How to Secure Client Data in Your Coaching Practice

To secure client data in a coaching practice, do five things: collect only what you need, keep records in one protected place, control who and what can access them, tell clients plainly how their information is handled, and write down what you will do if something goes wrong. None of this requires an IT department. It requires a short list of decisions, made once and followed every week.

Coaches hold more sensitive material than most people realize: goals, fears, performance concerns, family details, billing information and sometimes health-related disclosures. Clients trust you with it. This guide walks through a practical system you can set up in an afternoon.

TL;DR

• Collect and keep the minimum. The FTC advises holding on to personal information only as long as there is a legitimate business reason.
• Put notes, files, messages and payments in a small number of protected systems, not scattered across inboxes, phones and shared drives.
• Before you use any platform or AI tool with client details, check its security policy, retention, and whether your data trains its models.
• Explain confidentiality and its limits in your coaching agreement and out loud, early.
• Have a short incident plan written before you need it.

Table of Contents

• What client information you actually hold
• Collect less, keep less
• Store records, notes and messages in protected systems
• Lock down devices, accounts and file sharing
• Vet every platform and AI tool before client data touches it
• Know which U.S. rules might apply to you
• Tell clients how you protect their information
• How we think about this at ClickCoach
• Plan for the day something goes wrong
• A 60-minute security setup for this week
• Where ClickCoach fits
• FAQ
• Sources

What client information you actually hold

Start by listing it. Most coaches are surprised by the length of the list. A typical practice holds:

• Contact and profile details, including email, phone and sometimes employer.
• Session notes, goals, action plans, reflections and homework.
• Assessment responses and progress data.
• Emails, texts and messages.
• Contracts, invoices and payment records.
• Recordings, if you make them, and any files clients upload.
• Sensitive disclosures clients share voluntarily: health, relationships, finances, workplace conflict.

The International Coaching Federation (ICF) notes that coaching records can include emails, texts, written notes, recordings, and entries in customer-administration databases. That means your risk is not limited to one “client file.” It lives in every tool where a client’s name appears.

There is also data you never typed. Software platforms commonly log device, connection and usage data automatically. One example is LeggUP’s privacy policy, which separates what users enter (profile, coaching content, assessment responses, billing) from what is collected automatically (device, session and diagnostic data). When you evaluate a platform, read for both categories.

Map where each piece lives

The NIST Privacy Framework starter guide suggests mapping data through its whole lifecycle: collection, use, sharing, storage and disposal. A coach-sized version is a simple table you can build in a spreadsheet.

The last column is the one most coaches skip. Fill it in anyway.

Collect less, keep less

The cheapest way to protect data is to not have it. The FTC’s business guidance is direct: keep only the personal information you need for a legitimate business purpose, and for sensitive information you do not need, do not collect it. It also says to hold information only as long as necessary.

In a coaching practice this turns into a few habits:

1. Trim the intake form. If you do not use a client’s date of birth, home address or health history to coach them, remove the field.
2. Do not store card numbers. Use a payment processor and keep only invoices and receipts. The FTC advises against retaining customer credit-card information without an essential business need.
3. Decide whether to record sessions. Recording is a choice, not a default. Some coaches keep only the contract and contact details plus their own working notes. ICF’s ethics guidance describes this as a matter of professional judgment: define what is genuinely useful, agree confidentiality boundaries, secure the records you choose, and keep a reliable way to destroy them.
4. Set a retention rule. For example: active clients plus a fixed period after the engagement ends, then deletion. Pick the period that fits your contract and any legal obligations, write it in your agreement, and put a calendar reminder to purge.
5. Write notes that you could stand behind. Capture commitments, themes and next steps rather than a transcript of private disclosures.

Store records, notes and messages in protected systems

The ICF Code of Ethics asks coaches to maintain, store and dispose of records, electronic files and communications in ways that promote confidentiality, security and privacy and comply with applicable laws and agreements. That is the professional baseline, whatever tools you use.

Reduce the number of places data lives

Every extra app, spreadsheet and shared folder is another login to secure, another vendor to vet and another place a deletion request has to reach. A coach running intake in one form tool, notes in a document app, homework by email, invoices in a third system and files on a personal drive has five security perimeters, not one.

Consolidating is the most underrated security step. A practice platform that holds session notes, goals, assessments and billing in one workspace gives you a single place to set access, review activity and delete a client’s record when the engagement ends. Whatever you choose, the principle is the same: fewer systems, each chosen deliberately.

Keep communication off the open channel

Clients often text or email you about sensitive topics because it is easy. Offer a better default: a secure client area for messages, files and homework, and a short line in your agreement asking clients to use it for anything personal. A branded client portal is built for this purpose, so clients log in instead of attaching documents to email threads that sit in multiple inboxes indefinitely.

