Secure coaching software: privacy and GDPR points to check

At a minimum, GDPR-aware coaching software should host your data in the European Union or under equivalent safeguards, encrypt it in transit and at rest, keep it isolated from other users' data, let you export and delete it yourself, and publish a privacy policy that lists its sub-processors.

The tool does not do everything, though: you decide what information you collect about clients and what you do with it. This article offers general good-practice guidance; it is not legal advice for your specific situation.

For your clients' data, you are generally the controller: you choose to collect a name, a phone number or session notes, and for what purpose. The software vendor then acts as a processor: it handles that data on your behalf and on your instructions, and GDPR (Article 28) requires that relationship to be covered by contractual commitments.

For your own account data (your name, email, subscription), the vendor is the controller. Keeping this distinction in mind tells you what to check with the vendor and what you need to organize yourself.

Running a coaching practice requires very little: identity and contact details, appointment history, payment status and a few notes that support follow-up. That is the data minimization principle: collect only what genuinely serves the coaching.

Some categories of data get special protection under GDPR (Article 9): health, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation. Fitness, nutrition and wellness coaches run into these quickly. Unless you have a strict need and a clear legal basis, keep them out of your management tools.

The answers should be in the vendor's privacy policy and documentation. If you cannot find them, or they are vague, that is an answer in itself.

Step 1 — Map your processing: which data, for what purpose, in which tools, for how long. Data protection authorities such as France's CNIL publish simple record templates for small businesses.

Step 2 — Inform your clients: a few clear lines on your booking page or in your terms explaining what you collect and why. Managing appointments generally relies on performing your contract with the client, not on consent.

Step 3 — Set retention periods and stick to them. For prospects, the CNIL uses three years after the last contact as a benchmark; for former clients, set a reasonable, documented period that also reflects your accounting obligations.

Step 4 — Secure your access: a unique password, two-factor authentication on your email, a locked phone, no shared accounts.

Step 5 — Be ready for requests: a client can ask to access or delete their data, and you are generally expected to respond within one month.

Step 6 — Know how to react to an incident: when a data breach poses a risk to people, GDPR requires notifying your data protection authority within 72 hours.

Follow one typical booking to map your data flows. The client enters their name, email and phone number on your booking page and accepts your cancellation policy. That data is stored in your software, which sends a confirmation email through an email delivery provider.

If you sync your calendar, an event is created there: check what it contains, because calendars are often shared with family or colleagues. If the client pays online, their card details are entered on the payment provider's page and never pass through you. This ten-minute exercise covers most of your processing record for bookings.

Grix data is hosted in the European Union: database and files with Supabase, and the application served by Vercel from the Paris region. Data is encrypted in transit and at rest, and database row-level security ensures no coach can access another coach's data. Google Calendar access tokens are encrypted (AES-256-GCM); Grix only reads your busy times, never the titles or attendees of your own events, and the events it creates for your sessions are private and contain neither client contact details nor your notes.

From Settings you can export all your data as JSON or CSV and delete your account: deletion is immediate and permanent. A deleted client goes to the trash first, from where you can delete them permanently. The client's acceptance of your cancellation policy is recorded at booking, and sub-processors are listed in the privacy policy. Grix is not designed to host health data, though: what you write in your notes remains your responsibility.

Most risks do not come from sophisticated attacks but from everyday habits.