Privacy Policy

Parallel.Coach is operated by PARALLEL DEVELOPMENT LTD.

• Company Name: PARALLEL DEVELOPMENT LTD
• Company Number: 17310661
• Company Type: Private Limited Company (Incorporated in England & Wales)
• Incorporation Date: 30 June 2026
• Registered Office Address: Suite A, 82 James Carter Road, Mildenhall, United Kingdom, IP28 7DE

If you have any questions about this policy or how we handle your data, please contact us at:

• Privacy & Data Protection: privacy@parallel.coach
• Legal Enquiries: legal@parallel.coach
• Security: security@parallel.coach

PARALLEL DEVELOPMENT LTD is registered with the Information Commissioner's Office (ICO) in the United Kingdom.

We collect and process the following categories of personal data:

• Account Information: Name, email address, profile photo, and timezone.
• Connected Calendar Data: When you choose to connect your Google Calendar or Microsoft Calendar, we access your calendar list, busy time intervals, and event details strictly required to manage booking availability and create confirmed coaching sessions.
• Coaching Data: Coaching session records, notes created by your coach, action items and habits, goals and metrics, survey responses, and chat messages exchanged with your coach.
• Special Category Data (Health & Neurodiversity): When using our coaching portal, you may voluntarily share reflections concerning neurodiversity (including ADHD, autism, dyslexia), mental wellbeing, executive functioning patterns, or related health context in your coaching notes, surveys, or conversations with your coach. We do not require this information to create an account; when you voluntarily provide it, we process it pursuant to Article 9(2)(a) of the UK GDPR and EU GDPR based on your explicit consent. All such data is strongly encrypted at rest.
• Usage Data: Login timestamps, session attendance, feature usage patterns, and communication preferences.
• Technical Data: IP address, browser type and version, device information, and essential cookies (see our Cookie Policy for details).

We process your personal data under the following lawful bases:

• Consent (Article 6(1)(a)): You give consent when you accept this Privacy Policy during onboarding and account registration. You may withdraw consent at any time by managing your preferences in Settings.
• Explicit Consent for Special Category Data (Article 9(2)(a)): Information concerning neurodiversity, ADHD, mental wellbeing, or health reflections voluntarily entered into coaching records or surveys is processed solely on the basis of your explicit consent.
• Contractual Necessity (Article 6(1)(b)): Processing is necessary for the performance of the coaching service contract between you and your coach, facilitated through our Platform.
• Legitimate Interest (Article 6(1)(f)): We process certain technical and usage data to ensure system security, prevent fraud, maintain data integrity, and optimize user experience.
• Legal Obligation (Article 6(1)(c)): We may process data where required by applicable statutory law or regulatory obligations.

We use your personal data for the following purposes:

1. Service Delivery: To provide and maintain the coaching portal, facilitate communication between you and your coach, schedule sessions, and deliver coaching content.
2. Communication: To send service-related emails (session reminders, action alerts, invitation emails) and, with your consent, product update emails.
3. Platform Improvement: To analyse usage patterns, fix bugs, and improve the user experience.
4. Security & Compliance: To protect the Platform against unauthorised access, maintain data integrity, and comply with legal obligations.

Your data is accessible on a strict need-to-know basis:

• You: You have full access to your own profile and coaching data via your dashboard.
• Your Coach: Your coach has access to the data they need to provide coaching services, including notes, metrics, action items, session history, and chat messages.
• Platform Administrators: Limited to superadmin roles for technical support and compliance purposes, subject to strict confidentiality obligations.

We do not sell your personal data to third parties. We do not share your data with third parties for their own marketing purposes.

We retain your personal data only as long as necessary for the purposes described in this policy:

• Active Accounts: Data is retained while your account is active and your coaching relationship is ongoing.
• Inactive Accounts: If your account is inactive for 24 months, we may flag it for review and reach out before taking any action.
• Deleted Accounts: Upon account deletion, your data is removed within 30 days, subject to any legal retention obligations.
• Backups: Encrypted backups are retained for up to 30 days in accordance with our disaster recovery policy.

Note that coaching notes and session records may be retained by your coach in anonymised form after deletion for legitimate professional record-keeping purposes.

