ENNL
Menu
← All articles

Should you choose email or portal coaching as a coach?

Should you choose email or portal coaching as a coach?

Decorative title card with email and portal

Choose a secure coachee portal instead of regular email for sensitive data and practice organization. A portal protects personal data better, saves time, and helps you demonstrate that you comply with the GDPR. The Dutch Data Protection Authority calls security an obligation, not a choice, and a tool like Exantur shows what that looks like in practice.

In short:

  • A secure portal protects client data better than email and reduces administrative time by centralizing everything in one clear place.
  • Under the GDPR, you must conclude a processor agreement with every provider that processes personal data and carry out a risk analysis before you switch.
  • A good portal has EU hosting, multi-factor authentication, access roles, and logging to meet the security rules.
  • The migration process should happen in phases, starting with active clients, and communication with clients should be clearly explained.
  • Email continues to carry risks and does not belong with sensitive or confidential coaching data, whereas a portal protects it better.
Exantur
exantur.com
Bring coaching together in one place
Exantur connects the client portal, goals, check-ins, documents, and session notes to every coaching journey.
Discover Exantur

Table of contents

What is a coachee portal and why is it different from email?

A coachee portal is a secure online workspace where you and your client jointly track goals, progress, and documents. It is not a standalone communication channel like email, but a central place where all information about a coaching journey comes together.

Email sends data out into the world piecemeal, often unencrypted, and scattered across your and your client's inboxes. A portal keeps everything in one place, with encryption and logging that records who viewed what.

You notice that difference immediately in your daily work:

  • You no longer search through old emails for the homework from three sessions ago.
  • Your client fills in check-ins directly in the portal, instead of in separate emails.
  • You see at a glance where everyone stands in their journey, without going through files.
  • There is one place for documents, assignments, and notes, instead of attachments spread across ten different emails.

A coach with multiple clients who switches from email to a portal often quickly notices that administrative time drops considerably. Less searching, less copying, and less risk that an email goes to the wrong person.

Which GDPR rules apply to coaches who work with a portal?

You remain responsible for your clients' data, even when you use a portal from an external provider. Under the GDPR, this is called the controller. The portal provider is the processor, and you must conclude a processor agreement with that party.

Such an agreement is not optional. The Dutch government offers a model version that sets out arrangements on security, subprocessors, and what happens to the data if you stop using the service. Without that agreement, you take on a risk you cannot fully assess yourself.

In practice, it comes down to these steps:

  1. Carry out a risk analysis. Determine what data you process (intakes, session notes, assessments) and how sensitive it is.
  2. Choose appropriate measures. The Dutch Data Protection Authority names HTTPS as an absolute minimum and recommends multi-factor authentication (MFA) as an extra layer of security alongside a password.
  3. Draw up an authorization matrix. Set out precisely who may access which client data, especially if you work with multiple coaches.
  4. Ensure logging. A system that records who viewed or changed something and when helps you demonstrate that you are in control.
  5. Conclude a processor agreement with every provider that processes clients' personal data.

Important: the GDPR requires you to be able to demonstrate that you have taken appropriate technical and organizational measures. This is called the accountability principle, and a well-configured portal with logging and an authorization matrix makes that obligation a lot easier.

EDPB guidelines confirm that responsibility remains with you as the coach, even though the provider does the technical work.

Checklist: what a good coachee portal should offer

Use these points when you assess or compare a portal.

Security:

  • EU hosting, so that data remains subject to European legislation.
  • A standard processor agreement you can sign without hassle.
  • MFA for you and, where possible, for your clients.
  • Clear access roles if you work with multiple coaches.

Coaching features:

  • A dedicated client portal where coachees see their goals and progress.
  • Check-ins between sessions, so you don't go into a session blind.
  • Space for assignments and homework that stay linked to the right journey.
  • Searchable session notes, so you can quickly find what was going on three months ago.

Practice convenience:

  • Integration with your calendar, so appointments don't sit separately in two systems.
  • Video integration for remote sessions.
  • Invoicing linked to the journey, instead of separate Excel files.

Pro tip: Explicitly ask every provider about their processor agreement before you start a trial period. If a provider doesn't have an immediate answer, that's a warning sign.

How do you switch from email to a portal in practice?

The switch doesn't have to become chaotic if you tackle it in steps.

  1. Take stock of what currently goes through email. What data do you currently send around—intake forms, session reports, invoices? While doing so, also carry out a brief risk analysis: what is sensitive and what isn't.
  2. Select a portal based on the checklist above and set up the journey. Migrate data in phases, start with active clients, and only move old files once the system is running smoothly.
  3. Inform your coachees about the change, test first with a small group, and keep a fallback plan on hand for the first few weeks just in case.

A phased switch prevents your clients from getting confused about where they should now look for their homework or the next appointment.

