Exporting data from your coaching software: how to do it safely

Exporting data from your coaching software: how to do it safely

Do you want to get your client data out of your coaching software for a migration or a backup? Or is a client asking for it? Then you want three things. Everything has to come across, no one else may access it, and you have to stay within the rules of the GDPR. The GDPR is the European privacy law. In the Netherlands, the Dutch Data Protection Authority supervises that law. In this article you'll read step by step how to prepare an export, make it secure, and then check it. We're writing this for solo coaches and small practices without a technical background.

In short

• First make a list of all the data you have: client profiles, programmes, session notes, goals, documents and invoices.
• Only take what you really need. The GDPR asks you not to process more personal data than necessary.
• Choose a suitable file format for each type of data: a spreadsheet for lists, PDF for reports and original files for documents.
• Never store or send an export without security. A lost export file can be a data breach.
• Afterwards, check whether the counts, links and samples are correct. Do this before you delete anything in your old system.

Table of contents

• What a data export in a coaching practice is
• When you export data
• Step 1: map out which data you have
• Step 2: choose what you really take with you
• Step 3: choose the right file format
• Step 4: export and store securely
• Step 5: check that everything is complete
• When a client asks for their data
• Our view on exporting
• One place for your entire coaching practice
• Frequently asked questions
• Sources

What a data export in a coaching practice is

An export is a copy of your data that you take out of a system and put into a file. You can store, read or load that file into another program. In a coaching practice it almost always involves sensitive information. Think of what a client tells you about work, relationships, doubts or health.

That's why an export is more than pressing a button. You take confidential conversations out of a secure environment and put them into a loose file. That file then sits on your laptop, in your downloads or in a cloud folder. That's exactly where things often go wrong.

A good export has four characteristics:

1. Complete: all the data you need comes across.
2. Understandable: later on you can still see which note belongs to which client and which session.
3. Secure: only you, or whoever you give permission to, can open the file.
4. Limited: you don't take more than you need.

When you export data

Coaches usually export their data for one of these reasons:

• You're switching to different software. You want to bring your clients, programmes and notes over to the new system.
• You want your own backup. You don't want to be entirely dependent on a provider.
• A client asks for their data. Under the GDPR, a client has the right to request their data or have it transferred.
• You're stopping your practice or discontinuing a tool. You then have to decide what you keep and what you delete.
• Your practice is changing. A colleague leaves, you start collaborating, or you split up a practice.

Each reason calls for something different. With a migration you want to preserve as much coherence as possible. With a client request you only hand over that one person's data. With a backup it's mainly about storing securely. Keep your reason in mind at every step below.

Step 1: map out which data you have

Don't start with exporting, but with an overview. Many coaches only realise during a migration how many scattered places they use: a coaching tool, a calendar, an inbox, a chat app, a folder of PDFs and an accounting package.

Divide your data into groups. For each group, indicate how sensitive the data is and whether you need it.

For each group, also note where the data is currently stored. Are your invoices in a different package than your notes? Then you'll need two exports. Also write down what you don't have digitally, such as paper notes.

Pay extra attention to special situations. Do you coach young people, people in a vulnerable position, or clients in a profession where confidentiality weighs heavily? Then the consequences of a breach are greater. In that case, discuss your approach in advance with a privacy lawyer or with your client company's data protection officer.

Step 2: choose what you really take with you

An export is a good moment to tidy up. The GDPR asks organisations to not process more personal data than necessary for the purpose. That also applies to you as a self-employed coach.

For each group, ask yourself three questions:

1. Do I still need this for my work? An ongoing programme, yes. A client who stopped four years ago, maybe not.
2. Do I have to keep this? Invoices often have to be kept longer for your administration. Ask your accountant how long that applies to your situation.
3. What did the client expect? Do you mention a retention period in your coaching agreement or privacy statement? Then stick to it.

Data you no longer need, you don't take with you. Afterwards, also delete it in the old system. That way you reduce the risk: what isn't there can't leak.

Step 3: choose the right file format

Software usually offers an export in one or more forms. Each form has its own purpose.

For a migration you usually need a combination: a table of clients and programmes, plus the notes and documents per client. Ask your new provider in advance which format they can import. That way you avoid an export that the new system doesn't understand.

Also keep the extra information around your data. Think of the date of a session, the moment a note was made, and the programme a goal belongs to. Without that information, a note is a loose piece of text. The Dutch Data Protection Authority also mentions this in relation to transferring data: where possible, provide relevant additional data, such as timestamps, so that the meaning is preserved.

Step 4: export and store securely

Information security is about three things. The municipality of Rotterdam describes them in its privacy policy: confidentiality (no access for unauthorised persons), integrity (data is accurate and complete) and availability (you can access it when you need it). Those three also apply to your export. The same policy states that the loss of personal data, which makes it no longer available, is also a data breach.

What does that mean in practice?

• Export on a trusted device. Not on a shared computer or a computer in the library.
• Put the file straight into a secure folder. Use an encrypted folder or an encrypted zip file with a strong password. Encryption means the file is unreadable without the password.
• Never send an export as a plain email attachment. Use a secure way of sharing and send the password via another channel, for example by text message.
• Limit who may export. Do you work with several coaches? Agree on who may make exports and who may delete data.
• Use MFA. MFA stands for multi-factor authentication: in addition to your password, you confirm the login with a code on your phone. That way, someone with only your password can't access your data.
• Clean up temporary files. Afterwards, check your download folder and recycle bin. Exports often sit there unnoticed.

