Privacy Policy

Short summary

Klaver Solutions operates the Practions software platform for independent coaches and coaching practices. This privacy policy explains in clear language which Personal Data is processed, on what legal basis, how long it is retained and which rights data subjects have. With regard to coaching content (session transcripts, notes, free text), Klaver Solutions acts as processor on behalf of the coach; with regard to the coach's own data, Klaver Solutions acts as controller.

Questions and requests for access, rectification or erasure may be addressed to [email protected]. Complaints may be lodged with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Article 1. Identity of the controller

1. For the data of Customer (the coach or coaching practice that holds a Subscription with Practions) and the Users associated with Customer, Klaver Solutions acts as controller within the meaning of Article 4(7) GDPR.
2. For the data of Clients (end-clients of Customer) recorded by Customer via Practions, Customer is itself the controller and Klaver Solutions acts as processor within the meaning of Article 4(8) GDPR. The applicable arrangements are set out in the Data Processing Agreement, which applies automatically upon use of Practions.
3. Klaver Solutions can be reached at: - Email: [email protected] - Postal address: Blaasbalg 14, 8253 LX Dronten, the Netherlands

Article 2. Data Protection Officer

1. Considering the scale and nature of the processing, Klaver Solutions has not appointed a Data Protection Officer under Article 37 GDPR. This assessment is reviewed periodically.
2. The central point of contact for all privacy queries is [email protected].

Article 3. Categories of Personal Data processed

3.1 Data of Customer and User

• Identification and contact data: name, email address, telephone number (optional), practice name, profile photo (optional), website, LinkedIn (optional).
• WhatsApp data: WhatsApp number and opt-in status, only when Customer activates the optional WhatsApp integration for authentication verification and transactional messaging.
• Authentication data: hashed password (bcrypt with SHA-256 pre-hashing), encrypted TOTP seed for two-factor authentication, hashed recovery codes.
• Session and security data: IP address, user-agent and device name of active login sessions (retained while the session is active and for at most 30 days after deactivation, for forensic purposes).
• Business data: Chamber of Commerce number, VAT number, IBAN, registered office address, billing address.
• Subscription data: plan, status, current billing period, Mollie customer id, payment history.
• Usage statistics: number of AI chat messages, AI note generations and AI edits per calendar month, for quota enforcement purposes.
• AI assistant preferences: short text statements about coaching style and scheduling that Customer enters directly or accepts after AI suggestion. By design these preferences contain no Client content, no session transcripts and no special categories.
• Outbound email transparency log: every message sent by Practions on behalf of Customer (verification, invoice, session reminder, note-share email) is stored visibly to Customer so Customer can review the messages sent in their name.

3.2 Data of Clients (processed on behalf of Customer)

• Identification and contact data: name, email address, phone number, initials, photo (optional), address (optional).
• Coaching context: focus of the coaching, frequency, session history, status of the relationship, end date of the coaching relationship, free-text notes recorded by the coach about the client.
• Substantive session data: session appointments, session transcripts, AI-generated session notes, coach private notes, themes and action items.
• Messaging and files in the client portal.
• Client portal account: email address, hashed password and optional name, photo and phone number for Clients who log in to the portal themselves. A single portal account may be linked to multiple coaches who use the Service.
• Goals and progress (Goals): coach-defined goals, free-text description, status, progress percentage, target date, optional metric values and notes per logged measurement.
• Habits and check-ins (Habits): coach-defined habits, cadence, target count, periodic check-ins by coach or Client and optional notes per check-in.
• Programs and enrollments (Programs, Enrollments): templates for multi-week coaching trajectories and a Client's enrollment in such a trajectory, including start date and current phase.
• Group membership (Groups): linkage of a Client to a group cohort and the corresponding start and end dates.
• Client insights (ClientInsights): notifications generated by rule-based scans about engagement, stagnation or progress; contain identifier references and metrics, no free-text input by the Client.
• Automations (Automations, AutomationRuns): rules configured by Customer (for example "send a portal message when goal achieved") and the corresponding execution log.
• Optional AI suggestions on notes (Note.ai_goal_suggestions): language-model-proposed goal updates stored for review by the coach.
• Invoices, payments and VAT data.
• Per-session consent records (recording, transcription, AI processing) including timestamp, IP address and user-agent at the time consent was given.

