Data Handling, Privacy & GDPR

Document version 1.1 · Last updated 17th June 2026

A guide for coaches on how Parallel.Coach handles personal data, what protections are in place, and what it means for you and your clients.

Plain English Summary

Parallel.Coach is built with privacy and data protection at its core. We treat your clients' coaching data as highly sensitive — because it is. Every note, action item, metric, survey response, and chat message is encrypted so that even if someone gained unauthorised access to the database, they couldn't read a single word.

When you and your clients use the platform, you are the ones in control. You decide what data is stored, you can export it at any time, and you can delete it permanently whenever you choose. We don't sell data, we don't use it for advertising, and we don't share it with third parties. We're simply the technology that makes your coaching work — we don't own the content of that work.

Both UK GDPR (post-Brexit) and EU GDPR apply to how we operate, since we serve clients across both regions. Our approach is straightforward: collect only what's needed, encrypt everything sensitive, let users control their own data, and be fully transparent about how it all works.

1. Regulatory Framework

Parallel.Coach complies with:

UK General Data Protection Regulation (UK GDPR) — as enacted by the Data Protection Act 2018
EU General Data Protection Regulation (EU GDPR) — Regulation (EU) 2016/679
Privacy and Electronic Communications Regulations (PECR) — for cookie and electronic communications compliance

The service is operated from the United Kingdom. Where data is transferred outside the UK or European Economic Area, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and the UK ICO.

Data Controller vs. Data Processor

Role	Who	Responsibility
Data Controller	You (the Coach)	You determine what coaching data is collected, how long it's kept, and how it's used in your professional practice. You are responsible for obtaining your clients' consent to coach them and for handling any data you extract from the platform.
Data Processor	Parallel.Coach	We process data on your instructions. We store, encrypt, and serve the data you and your clients create. We do not use the data for any purpose other than providing the coaching platform service.
Joint Controller (limited)	Parallel.Coach	We act as a data controller for strictly limited purposes: account management, service emails, platform security, and compliance with legal obligations.

What this means for you: As a coach, you are the data controller for the coaching relationship. Parallel.Coach is the tool you use. We recommend you have your own privacy notice for your coaching practice that references the tools you use (including this platform).

2. What Data We Collect & Why

Account Information

Data	Purpose	Legal Basis
Full name	Identification, personalisation	Contractual necessity
Email address	Login, service emails, password reset	Contractual necessity
Timezone	Session scheduling, reminder timing	Contractual necessity
Profile photo	Identification within the platform	Consent
Phone number	Session contact (optional)	Contractual necessity

Coaching Data (encrypted at rest)

Data	Purpose	Who Can Access
Coaching notes	Recording session outcomes and observations	You + your client
Action items / habits	Task management between sessions	You + your client
Goals & metrics	Tracking progress over time	You + your client
Survey responses	Pre/post session check-ins	You + your client
Chat messages	Secure messaging between sessions	You + your client
Session records	Scheduling history and attendance	You + your client
Documents	Shared resources and assignments	You + your client

Technical Data

Data	Purpose	Legal Basis
IP address	Security, fraud prevention	Legitimate interest
Browser/device info	Platform optimisation	Legitimate interest
Cookies (auth session)	Essential for login functionality	Legitimate interest / essential
Usage timestamps	Security monitoring	Legitimate interest

What we do NOT collect:

Payment card details (not applicable in closed beta)
Advertising identifiers
Location data beyond timezone
Biometric data
Health data (unless voluntarily shared in coaching notes — and if so, it is encrypted)

3. How Data is Protected

Encryption at Rest (The Important One)

All sensitive coaching content is encrypted using pgsodium, a PostgreSQL extension that wraps the industry-standard libsodium library.

Every note, action, metric, survey response, and chat message is encrypted before it is stored in the database.
Each piece of content gets its own unique encryption nonce — meaning even if two notes contain identical text, their encrypted versions will look completely different.
The encryption key is managed within the database itself (Supabase Vault / pgsodium key management).
Decryption only happens on-the-fly when authorised users request the data through the platform.

What encryption prevents:

A database breach would yield only unreadable binary ciphertext — no plaintext content.
Even a database administrator with full SQL access cannot read encrypted coaching data.
Cloud providers (Supabase, AWS) cannot read your data.

Encryption in Transit

All traffic between your browser and our servers is encrypted using TLS 1.3.
API calls between our application and Supabase/Resend are encrypted.
Certificate management is handled by Vercel's edge network.

Access Controls (Row-Level Security)

The database enforces Row-Level Security (RLS) — a per-query access control system:

A user can only see rows where they are the subject (e.g., their own data).
A coach can only see rows belonging to their direct clients (verified via coaching relationships).
A superadmin can access data only for technical support purposes, under strict confidentiality obligations.
There is no "view all users" or "view all data" capability for any normal user.

