EazyCoach data-processing terms

Version 2 · Last updated 21 October 2026

These data-processing terms ("DPA") form part of the EazyCoach terms of service between the coach ("Controller", "you") and Simon Joseph, trading as EazyCoach, 103 Fleetham Gardens, Reading, RG6 4BZ, United Kingdom ("Processor", "we"). They meet Article 28 of the UK GDPR, and of the EU GDPR where it applies.

1. Roles

1.1 For personal data about your clients that is processed in your EazyCoach workspace ("Client Data"), you are the controller and we are your processor.

1.2 For your own account, billing and support data, we are a controller under our privacy notice. This DPA doesn't cover that data.

2. Your responsibilities as controller

2.1 You decide what Client Data is collected and why, and you're responsible for having a lawful basis for it. For health data (special category data: weight, body measurements, progress photos and videos, menstrual-cycle and symptom logs, injuries, protocol entries), that includes explicit consent or another Article 9 condition.

2.2 You give your clients a privacy notice that explains your processing, including your use of EazyCoach as your software provider and of its AI features. EazyCoach gives you a notice to start from, and asks each client to read and accept your published notice before they can use the app. The notice's content, and whether it's right for your coaching, stay your responsibility.

2.3 Your instructions to us must comply with data-protection law.

3. Our obligations as processor

3.1 Instructions. We process Client Data only on your documented instructions. These terms, your use of the app's features and your settings are those instructions. If we believe an instruction breaks data-protection law, we'll tell you.

3.2 Confidentiality. Anyone we authorise to process Client Data is bound by confidentiality.

3.3 Security. We keep the technical and organisational measures in Annex 2.

3.4 Subprocessors. You give general authorisation for the subprocessors in Annex 3. We'll give at least 30 days' notice of a new or replacement subprocessor by email or in the app. You may object on reasonable data-protection grounds. If we can't resolve it, you may cancel and receive a pro-rata refund of prepaid fees. Each subprocessor is bound by data-protection terms at least as protective as these, and we remain responsible for them.

3.5 Data subject requests. The app lets you export everything stored about a client (as a data file, or with their photos as a ZIP) and delete a client entirely. Beyond that, and taking into account the nature of the processing, we'll help you answer requests from your clients to exercise their rights. If a client contacts us directly, we'll pass the request to you and won't answer it ourselves unless you ask us to.

3.6 Assistance. We'll give reasonable help with your security obligations, breach notifications, data protection impact assessments and consultations with a supervisory authority.

3.7 Personal data breaches. We'll tell you without undue delay, and in any case within 48 hours of becoming aware of a breach affecting Client Data. We'll include what we know and update you as we learn more, so you can meet your own 72-hour reporting duty.

3.8 Records and audits. We'll make available the information needed to show compliance with this DPA. We'll allow and contribute to audits by you or an auditor you appoint, on reasonable notice, no more than once a year unless a breach or a regulator requires it, at your cost and subject to confidentiality.

4. AI features

When you use an AI feature, the relevant Client Data (for example a client's questionnaire answers, check-in figures and notes, and your methodology) is sent to our AI subprocessor to produce a draft for you to review. It is processed only to produce that draft, and the subprocessor's commercial terms don't allow it to be used to train AI models. Your methodology is used only in your own workspace.

5. Duration, return and deletion

5.1 This DPA lasts as long as we process Client Data for you.

5.2 When your account closes, you can ask for an export of Client Data within 30 days. After that we delete Client Data, including from our subprocessors, within 30 days, unless the law requires us to keep it. Backups expire on the providers' normal cycle.

5.3 You can delete a client from your workspace at any time. That deletes everything stored about them, including their photos and videos.

5.4 You choose how long a deactivated client's data is kept (6, 12, 24 or 36 months; 12 unless you change it). We email you a week before it's deleted, then delete it automatically.

6. International transfers

Client Data is stored in London (database and app functions), and client photos and videos in Western Europe (EU). Some subprocessors are based in, or access data from, the USA (Annex 3). Where Client Data is transferred outside the UK, we make sure an appropriate safeguard is in place: UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework), or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.

7. Liability

Each party's liability under this DPA is subject to the limits in the terms of service, except where the law doesn't allow it to be limited.

Annex 1: Details of processing

Annex 2: Security measures

• Encryption in transit (HTTPS/TLS) for all traffic. Encryption at rest by our database and storage providers.
• Every workspace's data is separated: coach-side pages and actions check that the client belongs to the signed-in coach before reading or changing anything, and an automated test checks every coach action does this.
• Client photos and videos are stored privately and shown only through links that check who is asking and expire after 10 minutes. Nobody outside the workspace can open them, including our own administrators through the app.
• Sign-in through a dedicated identity provider. No passwords are stored by EazyCoach.
• Rate limits on sign-up links, uploads, messaging and AI features.
• Automatic alerts to us when the app hits an unexpected error.
• Least-privilege access to production systems. Production database queries are read-only except for approved changes.
• Database backups and point-in-time branches held by our database provider. A backup is taken before every database change.
• Monthly AI credit limits per workspace.
• A demo client feature that never contacts anyone, so coaches can practise without real data.
• Client payments go straight to the coach's own Stripe account. Card data never touches EazyCoach.

Annex 3: Subprocessors