.
Sources and scope
The ICO's privacy-information guidance explains UK GDPR transparency requirements. Its small-organization privacy notice resource currently notes that guidance is under review following UK legislative changes. Consult current authoritative guidance and qualified advice for your actual jurisdiction. Coachful product boundaries above are drawn from its current published privacy policy, not assumed from screenshots.
