Privacy & Security at Simply.Coach

What is it?
HIPAA (Health Insurance Portability and Accountability Act) is a US federal law that protects sensitive patient health information. It operates through three rules: the Privacy Rule, which covers all forms of individually identifiable health information; the Security Rule, which governs how that information is stored and handled electronically; and the Breach Notification Rule, which mandates prompt disclosure if protected data is ever compromised.

Who is it for?
HIPAA compliance is essential for coaches working in healthcare-adjacent contexts — including health and wellness coaches, mental health practitioners, and any coach whose clients share medical or clinical information as part of their engagement.

What it means for you
Your clients' health information stays protected. Every session note, every intake form, every piece of sensitive data shared in your practice is handled in full accordance with US federal law — so you can focus on the work, not the liability.

What is it?
SOC 2 (Service Organization Control Type 2) is a rigorous, independently audited cybersecurity framework that evaluates an organization's systems across five criteria: security, availability, processing integrity, confidentiality, and privacy. Unlike a checkbox certification, SOC 2 involves continuous assessment of internal controls, risk management practices, and data protection measures.

Who is it for?
SOC 2 matters to any coach or firm where client data security is non-negotiable — and increasingly, it's what enterprise and corporate buyers look for before signing a contract with any software provider.

What it means for you
Your data — and your clients' data — is processed and stored on infrastructure that has been independently verified to meet the highest security standards. No data breaches. No unexpected downtime. No gaps in how your information is protected.

What is it?
GDPR (General Data Protection Regulation) is a binding regulation created by the European Union that governs how organizations collect, handle, and protect the personal data of EU residents. It sets clear standards around data minimization, transparency, consent, and individuals' rights over their own information.

Who is it for?
GDPR compliance is mandatory for any coach or firm working with clients based in the European Union — and increasingly considered best practice globally as data privacy expectations rise across markets.

What it means for you
Your clients have full visibility and control over how their data is collected, processed, and used. Simply.Coach handles personal information ethically and lawfully — wherever your clients are in the world, their privacy is respected by design.