Lock down devices, accounts and file sharing

Software choices matter less if your laptop is open on a café table. The HIPAA Security Rule is written for health entities, not coaches, but its structure is a useful model: designate someone responsible for security, train everyone who handles data, and run regular technical and non-technical assessments. HHS also stresses that these safeguards are scalable to an organization’s size and activities. For a solo coach, “designate a security official” means you, on purpose, with a recurring calendar slot.

A workable baseline for a coaching practice:

• Unique, long passwords in a password manager, and no reuse between your email, platform and payment accounts.
• Multi-factor authentication on email first, since email resets everything else, then on every tool that offers it. The FTC’s Safeguards Rule guidance lists multi-factor authentication and encryption of information at rest and in transit among its expected controls for businesses it covers. It is a sensible standard for you too.
• Device locks and updates. Screen lock, full-disk encryption, automatic operating-system updates, and a way to wipe a lost phone.
• Least privilege. The FTC recommends that each worker can access only the resources their role needs. If you have an assistant or associate coaches, give them access to their own clients only.
• Private networks. Avoid coaching or opening client files on public Wi-Fi without a trusted connection, and keep your home router updated.
• Sharing links, not attachments. Use expiring, access-controlled links where possible, and remove access when a project ends.
• Your website too. If your site collects inquiry forms or hosts a client login, it is part of your attack surface. A WordPress security plugin can add administrative and technical protection for that layer, alongside updates and strong admin credentials.

No setup is perfect. Counseling bodies such as BACP and PACFA make the same point in their record-keeping guidance: absolute digital security does not exist, so the aim is reasonable and appropriate precautions. Treat that as permission to be practical, not an excuse to skip steps.

Vet every platform and AI tool before client data touches it

Coaches adopt tools quickly, especially AI note-takers and summarizers. Each one becomes a vendor holding your clients’ words. The American Psychological Association’s guide to evaluating AI tools gives a checklist that carries over well to coaching. It recommends reviewing the vendor’s security policy, encryption, certifications, privacy policy, data uses and sharing, retention, terms of service, and whether your data trains the AI model or can be excluded.

Turn that into questions you can send to any vendor, ours included:

1. How is data encrypted in transit and at rest? The ICF AI Coaching Framework names confidentiality, integrity and availability as security goals, with encryption at rest and in transit among the safeguards.
2. Who at the vendor can see my clients’ content, and under what circumstances?
3. Is my data used to train AI models? Can I opt out, and is that the default?
4. How long is data retained, and what happens when I delete a client or cancel?
5. Can I export my records if I leave?
6. Which third parties receive data (payment processors, email services, analytics)?
7. Does any legal framework apply to me that requires a specific agreement, such as a business associate agreement?

Put the answers in a folder. If a client asks how their information is handled, you can answer with specifics.

A rule for AI and session notes

Use AI where it removes admin work, not where it removes your judgment. Drafting homework or follow-up actions from your own notes is a reasonable use. Pasting a full transcript with names and personal disclosures into a general-purpose chatbot is not, unless you have checked the terms above. Remove names and identifying details first, and tell clients in your agreement if AI tools touch their information.

Know which U.S. rules might apply to you

Most coaches are not covered by HIPAA, but some are, and the answer depends on your work. HIPAA applies to health plans, health care clearinghouses, qualifying health care providers, and their business associates. A coach who contracts with a health system or provider and handles protected health information on its behalf may be a business associate. A coach working directly with individuals on career or leadership goals usually is not.

Other rules to know about:

• FTC Health Breach Notification Rule. It applies to vendors of personal health records and requires notice to affected individuals and the FTC after a breach of unsecured identifiable health information. It matters mainly if you offer an app or tool that holds health records.
• FTC Safeguards Rule. It applies to businesses meeting its definition of a financial institution, not automatically to every coach. A coach who handles financial planning services may need to look closer.
• State privacy and breach-notification laws. These differ by state and by where your clients live. If you have clients in several states, check the rules for each, or ask a privacy attorney.

If you coach in a regulated setting, such as healthcare, financial services or education, ask your attorney or the contracting organization which rules bind you. That is a legal question, and a short consult costs far less than guessing wrong.

Tell clients how you protect their information

Security that clients never hear about does not build trust. ICF guidance says coaches should explain confidentiality and its limits early, in both the written coaching agreement and verbally during contracting, including what is confidential, the exceptions, and how information is shared with third parties such as sponsors.

Your agreement should cover:

• What is confidential: everything shared in and around the engagement, unless the client consents otherwise.
• Limits: the same source lists safety concerns such as risk of harm, abuse or neglect, legal limits such as court orders or subpoenas, and professional limits such as supervision or ethical review.
• Sponsors and organizations: what you will and will not report to a client’s employer. Agree this in a three-way conversation before the first session.
• Tools and vendors: a plain-language list of where records are kept and whether AI tools are used.
• Recordings: whether you record, why, who sees them and when they are deleted.
• Retention and deletion: how long you keep records and how a client can ask for deletion or a copy.
• Client responsibilities: use the secure portal, do not share login details, and keep sessions in a private space.

