Scope and roles
This Data Processing Addendum forms part of the CoachIntake terms where a coach uses the service to process applicant or client personal data. The coach is controller and CoachIntake is processor, except where each acts as an independent controller for its own obligations.
Processing details
The subject matter is the operation of coaching intake, consultation booking, client account and subscription workflows for the term of the coach's subscription plus the configured deletion period. Data subjects are applicants, prospective clients, active clients and coach account users. Data can include identity and contact details, goals, application answers, booking information, selected plans, subscription status, communications and, only where a coach asks for it and explicit consent is recorded, health or other special-category information.
Instructions and confidentiality
CoachIntake processes personal data only to provide, secure and support the service, on the coach's documented instructions in the agreement and product settings, unless UK law requires otherwise. People authorised to process data are bound by confidentiality duties.
Security
Measures include tenant-scoped row-level database controls, restricted service credentials, encryption in transit and at rest where provided by infrastructure suppliers, short-lived access links, webhook verification, audit events, backups and security testing proportionate to risk.
Subprocessors
Current categories include Supabase for database and authentication, the deployment host, Stripe for payments, OpenAI for filtered summaries, Resend for email and Twilio for WhatsApp. CoachIntake will give reasonable notice of material subprocessor changes and remains responsible for required processor terms.
International transfers
Where personal data is transferred outside the UK, CoachIntake will use an applicable adequacy regulation or approved safeguards, including the UK International Data Transfer Addendum where required.
Requests, incidents and audits
CoachIntake will reasonably assist with data-subject requests, data protection impact assessments and regulator enquiries, taking account of the nature of processing. We will notify the coach without undue delay after becoming aware of a personal data breach affecting their data. Reasonable compliance information will be provided on request.
Return and deletion
On termination or controller instruction, CoachIntake will delete or return personal data unless retention is required by law. Active production records are deleted according to the coach's configured period after an application is declined, cancelled or archived. Encrypted backup rotation may require a limited additional completion period, during which backup data is isolated from ordinary use.