Do you still lose a file, or has someone else opened it? Then you may be dealing with a data breach. Check the website of the Dutch Data Protection Authority to see what to do and whether you need to report it.

Want to know where your practice stands right now? Take the short coaching privacy check or go through the GDPR checklist for coaches.

Step 5: check that everything is complete

An export that looks good is not yet complete. So always check everything before you delete anything in your old system.

1. Make a field list. For each table, write down which columns it contains and what they mean. For example: "status" can be "active", "paused" or "completed". Also note which fields must always be filled in, such as name and email.
2. Count. How many clients, programmes, sessions and invoices did you have in the old system? Do those numbers match the export?
3. Check the links. Does each note still belong to the right client and the right programme? This is where exports most often fall short.
4. Take a sample. Choose five clients, preferably with long programmes. Compare their notes, goals and documents in the old and the new system.
5. Check special characters. Names with an umlaut or accent and long notes with bullet points sometimes get damaged. Check whether they came across correctly.
6. Keep the original temporarily. Hold on to your old account or an encrypted copy until you're sure everything is correct. Choose a date on which you delete it for good.

Are you moving to a new system? Then first import a small part, for example three clients. Only once those come across correctly do you transfer the rest.

When a client asks for their data

An export can also start with a client. The GDPR gives people the right to data transfer, also known as data portability. That means someone can request their data to keep it themselves or give it to another party.

According to the Dutch Data Protection Authority on data portability, the following applies:

• You hand over the personal data the client provided to you themselves.
• You deliver it in a structured, commonly used and machine-readable format. Machine-readable means a computer can read the file, such as a CSV file. A scan or photo of a document is not.
• You carefully verify whether the person making the request really is the client. That way you prevent handing over data to the wrong person.
• The right to transfer does not release you from your duty to secure the data properly.

The right to transfer concerns digital data. According to the GDPR manual of the Dutch Data Protection Authority, paper records are not covered. A client can, however, ask through other GDPR rights, such as the right of access, which data you hold.

Are you unsure whether your own notes about a client fall under the request? Then put that question to a privacy lawyer. In any case, note when the request came in, how you verified the identity, and what you delivered.

A tip from another sector: the insurance industry works with fixed agreements on how data is transferred. According to SIVI, such a standard also helps to exchange only the necessary data. For you as a coach, the lesson is: create a fixed setup for such a request. That way you don't have to work out what to deliver all over again each time.

Our view on exporting

We often see coaches only think about exporting when they want to switch. Then it turns out their practice is spread across five or six places. The notes are in a text file, the goals in a spreadsheet, the check-ins in a chat app and the invoices somewhere else. An export then becomes a puzzle.

That's why we build Exantur around the coaching programme itself. Notes, goals, check-ins, assessments, documents and assignments are linked to the right client and the right programme. You record session notes as observations, insights, breakthroughs and action points. That fixed structure also makes your data easier to understand later on. A note without a client, date or programme says little. A note with that context does.

We also believe you should know exactly where your data is stored. We keep the data in the EU, on servers in Frankfurt. Each organisation is shielded from other organisations. You can use MFA, and there's a data processing agreement. That's a contract setting out how we, as a provider, handle your clients' data. You can read more about that on our pages about GDPR coaching software and secure coaching software.

To be fair: software alone doesn't automatically make your practice fully GDPR compliant. You decide what you record, how long you keep it, and who you share it with. Our advice: before you start, ask every provider how you can get your data back out later. And actually try it during a trial period. That applies to us just as much as to anyone else.

- Martijn

One place for your entire coaching practice

Want to have everything in one place after your export? In Exantur you manage clients, programmes, session notes, goals, check-ins and documents in one workspace. Your clients get their own portal for their goals, progress and check-ins. You can start with a free trial period. After that, the Mini plan costs €19 per month or €190 per year. The Starter plan costs €49 per month. See all the plans on the pricing page or first read how to organise coaching clients.

Frequently asked questions

Am I allowed to simply export client data to my own computer?

You are, as long as you have a clear purpose and secure the data properly. Put an export straight into an encrypted folder and use a device with a strong password. Delete temporary copies as soon as you no longer need them.

Which file format is best for a migration?

That depends on what your new software can import. For lists of clients and programmes, a CSV or Excel file usually works well. Ask the new provider in advance which format they support and test first with a few clients.

Do I have to delete my old data after a migration?

Yes, once you have checked that everything came across correctly. Data you no longer need should not stay in existence. But do watch out for documents you have to keep for your administration, such as invoices, and ask your accountant about the retention period.

Do I have to hand over my session notes if a client asks for their data?

A data portability request concerns the digital data the client provided to you themselves. How that works out for your own notes depends on the situation. Put any doubts to a privacy lawyer and always verify the identity of the person making the request first.

Is a lost export file a data breach?

It can be. The loss of personal data, which makes it no longer available, also counts as a data breach. Check the website of the Dutch Data Protection Authority to see what you have to do and whether you need to report it.

Sources

• The GDPR in brief, Dutch Data Protection Authority
• Right to transfer data (data portability), Dutch Data Protection Authority
• Manual on the General Data Protection Regulation, Dutch Data Protection Authority
• Privacy policy of the municipality of Rotterdam
• Data Portability Standard, SIVI

Recommendations

• Secure coaching software, EU-hosted, GDPR, RLS