Say it out loud in the first session too. Two minutes of plain speech does more than a clause buried on page four.

How we think about this at ClickCoach

Our perspective: security in a coaching practice is mostly an operating habit, not a purchase. The coaches who have the fewest problems are the ones with the fewest places for client data to hide.

ClickCoach was built by a veteran coach who ran a practice on disconnected apps and felt the cost: notes in one place, homework in another, invoices in a third, and clients unsure where to send anything. We bring client records, session notes, goals, action plans, homework, progress tracking, billing and branded client portals into one workspace so there is one login to protect and one place to manage access and deletion.

We also believe in keeping the coach in control of AI. Our AI helps draft homework and follow-up actions, and the coach reviews what goes to the client. Whatever platform you choose, including ours, ask the vendor questions in this article and keep the answers on file. A tool that welcomes those questions is one you can trust more.

— Mitch Russo

Plan for the day something goes wrong

The FTC’s guidance says businesses should have an incident response plan: disconnect compromised computers, investigate promptly, address vulnerabilities, and consider whom to notify. Its separate data breach response guide tells businesses to move quickly to secure systems and fix the vulnerabilities that allowed the breach, and includes physical areas as well as digital ones.

A one-page plan for a coaching practice might read like this:

1. Contain. Disconnect the affected device from the network. Change passwords for email, your platform and payment accounts from a clean device. Revoke shared links and sessions.
2. Identify. What was exposed, which clients, and since when? Your data map from earlier makes this a ten-minute job rather than a week-long one.
3. Fix. Close the cause: a stolen device, a phished password, a misconfigured shared folder, an outdated website plugin. Website security basics such as updates and access controls matter here if the entry point was your site.
4. Notify. Consider clients, your vendors, your insurer, and where required law enforcement or regulators. Notification duties vary by state, so ask an attorney quickly. Tell affected clients plainly what happened, what was exposed, and what you are doing.
5. Document and learn. Record the timeline and the change you made so it does not recur.

Print it, and store a copy somewhere you can reach if your laptop is the problem.

A 60-minute security setup for this week

If you do nothing else, do this:

1. Minutes 0 to 10: List every tool that holds client information.
2. Minutes 10 to 25: Turn on multi-factor authentication for email, platform and payments; install a password manager.
3. Minutes 25 to 40: Remove unneeded intake fields and set a retention period.
4. Minutes 40 to 50: Add a data-handling paragraph to your agreement.
5. Minutes 50 to 60: Write the five-line incident plan above.

Then put a quarterly reminder in your calendar to repeat the review. The HIPAA Security Rule’s call for regular assessments is a good habit for any practice.

Where ClickCoach fits

If your records are spread across notebooks, documents, email and payment tools, consolidating them is the biggest structural improvement you can make. ClickCoach is practice management software for coaches: client records, session notes, goals, homework, billing and a branded client portal in one secure workspace. We are not a directory, a certification provider, or an email marketing tool. We are the operating system for your practice. See how the coaching platform works, or review pricing: $497 per year per coach on the Solo coach and Multi-coach company plans, with a 30-day money-back guarantee.

Before you commit to any platform, send it the vendor questions above. We are glad to be held to the same standard.

FAQ

Do coaches have to follow HIPAA?

Usually not. HIPAA covers health plans, clearinghouses, qualifying health care providers and their business associates. If you work for or with a covered entity and handle its protected health information, you may be a business associate. Ask an attorney if you are unsure.

Is it safe to use AI tools for session notes?

It can be, if you check the vendor first. Review its security policy, encryption, retention, and whether your data is used to train its models. Remove names and identifying details where you can, and tell clients in your agreement that AI tools are used.

How long should I keep client records?

Only as long as you have a legitimate business or legal reason. The FTC advises against holding personal information longer than necessary. Set a period in your agreement, then delete on schedule. Check your state’s requirements or ask an attorney if you are unsure.

Should I record coaching sessions?

Only if it serves the client and they agree. Recording adds a sensitive file to protect and delete. Explain why you record, who can access it and when it will be deleted, and secure it like any other client record.

What is the first thing to do after a suspected breach?

Contain it. Disconnect affected devices, change passwords from a clean device, and revoke shared access. Then work out what was exposed, fix the cause, and ask an attorney about notification duties in your state.

Sources

• ICF Insights and Considerations for Ethics
• LeggUP Privacy Policy
• NIST Privacy Framework starter guide
• FTC: Protecting Personal Information, A Guide for Business
• ICF Code of Ethics
• HHS: Summary of the HIPAA Security Rule
• FTC Safeguards Rule: What Your Business Needs to Know
• PACFA: Maintaining client records
• APA: Evaluating AI tools
• ICF AI Coaching Framework and Standards
• HHS: Summary of the HIPAA Privacy Rule
• 16 CFR Part 318, Health Breach Notification Rule
• ICF: Can a coach break confidentiality?
• FTC: Data Breach Response, A Guide for Business