Common mistakes when switching to a portal

A few pitfalls keep coming back for coaches who have just switched:

  • Thinking that purchasing software automatically means you are GDPR-proof. Software helps, but the responsibility stays with you.
  • Not drawing up an authorization matrix, which lets everyone within a practice access all client data.
  • Continuing to use personal email addresses alongside the portal, so you still send sensitive information outside the system.
  • Not signing a processor agreement because it will "come later."
  • Moving all clients over at once without first running a test phase with a small group.

Every mistake can be prevented with the same discipline: follow the checklist, test small, and sort out the paperwork before you go live.

Safeguarding confidentiality: email versus a portal

Email feels familiar, but technically it is one of the weaker spots in your data security. A message can be read along the way, stays in multiple mailboxes, and a misaddressed email is sent in an instant. Coaching often involves vulnerable information—think of Wheel of Life assessments or personal breakthroughs a client shares with you.

If you still want to use email for certain communication, follow a few rules. Never send complete files or assessments as an attachment. Use short, practical messages for logistics such as rescheduling an appointment, and keep substantive coaching information in a secure environment. Also never ask for sensitive information in a reply to an email, because then it ends up in an inbox you don't fully control.

A portal solves this differently. Data stays in one secure place instead of scattered across inboxes. Access is easier to manage: you determine per role who may see what, and logging records who opened something and when. That is not only safer, it also makes clearer who is responsible for what if something goes wrong.

Comparison of email and portal security

The rule of thumb is simple: the more sensitive the information, the less it belongs in an email.

Communicating efficiently together within a portal

A portal works best when coach and coachee use it together as a fixed workspace, not as an extra task alongside email. At the start of a journey, agree on where each type of communication takes place: check-ins and homework in the portal, short logistical questions possibly via another channel.

Check-ins between sessions work better within a portal than through separate emails, because your client fills in a fixed format instead of writing free text. That makes it easier for you as a coach to spot trends over several weeks, instead of scrolling loosely through old messages.

Session preparation also benefits from this structure. If a client fills in a short question or update beforehand, you can start a session more purposefully instead of first catching up for ten minutes. Shared documents and assignments also stay linked to the right journey, so no one is searching for "that file from last month."

It works best when you make a few simple agreements: respond to messages in the portal within a fixed time frame, keep check-ins short and concrete, and actually use the portal for everything related to the content of the coaching. That way it doesn't become an extra system alongside email, but the fixed place where the journey lives.

Communicating efficiently together within a portal — overview diagram

A personal note from Martijn

Coaches who switch from email to a portal notice one thing above all: administrative pressure drops and confidentiality rises at the same time. That may seem like a compromise, but it isn't. A tool like Exantur shows that an integrated portal, EU hosting, and a clear processor agreement aren't a technical luxury, but practical, everyday tools. Start small: test one journey in a portal alongside your existing way of working, and see how much time and hassle you save before you switch everything over.

— Martijn

Exantur as a practical starting point for your switch

There are software tools built specifically around the coaching process itself, not as general CRM systems that also happen to work for coaches. In such a system, coachees get a portal for goals, progress, check-ins, and shared documents, while as a coach you manage client relationships, intake forms, assessments such as DISC and Wheel of Life, and session notes in one place. Data is hosted within the EU, and a processor agreement is available, which is important for GDPR requirements.

You can try Exantur free for 14 days, at no cost during the trial. Use that period to work through the GDPR checklist for coaches and check whether the portal fits how you work. Take a look at the subscriptions and prices to see which package matches the number of clients you support, and start the trial period when you're ready to leave email behind.

Sources

Frequently asked questions

Is email allowed under the GDPR for coaching data?

Email is not forbidden, but it is risky for sensitive coaching information because messages can remain unencrypted across multiple inboxes. The Dutch Data Protection Authority states that appropriate security is mandatory, and a regular email usually does not meet that standard for sensitive records.

What should a processor agreement with a portal provider contain?

A processor agreement sets out how the provider handles security, subprocessors, and the return of data upon termination. The Dutch government offers a model version you can use as a starting point.

What does Exantur cost as a coachee portal?

Exantur offers subscriptions starting at €19 per month for the Mini package, with larger packages such as Starter, Growth, and Practice for practices with more clients or coaches. The current prices and packages are listed on the pricing page.

How do I know if my current security is sufficient?

Start with a risk analysis: what data do you process, and how sensitive is it? The Dutch Data Protection Authority recommends HTTPS as a minimum and advises adding multi-factor authentication and logging as extra protection.

Should I require ISO 27001 certification from my software provider?

No, that is not necessary for most small coaching practices. ISO/IEC 27001 can serve as an extra signal of trust, but a solid risk analysis and a proper processor agreement are more important for a solo coach than certification.

Recommendations