PracticeLoom Privacy Policy

DRAFT for legal review: not legal advice and not yet published. Written from PRD v1.11. Before publishing, a lawyer must review it (PRD §7.10) and fill every [PLACEHOLDER]. Items marked [CONFIRM] depend on a provider's current terms and must be checked. Do not add HIPAA, GDPR or ICF compliance claims without independent verification.

Placeholders: [COMPANY LEGAL NAME], [ENTITY TYPE AND STATE], [MAILING ADDRESS], [EFFECTIVE DATE], [BACKUP RETENTION PERIOD].

Effective date: [EFFECTIVE DATE]

PracticeLoom ("PracticeLoom", "we", "us") is operated by [COMPANY LEGAL NAME], a [ENTITY TYPE AND STATE], at [MAILING ADDRESS]. This policy explains what information we handle when you use PracticeLoom at usepracticeloom.com, why, who we share it with, and the choices you have.

1. Who this policy covers

PracticeLoom is software for independent coaches based in the United States. There are three kinds of people involved:

• Coaches: people who sign up and pay for PracticeLoom to run their coaching practice. A coach owns a workspace.
• Clients: people a coach works with. A coach records clients in their workspace and may invite them to a client portal.
• Visitors: people who browse our public website.

An important distinction. When a coach records information about their clients (notes, goals, session recordings, check-ins and files), the coach decides what to collect and why. We store and process that information on the coach's behalf, to provide the service to them. If you are a coaching client, your coach is your first point of contact for questions about your information, and their own privacy practices also apply to you. We help coaches respond to client requests (see section 9).

2. Information we collect

From coaches

• Account details: name, email address, password (stored only as a secure hash by our authentication provider), business name, specialty, timezone and branding.
• Billing details: your PracticeLoom subscription is billed through Stripe. Stripe collects your card details; we never see or store your full card number. We keep your plan, billing status, invoice records and Stripe customer reference.
• Connected accounts: when you connect Google Calendar or Zoom, we receive access tokens (stored encrypted) and only the data those permissions allow. For Google Calendar, that is free/busy times on calendars you select and the session events we create. For Zoom, that is meetings we create for sessions, plus their cloud recordings and transcripts.
• Client payments setup: if you connect a Stripe account to collect payments from your clients, Stripe holds your account details. We keep the account reference and the status of invoices and payments.

About clients (entered by coaches, or by clients in the portal)

• Contact details, coaching context, goals, milestones, actions, measurements, intake answers, check-ins, notes, proposals, agreements, invoices and payment status.
• Session recordings and transcripts: for Zoom sessions linked to PracticeLoom, we import the audio and transcript from the coach's Zoom cloud recording. We do not store video. Coaches can also upload recordings. We do not record or import Google Meet sessions; a Meet session only receives a join link.
• Files the coach or client uploads, such as worksheets and signed agreements.

Automatically

• Essential cookies that keep you signed in and protect your account. We do not use advertising cookies or third-party analytics trackers.
• Product events stored in our own database to understand how the product is used (for example "session completed"). These use pseudonymous IDs, not the content of coaching notes.
• Logs and error reports used to run and fix the service. Sensitive information is redacted where possible.

3. How we use information

• To provide PracticeLoom: store records, schedule sessions, sync calendars, import recordings, produce transcripts, show the client portal, send emails and process subscriptions.
• AI assistance (see section 4).
• To keep the service secure, prevent abuse, and enforce our Terms of Service, including fair-use safeguards.
• To send service emails: invitations, reminders, receipts and follow-ups a coach has approved. Emails a coach sends to their clients come from info@usepracticeloom.com under the name "[Coach Name] via PracticeLoom", and replies go to the coach.
• To improve the product using aggregated or pseudonymous usage data.
• To meet legal obligations.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

4. AI features

PracticeLoom uses AI to help coaches. It drafts session summaries, suggests action items, prepares pre-session briefs, analyzes a client's progress over time, and drafts final reports.

• AI is on by default for coaches, within the limits below.
• AI only uses information from the selected client's records in the coach's own workspace. It never mixes one client's information into another client's results, and never uses another workspace's data. Uploaded historical attachments are not read by AI.
• Everything AI produces is a draft for the coach. Clients never see an AI draft. A coach must review and approve the exact content before anything is shared with a client. Coach-private notes can inform a draft, but the private notes themselves are never shown to clients.
• AI does not coach clients, diagnose any condition, or decide outcomes.
• To do this, we send the relevant content to our AI providers (section 5). We do not use your content to train our own AI models. Our AI and transcription providers process content to provide the service to us. [CONFIRM] each provider's current API terms on training and data retention before publishing, and state them here.

