Data Processing Addendum

Client Data means personal data about your clients, members, leads and staff that you put into CoachVana or collect through it: notes, programs and plans you assign, records you import, answers to your forms, leads from your public page, DM link and connected tools, and messages in your threads and groups.

For Client Data, you are the business that decides why and how it is used, and we process it for you, as your service provider or processor, only to provide CoachVana to you.

Your clients and members also have their own CoachVana accounts. What a client logs or writes in their own account (workouts, food, measurements, photos, check-ins), and data from devices they connect, is held by us for that client under our Privacy Policy, and shared with you because the client works with you. You use it for coaching that client, and we each answer for our own handling of it.

• We process Client Data only on your documented instructions, which are the Terms, this addendum and how you use CoachVana, unless the law requires otherwise; if it does, we tell you first unless the law forbids it.
• We do not sell or share Client Data, use it for advertising, or use it for any purpose outside providing CoachVana to you. We do not combine it with data from other sources except as the law allows a service provider to, such as to secure the service.
• We do not use Client Data to train AI models.
• Everyone at CoachVana who can access Client Data is bound to keep it confidential, and access is limited to people who need it to run, support or secure the service.
• We protect it with the measures in the appendix below, and keep them at least as strong during your use of CoachVana.
• We tell you if we can no longer meet our obligations under the privacy laws that apply to us as your service provider, and you may then take reasonable steps to stop and fix any unauthorized use.

You authorize us to use the subprocessors listed on our subprocessors page. Each one is bound by a written contract with data protection terms no less protective than these, and we are responsible for their work. We update that page at least 15 days before a new subprocessor starts processing Client Data, except in an emergency. If you object on reasonable data protection grounds within that time, we will work with you on it; if we can't resolve it, you may stop using the affected feature or close your account and we will refund any prepaid fees for the unused time.

• Requests from people: CoachVana's export, correction and deletion tools let you and your clients answer most requests directly. If a person asks us about Client Data, we pass the request to you unless the law requires us to answer it, and we help you answer it.
• Assessments: we give you the information you reasonably need about our processing for a data protection or risk assessment you are required to do.
• Audits: once a year, or after a breach, we answer a reasonable written questionnaire about our security and this addendum. Anything more is by agreement, at your cost, and under confidentiality.

If we confirm a breach of security affecting Client Data, we tell you without undue delay, and within 72 hours of confirming it where we can, with what we know: what happened, the data involved, the people affected, what we are doing, and who to contact. We update you as we learn more, and help you meet any notice duty you have. Telling you is not an admission of fault.

You can export your data at any time. When you delete your account, Client Data is deleted from the live service at once, and from backups within seven days, except what the law requires us to keep and records the Privacy Policy says are kept without a name. A client's own account and what they logged in it stays theirs.

• You have a lawful basis, and any notice and consent the law requires, to collect Client Data and to have us process it, including for marketing to leads, publishing testimonials, and importing records.
• You give your clients any privacy notice your own business needs, and you tell them you use CoachVana.
• You do not put into CoachVana protected health information on behalf of a health care provider, payment card numbers, government ID numbers, or data about anyone under 18.
• You use the data you see only to coach your clients and run your business with them, and keep your account and the devices you use secure.
• If you connect a tool or an AI assistant, you are the one sending data to that company, under your own agreement with it.

CoachVana is not a HIPAA business associate and does not sign business associate agreements. This addendum is not one. If you are a covered entity, or act for one, do not use CoachVana for protected health information.

Client Data is processed and stored in the United States. CoachVana is offered for coaching people in the United States, and this addendum does not include the terms that the EU or UK GDPR require. Do not use CoachVana for clients in the European Economic Area, Switzerland or the United Kingdom until we offer those terms.

Each party's liability under this addendum is subject to the limits in the Terms, except where the law does not allow it. We may update this addendum to reflect changes in the law or the service, and we tell you before a change that reduces your protections applies.

• Subject matter and duration: providing CoachVana to you, for as long as you have an account.
• Nature and purpose: storing, organizing, showing, sending and analyzing data to run coaching, scheduling, messaging, payments set-up, groups, marketing pages and the features you use.
• People: your clients, members, leads, prospects, staff and coaches.
• Data: names, contact details, social handles, relationship and billing status, notes, programs, plans, messages, form answers, bookings, and the health data described in our Consumer Health Data Privacy Policy.

• Encryption in transit (TLS) and at rest.
• Access rules enforced in the database by row-level security, so a coach can reach only their own clients' data, with automated tests for each table.
• Private file storage reached only through short-lived signed links.
• Production access limited to named team members who need it.
• Daily backups, kept for seven days.
• Card details handled only by Stripe or Apple, never stored by us.
• A written breach response plan, followed for every suspected incident.

Questions about this addendum, or a request for a signed copy: support@coachvana.com.