GDPR coaching software

GDPR-compliant coaching software processes only necessary data on a lawful basis, keeps you as the data controller with the vendor as processor under a DPA, and supports data subject rights such as export and deletion. Software alone does not make a practice compliant; it provides the building blocks you then use correctly.

Exantur processes only what is necessary to run the service, under the GDPR. Data is never sold, used for advertising, or shared with third parties beyond what is strictly required to provide the service.

Data minimization is a principle of the regulation, not just good manners. The less you collect and the less it travels, the smaller your exposure if anything goes wrong. Because the platform is built around the coaching record rather than an advertising or profiling model, there is no secondary use of client data pulling against that principle.

For the coaching data your organization enters, session notes, goals, check-ins, assessment results, you are the data controller and Exantur is the processor. A Data Processing Agreement sets that relationship out, is available on request, and can be downloaded from the DPA page. No software can make your practice GDPR-compliant on its own: Exantur provides the contractual and technical building blocks, and you remain responsible for how you use them.

Individual coachees can request a full export of their personal data or permanent deletion of their account and all associated data. Deletion flows exist for both individual coachees and entire organizations, with a grace period that allows error correction before permanent, irreversible deletion.

These rights are not abstract clauses; a client can and eventually will ask to see or remove their data, and you need to answer without a scramble. Because export and deletion are built into the platform rather than handled as a manual favor, responding to a request is a process you can actually rely on, and the grace period on deletion protects against an accidental, irreversible wipe.

The AI assistant is a paid add-on, off by default and opt-in. When you do enable it, it runs on your own Anthropic API key and drafts things like session summaries, prep briefs and end-of-engagement reports. No client-identifying data is sent to the model, which matters for a GDPR posture: the sensitive record stays in your controlled environment rather than being handed to a third-party model along with names and details. If you prefer not to use AI at all, leaving it off changes nothing about the rest of the platform.

Coaching is not therapy, but coaching notes can still touch on health and other special categories of data under the GDPR, which deserve extra care in how you collect and describe them. Exantur is not HIPAA-certified, which is a US healthcare framework rather than a European one, so if your work genuinely falls under HIPAA you should factor that in. For European coaching under the GDPR, the relevant question is whether you have a lawful basis and appropriate safeguards, and that is where the DPA, EU hosting and access controls come in.

The GDPR is the legal frame; two things underpin it that this page keeps deliberately short. Where the data physically lives is a residency question, covered on our EU-hosted coaching software page. How access to it is technically enforced, database-level row-level security, encryption and MFA, is covered on our secure coaching software page. Here we stay on the obligations, rights and agreements.