Authentication

Passwords are hashed and stored securely by Supabase Auth (bcrypt).
Magic link authentication uses cryptographically random, single-use tokens with 15-minute expiry.
Session tokens are stored as HTTP-only cookies.
Coaches can use an impersonation feature to view their client's dashboard (logged for audit).

4. Access Matrix — Who Can See What

Data	Client (self)	Their Coach	Other Coaches	Superadmin
Own profile	✅ Full	✅ Read	❌	✅ Support only
Coaching notes	✅	✅	❌	✅ Support only
Actions	✅	✅	❌	✅ Support only
Goals/Metrics	✅	✅	❌	✅ Support only
Survey responses	✅	✅	❌	✅ Support only
Chat messages	✅	✅	❌	✅ Support only
Session records	✅	✅	❌	✅ Support only
Other clients' data	❌	❌	❌	✅ Support only
Legal consents	✅	✅ (own clients only)	❌	✅ Full

Superadmin access is limited to a small number of named individuals, logged for audit, and used only for:

Technical support requests
Compliance investigations
Platform maintenance

5. Consent & Onboarding

What We Ask For

Consent	Required?	Purpose
Privacy Policy acceptance	✅ Required	You confirm you've read how we handle data
Terms of Service acceptance	✅ Required	You agree to the terms of using the platform
Data Processing consent	✅ Required	You consent to your coaching data being processed through the platform for service delivery
Product Updates (marketing)	❌ Optional	You agree to receive product tips and feature announcements

How Consent is Recorded

Each consent is stored as a permanent record with: type, granted/denied, policy version, timestamp, IP address, and user agent (for audit trail).
Consents are linked to your profile via a unique constraint — one record per type per user.
If policies are updated, you will be asked to re-affirm your consent.

Withdrawing Consent

Data Processing consent: Delete your account at any time, which withdraws consent for processing.
Marketing consent: Uncheck the box in your consent record or update notification preferences in Settings.
Privacy/Terms acceptance: While you cannot "unaccept" these (they are contractual), you can terminate your account.

6. Data Retention

Data Category	Retention Period	Notes
Active account data	Duration of coaching relationship + account activity	Retained until deletion requested
Inactive accounts	Flagged after 24 months of inactivity	Manual review process — you'll be contacted before any action
Deleted accounts	7-day grace period, then permanent deletion within 30 days	You can cancel deletion during grace period
Backups	30 days maximum	Encrypted backups retained for disaster recovery
Coach records (anonymised)	Indefinitely in anonymised form	Notes of professional record-keeping may be retained without identifying information

Account Deletion Process

The deletion behaviour differs depending on your role:

Role	What happens	Data retained
Client	Hard-delete — all shared data is permanently erased in accordance with the right to erasure (GDPR Art. 17).	Your coach's private notes about you are retained (anonymised — your ID is removed) for their professional records. These are notes that you could never see during the coaching relationship.
Coach	Soft-delete — your profile is archived, PII is wiped, and your auth account is disabled.	All shared coaching data (non-private notes, sessions, messages, actions, metrics, survey responses) survives for your clients. Your private notes are permanently deleted.

Client Deletion Steps

Request: Initiated via Settings → Delete Account
Confirmation dialog: You confirm with a warning of what will be deleted
Grace period (7 days): A confirmation email is sent with a cancellation link. During this period, you can cancel the deletion.
Automated purge (hard-delete): After the grace period, all shared coaching notes, actions, metrics, survey responses, chat messages, sessions, profile, and authentication are permanently deleted.
Coach's private notes: Your coach's private notes survive with your identity removed (your ID is set to null). These remain accessible to your coach.

What a coach sees after client deletion: The client disappears from the coach\'s dashboard. Non-private notes, sessions, and messages about that client are permanently removed. The coach\'s private notes about the client are retained in anonymised form (the client ID reference is removed), preserving the coach\'s professional work product.

Coach Deletion Steps

Request: Initiated via Settings → Delete Account
Confirmation dialog: You confirm with a warning of what will be deleted
Grace period (7 days): A confirmation email is sent with a cancellation link. During this period, you can cancel the deletion.
Automated purge (soft-delete): After the grace period, private notes are permanently deleted, coach-owned resources (templates, documents, invites) are permanently deleted, shared data (non-private notes, sessions, messages, actions, metrics, survey responses) survives for your clients, your profile is archived with PII wiped, and your authentication account is disabled to prevent login.

