Template notice — remove before launch. This is a working draft prepared for review. Replace every bracketed placeholder and have a qualified lawyer review it before you accept real customer data, particularly because coaching records can be sensitive.
This policy explains how [LEGAL ENTITY NAME] ("MyTeamVantage", "we", "us") handles personal information when you visit our website or use our software.
1. Two different roles
We handle two categories of information, and our responsibilities differ for each.
Information we control
Details about you as our customer or website visitor — your name, work email, company name, billing details, and how you use the site. We decide how this is used, so we are the data controller.
Information you control
Records you enter about your own coaches and clients — names, contact details, session history, and session notes. That information belongs to your organisation. We only process it to provide the service, on your instructions. You are the controller; we are the processor.
We do not sell either category, and we do not use your client records to train models or for our own marketing.
2. What we collect
- Account information — name, work email, company name, role, and password credentials (stored only as a salted hash).
- Billing information — handled by our payment processor. We receive a customer reference, the last four digits, and payment status. We never see or store full card numbers.
- Customer content — the coach, client, session, note, and payout records your organisation enters.
- Usage data — pages visited, features used, approximate location derived from IP, browser and device type.
- Communications — messages you send us and our replies.
3. Why we use it
- To provide, secure, and support the service
- To process payments and manage subscriptions
- To respond to your questions
- To detect and prevent fraud, abuse, and security incidents
- To improve the product using aggregated, de-identified usage patterns
- To send service notices, and — only with your consent — occasional product updates
Where the GDPR applies, our legal bases are performance of a contract, our legitimate interests in operating and securing the service, consent where required, and compliance with legal obligations.
4. Who we share it with
We share personal information only with service providers who help us run the platform, each bound by contract to protect it:
- [HOSTING / DATABASE PROVIDER] — application hosting and data storage
- [PAYMENT PROCESSOR] — subscription billing
- [EMAIL PROVIDER] — transactional email
- [ANALYTICS PROVIDER, IF ANY] — usage measurement
We may also disclose information where legally required, or in connection with a merger or acquisition — in which case we will notify you before your information becomes subject to a different policy.
5. Session notes and sensitive information
Coaching notes can be sensitive. We treat them accordingly:
- Internal notes are stored separately from any client-facing field and are never exposed to clients
- Access is restricted by role — coaches can reach only their own clients' records
- Separation between organisations is enforced at the database layer, not only in the interface
- Administrative access to customer content is limited to support work you have requested, or to investigate a security incident
MyTeamVantage is not a medical record system and is not intended for protected health information under HIPAA. If your organisation is a HIPAA covered entity or business associate, do not enter PHI without a signed business associate agreement in place.
6. Retention
Account information is kept while your account is active and for [RETENTION PERIOD] afterwards. Customer content is deleted within [DELETION WINDOW] of account closure, unless you ask for it sooner or we must retain it by law. Backups are purged on a rolling [BACKUP CYCLE] schedule.
7. Security
We use encryption in transit and at rest, role-based access controls, database-level tenant isolation, hashed credentials, audit logging of access to customer records, and least-privilege administrative access. No system is perfectly secure, but if a breach affects your information we will notify you and any required regulator without undue delay.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal information, to object to processing, and to withdraw consent. California residents may request disclosure of the categories of information collected and may opt out of "sharing" as defined by the CCPA — note that we do not sell personal information.
To exercise any of these, email privacy@myteamvantage.com. We respond within 30 days. If your request concerns records held by a coaching company using our platform, we will refer you to that organisation, since they control that data.
9. Cookies
We use strictly necessary cookies to keep you signed in and to secure the service. [IF USING ANALYTICS: We also use analytics cookies, which you can decline without losing functionality.] We do not use advertising cookies or third-party tracking pixels.
10. International transfers
We operate from [COUNTRY] and our providers may process data in other countries. Where information leaves the UK, EEA, or Switzerland, we rely on Standard Contractual Clauses or another approved transfer mechanism.
11. Children
The service is for businesses and is not directed at anyone under 16. We do not knowingly collect information from children. If a coaching company using our platform works with minors, that organisation is responsible for obtaining any consent required.
12. Changes
We may update this policy. Material changes will be announced by email or in-product at least 30 days before they take effect, and the date at the top will always reflect the current version.
13. Contact
[LEGAL ENTITY NAME]
[REGISTERED ADDRESS]
privacy@myteamvantage.com