Under UK GDPR and EU GDPR, you have the following rights regarding your personal data:

• Right of Access (Article 15): You can request a copy of all personal data we hold about you. Use the "Export My Data" feature in Settings.
• Right to Rectification (Article 16): You can update your profile information at any time via Settings.
• Right to Erasure (Article 17): You can request deletion of your account and associated data via Settings. We will process this within 30 days.
• Right to Restrict Processing (Article 18): You can request that we limit how we use your data while a complaint is being resolved.
• Right to Data Portability (Article 20): You can export your data in a machine-readable format via Settings.
• Right to Object (Article 21): You can object to processing based on legitimate interest, including direct marketing.

To exercise any of these rights, use the features in your Settings or contact our Data Protection team at privacy@parallel.coach. We will respond within 30 days.

We use vetted third-party service providers (sub-processors) to deliver the Platform. All providers are contractually bound by Data Processing Agreements (DPAs) complying with UK GDPR and EU GDPR standards:

International Data Transfers:

Where personal data is transferred outside the United Kingdom or European Economic Area (EEA), we ensure appropriate safeguards are implemented in accordance with Chapter V of the UK GDPR and EU GDPR. These mechanisms include:

• The UK International Data Transfer Agreement (IDTA) issued by the Information Commissioner's Office.
• The UK Addendum to the EU Standard Contractual Clauses (SCCs).
• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Supplementary technical measures, including per-row AEAD encryption at rest using pgsodium so that stored coaching content cannot be read by underlying cloud infrastructure providers.

When you connect your Google account to Parallel.Coach, our application accesses your Google Calendar data to provide calendar integration and scheduling features.

Limited Use Disclosure:

Parallel.Coach's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What Google Data We Access and Request:

• Calendar List & Free/Busy Status (`calendar.readonly`): We access your list of calendars so you can choose which sub-calendars should be monitored to prevent double-booking, and query busy time slots to calculate and display your available coaching hours to prospective clients.
• Calendar Events (`calendar.events`): We insert, update, and remove confirmed coaching appointments directly on your primary calendar, including adding meeting links and inviting the attendee.

How We Use, Store, and Protect Google Data:

• Purpose: We access Google Calendar data strictly to provide user-facing scheduling, appointment management, and availability calculation.
• No Advertising or Marketing: We never use Google user data to serve advertisements, conduct targeted marketing, or profile users.
• No Sale of Data: We never sell, rent, or lease Google user data to any third party.
• No AI Model Training: We do not use Google user data to train or fine-tune artificial intelligence, machine learning, or large language models.
• Encryption at Rest & in Transit: All OAuth access and refresh tokens are encrypted at rest in our database using libsodium AEAD encryption (pgsodium) with dedicated nonces. All API communication with Google occurs exclusively over TLS 1.3.

Revoking Access and Deleting Data:

You can disconnect your Google Calendar at any time in your Parallel.Coach Settings. Upon disconnection, your stored Google access and refresh tokens are immediately deleted from our database. You can also revoke our access at any time via your Google Account Permissions.

We implement robust security measures to protect your data:

• Encryption at Rest: All sensitive coaching data (notes, actions, metrics, survey responses, chat messages) is encrypted using pgsodium (libsodium AEAD) with per-row encryption keys and unique nonces.
• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.3.
• Access Controls: Row-Level Security (RLS) ensures users can only access their own data. Coaches can only access data of their direct clients.
• Authentication: Secure password policies, magic link authentication, and session management.
• Audit Logging: Key operations are logged for security monitoring.

We use only strictly necessary cookies required for the Platform to function. These cookies are essential for authentication and session management:

We do not use tracking cookies, analytics cookies, or advertising cookies. If we introduce non-essential cookies in the future, we will seek your explicit consent before placing them.

You can control cookies through your browser settings. However, disabling essential cookies will prevent the Platform from functioning properly.

If you have concerns regarding how we handle your personal data, we encourage you to contact us first at privacy@parallel.coach or legal@parallel.coach so we can resolve the matter promptly.

You also have the right to lodge a complaint with your supervisory authority at any time:

UK Residents — Information Commissioner's Office (ICO):

• Website: https://ico.org.uk
• Helpline: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Report a Concern: https://ico.org.uk/make-a-complaint/

EU Residents — European Data Protection Authorities (DPAs):

• If you reside in the EEA, you may contact your national Data Protection Authority.
• A directory of EU DPAs is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or through the Platform and ask you to re-affirm your consent.

The current version of this policy is v1.2, last updated September 2026.