What a coach's clients see after deletion:Clients retain access to their full shared coaching history (non-private notes, sessions, messages, actions, metrics, and survey responses). The coach will appear as “Deleted Account” in any UI that displays the coach's name. All coach-owned templates, documents, and resources are removed and will no longer be visible or accessible to clients.

7. User Rights & How to Exercise Them

Under UK GDPR (Articles 15–22) and EU GDPR, all users have the following rights:

Right	What It Means	How to Exercise It
Right of Access (Art. 15)	Request a copy of all data we hold about you	Settings → Export My Data — generates a JSON export
Right to Rectification (Art. 16)	Correct inaccurate or incomplete data	Settings — update your name, timezone, avatar
Right to Erasure (Art. 17)	Delete your account and all associated data	Settings → Delete Account — with 7-day grace period
Right to Restrict Processing (Art. 18)	Limit how we process your data while a complaint is being resolved	Email privacy@parallel.coach
Right to Data Portability (Art. 20)	Receive your data in a machine-readable format	Settings → Export My Data — JSON format
Right to Object (Art. 21)	Object to processing based on legitimate interest	Opt out of marketing or email privacy@parallel.coach
Automated decisions (Art. 22)	Not be subject to decisions based solely on automated processing	We do not perform automated profiling or decision-making

Response Timeline: We respond to all data subject requests within 30 days (as required by GDPR). Most rights (access, rectification, erasure, portability) can be exercised immediately through built-in Settings features.

8. Coaches' Responsibilities

Your Role as Data Controller

You determine what coaching data is collected and how it is used in your professional practice.
You are responsible for obtaining your clients' informed consent to be coached.
If you export data from the platform, you become the data controller for that exported data and must handle it in accordance with your own data protection obligations.
We recommend you have your own privacy notice covering what data you collect, how you store it, how long you retain it, and your clients' rights.

Client Data When an Account is Deleted

When a client deletes their account, their data is permanently removed from the platform.
We recommend you maintain your own anonymised records of sessions for professional and insurance purposes, exported before the client initiates deletion.
As the data controller for your coaching practice, you may retain anonymised notes (with all identifying information removed) for legitimate professional record-keeping.

Confidentiality

Your access to client data within the platform is governed by RLS — you can only see your own clients.
You should not share your login credentials with anyone.
You should log out of shared devices.
Any data you download or export from the platform is your responsibility to protect.

Professional Obligations

Parallel.Coach is a tool that supports your coaching practice — it does not replace your professional judgment or obligations.
You remain responsible for the quality, safety, and appropriateness of your coaching services.
If you have concerns about a client's safety or wellbeing, follow your professional code of conduct and safeguarding procedures.

9. Third-Party Processors

All providers are bound by Data Processing Agreements (DPAs) incorporating Standard Contractual Clauses (SCCs) for international data transfers.

Processor	Service	Data Processed	Data Location	Safeguards
Supabase Inc.	Database hosting, auth, file storage	All account and coaching data	US (AWS) with EU option	SOC 2 Type II, SCCs, encryption at rest
Resend Inc.	Transactional email delivery	Email address, name	US & EU	SOC 2 Type II, SCCs
Vercel Inc.	Web application hosting	IP address, request data	Global CDN	SOC 2 Type II, SCCs

International Data Transfer Safeguards

Standard Contractual Clauses (SCCs) — both EU 2021 SCCs and UK IDTA.
Technical safeguards — all sensitive data is encrypted at rest with per-row keys.
Data minimisation — only the minimum necessary data is transferred for service operation.

10. Security Incident Response

Detection: Automated monitoring alerts us to unusual activity or potential breaches.
Containment: We immediately isolate affected systems and revoke any compromised access.
Investigation: We determine the scope and cause of the incident.
Notification: If personal data is involved, we notify affected users within 72 hours and the ICO as required.
Remediation: We fix the underlying cause and implement additional safeguards.

If you suspect a data breach involving your account:

Change your password immediately.
Contact us at privacy@parallel.coach so we can investigate.
If you exported client data and it is compromised, notify affected clients and your professional indemnity insurer.

11. Contact & Complaints

Email: privacy@parallel.coach

Supervisory Authorities

United Kingdom:
Information Commissioner\'s Office (ICO)
ico.org.uk · 0303 123 1113

European Union:
Your local Data Protection Authority (DPA)
List of EU DPAs

12. References

Full Privacy Policy → /privacy
Full Terms of Service → /terms
Data Export: Settings → Export My Data
Account Deletion: Settings → Delete Account
Cookie Consent: Managed via the cookie banner on your first visit

This document is provided for informational purposes and does not constitute legal advice. Coaches should seek independent legal advice regarding their own data protection obligations.