Short answer
Health data is stored in the European Union and encrypted at rest. Coaches sign in with a password and a two-step code. Each coach sees only their own clients, and every read of a client’s data is logged. Anyone can export everything, or delete their account, without asking.
Where data lives
- The app’s database and stored files are on Cloudflare, in its EU jurisdiction, and encrypted at rest. Pages and the app are served over HTTPS only.
- Photos and videos (progress photos, messages, logos) are private. They’re streamed only to the people allowed to see them, never from a public link.
- Card details go to Stripe, never to Holicoach. Clients pay into their coach’s own Stripe account.
Signing in
- Coaches use a password and a two-step code from an authenticator app. Coaching screens stay closed without it.
- Clients use a password, or a one-time sign-in link by email that works for 10 minutes. Coaches can’t use sign-in links.
- Repeated wrong passwords or codes are slowed down. A forgotten password is reset by email.
Who can see what
- A coach sees only their own clients, while the coaching runs. An automated test covers every operation in the app, for every kind of user.
- Coaches see the outcome of a client’s safety screen, not the answers.
- Every read and change of a client’s data is in an audit log: who, what and when, never the content. Clients get it with their export.
- Clients give each consent separately when they join: storing their health information and sharing it with their coach are needed for coaching; AI drafts and anything else are their choice, and can be changed later.
AI
- Next week’s plan is drafted by Anthropic’s Claude only for clients who agreed, from check-in numbers, the current plan and the coach’s rules. No names or contact details go to it.
- A coach approves every draft. Drafts are checked before a coach sees them, and blocked if they mention medication, name conditions or promise results.
- Program imports have names, emails and phone numbers taken out of text before the AI reads them.
Export and deletion
- Coaches and clients export everything, any time, as JSON and CSV files, without asking us.
- Deleting an account deletes its data and files, except payment records, which accounting law requires us to keep without a name.
Who processes data for us
- Cloudflare hosts the site and the app, and sends our emails, with Resend as a backup.
- Stripe processes payments for coaches.
- Anthropic drafts plans and reads imported programs, as above.
- Sentry receives error reports, with no personal data in them.
The full list, and what each one receives, is in the privacy policy.
Frequently asked
Where is health data stored?
In the European Union. The app’s database and stored files (progress photos, message photos and videos, logos) are on Cloudflare in its EU jurisdiction, encrypted at rest. Everything travels over HTTPS.
Who can see a client’s check-ins?
The client, and the coach they joined, while the coaching runs. Coaches see the outcome of the safety screen, not the answers. Every read and change of a client’s data is in an audit log the client can download.
Does the AI see who my clients are?
No. Drafts are made only for clients who agreed to them, from check-in numbers, the current plan and the coach’s rules, never names or contact details. Program imports have names, emails and phone numbers taken out of text before the AI reads them.
Found a problem?
Email support@holicoach.com about anything that looks wrong; we reply within a working day. For your own data, write to privacy@holicoach.com.