Substantive session content, namely session transcripts, session summaries, private notes and transcript lines, is stored encrypted at rest in the database using Fernet encryption with separate keys per column category. Key management is performed by Klaver Solutions in its capacity as processor. The other Client categories listed above (coaching context, goals, habits, insights, program enrollments and group membership) are not separately encrypted at rest in the current release of the Service, but are subject to the same access, audit and network controls as the other tables. This will be addressed in a future release.

3.3 Visitor data on practions.com

• Visited URL, referrer, browser type, device type, estimated country and a hashed value of the IP address. The hash is constructed in such a way that the IP address cannot be reconstructed.
• Preferred language NL or EN, stored in the browser's localStorage.

3.4 Special categories of personal data (Article 9 GDPR)

Coaching may touch upon data relating to the mental health, personal well-being or worldview of the Client. Coaching session content is, regardless of its actual content, treated as a special category of personal data. Processing is based exclusively on the explicit consent of the Client (Article 9(2)(a) GDPR), which the coach must record via Practions before transcription or AI processing.

Article 4. Purposes and legal bases

Where the legal basis is consent, that consent may be withdrawn at any time, without affecting the lawfulness of processing prior to withdrawal.

Article 5. Recipients and sub-processors

Klaver Solutions engages the following sub-processors under strict conditions. For an up-to-date list, including establishment country and transfer mechanism, see https://practions.com/en/sub-processors.

• Mollie B.V. (the Netherlands) for payment processing.
• Moneybird B.V. (the Netherlands) for optional accounting integration (only when activated by Customer).
• Microsoft Ireland Operations Limited for Azure OpenAI in EU regions. Production processing of transcripts and AI content runs exclusively via Azure OpenAI with EU data residency.
• OpenAI L.L.C. (United States): not used in production. For development and testing purposes only, with non-production test data.
• Zoho Corporation B.V. (European data centre, smtp.zoho.eu) for outbound transactional email.
• Meta Platforms Ireland Limited for the WhatsApp Business Cloud API, only when Customer activates the optional WhatsApp integration for signup verification or transactional messaging.
• Cloudflare, Inc. for network and tunnel services between the public domain and the production environment.
• European Commission / VIES for VAT validation of business Clients of Customer.
• Optional TURN provider for WebRTC NAT traversal, only when activated. The provider and country of establishment are then added to the sub-processor list.
• Sentry (optional) for error monitoring. PII is filtered before events are transmitted.

Klaver Solutions does not sell personal data and does not share it with third parties for commercial purposes.

Article 6. International transfers

1. Processing of Personal Data takes place, as far as possible, within the European Economic Area (EEA).
2. Where sub-processors are established outside the EEA, transfer takes place on the basis of an appropriate transfer mechanism, including: - the Standard Contractual Clauses (SCCs) of the European Commission (Implementing Decision (EU) 2021/914); - additional technical and organisational measures where necessary, following the assessment under the Schrems II judgment; - for US-based providers, where applicable, a valid EU-US Data Privacy Framework certification.
3. Substantive Client session data processed in production via an LLM remains within Azure OpenAI EU regions. Klaver Solutions expressly does not use the direct OpenAI API in the United States for production processing.

Article 7. Retention periods

Deletion is performed automatically by a daily retention batch at 03:00 (Europe/Amsterdam time). Each deletion run is recorded in the audit log.

Article 8. Data subject rights

Every data subject has the following rights under the GDPR:

• Right of access to the Personal Data processed (Article 15 GDPR).
• Right to rectification of inaccurate or incomplete data (Article 16 GDPR).
• Right to erasure ("right to be forgotten", Article 17 GDPR), subject to the limits of statutory retention obligations.
• Right to restriction of processing (Article 18 GDPR); technically supported in Practions via a per-Client processing restriction flag that immediately suspends automated processing, including AI note generation and notification emails.
• Right to data portability in a structured, commonly used and machine-readable format (Article 20 GDPR); supported in Practions via a data export function.
• Right to object to processing on the basis of legitimate interests (Article 21 GDPR); recorded in Practions in an objection log that the coach must review within one month.
• Right to withdraw consent for processing based on consent (Article 7(3) GDPR).
• Right not to be subject to a decision based solely on automated processing producing legal effects (Article 22 GDPR); see Article 11 below.