5. Who we share information with

We share information only with service providers that help us run PracticeLoom (subprocessors), when you direct us to, or when the law requires it.

Provider	What it does for us	Data involved
Supabase	Database, authentication and file storage (United States)	All service data
DigitalOcean	Application servers (United States)	Data passing through the app
OpenAI	AI drafting and analysis	Content of the selected client's records used for a draft
AssemblyAI	Transcription when Zoom has no transcript, or for uploaded recordings	Session audio
Stripe	Platform subscription billing; client payments for coaches who connect Stripe	Billing and payment details
Resend	Sending email	Recipient address and message content
Sentry	Error monitoring	Technical error details (sensitive data redacted where possible)
Zoom	Meetings and recordings, when a coach connects it	Meeting details, recordings, transcripts
Google	Calendar sync and Meet join links, when a coach connects it	Free/busy times and session events

Zoom, Google and Stripe are also governed by their own terms and privacy policies, which apply to your accounts with them.

We may also disclose information:

• if required by law, subpoena or other legal process;
• to protect the rights, safety or property of our users, the public or PracticeLoom;
• as part of a merger, acquisition or sale of assets, subject to this policy's protections.

6. Recording and consent

When a coach connects Zoom, PracticeLoom turns on Zoom cloud auto-recording by default for linked sessions. The coach can change this per session. Coaches are responsible for telling their clients that sessions are recorded and for getting any consent the law requires. Some US states require every participant's consent. PracticeLoom does not collect recording consent inside the app. Zoom's own recording notices still appear to participants.

7. How long we keep information

• We keep coaching records, recordings, transcripts and AI-derived insights indefinitely. They are not deleted automatically because of their age or because a subscription ends.
• If a coach's subscription ends, the coach keeps free, read-only access to their workspace indefinitely. Clients keep read-only access to content their coach previously shared with them, unless the coach has revoked their access.
• Deletion on request: a workspace owner can ask us to delete specific records or their whole account by emailing info@usepracticeloom.com. We verify the request and confirm exactly what will be deleted. Then we delete it, along with copies derived from it (such as transcripts, AI drafts and search indexes). Deleted data may remain in encrypted backups for up to [BACKUP RETENTION PERIOD] before those backups expire, and is not restored from them.
• We may keep billing records and other information as required by law, such as tax and accounting rules.
• We do not control copies held by Zoom, Google or Stripe; contact those providers directly.

8. Security

We protect information with:

• access controls in the database, so each coach and client can only reach what they are allowed to see;
• server-side authorization checks;
• encryption in transit (HTTPS);
• encrypted storage of connection tokens;
• short-lived private links for files;
• monitoring.

No system is perfectly secure. If we learn of a breach affecting your information, we will notify you as required by law.

PracticeLoom is coaching software. It is not a healthcare or therapy service, and it is not designed to store protected health information under HIPAA. Coaches should not use it to store medical records or protected health information.

9. Your choices and rights

• Coaches can view and edit their information in the app, export final reports as PDFs, and request deletion as described in section 7.
• Clients should contact their coach first. A coach can correct or remove client records, and can ask us to delete them. If you cannot reach your coach, email us and we will forward your request to them.
• Depending on your state of residence, you may have additional rights to know, access, correct or delete your personal information, and to appeal a decision about such a request. To make a request, email info@usepracticeloom.com. We will verify your identity and respond within the time the law requires. We will not discriminate against you for exercising these rights.
• You can unsubscribe from non-essential emails at any time. Service emails, such as security notices and receipts, are still sent.

10. Children

PracticeLoom is not directed to children, and coaches must be at least 18. [LAWYER] Decide whether coaches may record clients under 18 and, if so, what guardian consent coaches must obtain. Until then, coaches must not use PracticeLoom for clients under 18 without verifiable parental or guardian consent.

11. Where we process information

PracticeLoom is offered to US-based coaches, and we store and process information in the United States.

12. Changes to this policy

We will post any changes here and update the effective date. If changes are material, we will notify coaches by email or in the app before they take effect.

13. Contact

Questions or requests: info@usepracticeloom.com [COMPANY LEGAL NAME], [MAILING ADDRESS]