To exercise these rights, Customer and Client may contact [email protected]. For Clients, requests are first routed via their own coach, since the coach acts as controller for client data.

Article 9. Right to lodge a complaint

Every data subject has the right to lodge a complaint with the data protection supervisory authority, without prejudice to other remedies:

Autoriteit Persoonsgegevens Postbus 93374, 2509 AJ Den Haag, the Netherlands Telephone: +31 88 1805 250 Website: https://autoriteitpersoonsgegevens.nl

Article 10. Consequences of not providing data

Certain data is necessary for entering into and performing the Agreement, including the name, email address and payment details of Customer. Without these, Practions cannot deliver the Service. Other data is optional; their absence merely limits the functionality of the Service (for example, no profile photo).

Article 11. Automated decision-making

1. Practions uses AI to generate draft session notes, edit existing notes, propose goal updates from session transcripts, and to provide an AI practice-manager chat with optional coach-specific preferences. In all cases there is an intermediate step controlled by the coach: AI output is never shared with the Client or finalised without human review.
2. In addition to AI, the Service offers rule-based mechanisms that do not use a language model: the client-insight scan and Customer-configured automations. These rules act on dashboard views, tasks and internal messages and do not produce legal effects or similarly significant effects for the Client.
3. There is no automated decision-making that produces legal effects or similarly significant effects for Clients within the meaning of Article 22(1) GDPR.
4. Clients may, via the coach, object to an AI-generated note and request correction; the coach handles this note dispute within a reasonable period of no more than one month.

Article 12. Cookies and client-side storage

1. The marketing website practions.com places no cookies. Anonymous visitor statistics are calculated server-side based on a hashed IP address.
2. For the operation of the Service (after login), strictly necessary cookies are placed, including authentication and CSRF cookies, and browser storage (localStorage, sessionStorage) is used for functional preferences such as language, call persistence and client-portal session.
3. A detailed list of keys, purposes and categories is set out in the Cookie Policy at https://practions.com/en/cookies.

Article 13. Security

Klaver Solutions applies appropriate technical and organisational measures to secure Personal Data, including:

• encryption in transit via TLS;
• encryption at rest of session transcripts, session notes, private notes, TOTP seeds and third-party API tokens, with separate keys per column category;
• passwords hashed with bcrypt with SHA-256 pre-hashing to prevent truncation of long passwords;
• short-lived JSON Web Tokens with server-side revocation via a session register;
• HttpOnly, Secure and SameSite attributes on authentication cookies;
• a double-submit CSRF mechanism;
• rate limiting on authentication and public endpoints;
• security headers including HSTS, Content Security Policy and Permissions-Policy;
• a network egress allowlist limiting outbound connections from the production process to documented sub-processors;
• a PII scrubber at the log level filtering JWTs, bcrypt hashes, IBAN/VAT numbers, email local-parts, phone numbers and long hex tokens;
• audit logging with composite indexes for per-user and per-action investigation.

Article 14. Data breaches

1. If a personal-data breach occurs, Klaver Solutions assesses within 24 hours its nature, scope and consequences.
2. A notifiable breach is reported by Klaver Solutions to the Autoriteit Persoonsgegevens within 72 hours of discovery, in accordance with Article 33 GDPR. Where the breach is likely to result in a high risk to data subjects, those data subjects are informed in accordance with Article 34 GDPR.
3. For breaches involving only Client data, Klaver Solutions notifies Customer without undue delay so that Customer can comply with its own notification obligation. The arrangements are set out in the Data Processing Agreement.

Article 15. Amendments to this privacy policy

1. This privacy policy may be amended from time to time. Amendments are announced at least thirty (30) days before they take effect, via email or a banner in the Service, save for purely editorial changes.
2. The current version and effective date are shown at the top of this document.