Privacy Notice

1. Who we are

The Mindful Space: Coaching Hub ("the Service") is operated by The Mindful Narrative ("we", "us", "our"). We are the data controller for the personal data we collect through the Service. You can contact us at the email address shown on the Service.

2. Personal data we collect

• Account data: name, email address, login credentials, role (coach or client), plan and pathway assignments (Coaching Psychology and/or Personal Training).
• Profile data: any information you choose to add to your profile.
• Coaching content: messages, goals and progress updates, tracking metrics and entries, coaching session records (delivered hours, draft notes and outcomes), appointments, agreements, feedback forms and responses, shared resources and catalogue items, workout programs and logs, nutrition targets, nutrition entries and meal plans, invoices, in-app notifications, support tickets, and other content you or the people you are connected with create or upload.
• Aggregated practice insights: for coaches, we compute pathway-aware summary counts and trends (e.g. active clients, goals, coaching sessions, workouts, nutrition entries, invoices, training volume and macro adherence) from your own coaching content to power the Insights dashboard. These are derived from data you already have in the Service and are visible only to you. Client reflections are never used to compute Insights.
• Private reflections: journal entries clients write in the Reflections area are visible only to the client who wrote them. Coaches cannot see reflections, and they are excluded from every coach-facing view, export and analytics surface.
• Usage data: pages viewed, features used, device identifiers, IP address, browser and OS information, log data.
• Support data: any information you provide when you contact us for help or open a support ticket.
• Subscription billing data: your plan, subscription status and invoice history for your subscription to The Mindful Space. Payment card details are collected and processed directly by our payment provider, Paddle, and are not stored on our systems.
• Coach-issued invoice records: if you are a coach using the in-app Invoices feature, we store the totals, line items, dates and status of invoices you issue to your clients. Actual payment between you and your client is settled outside the Service by whatever method you choose (bank transfer, third-party payment link, etc.), and we do not collect or process card or bank details for those transactions.
• Google Calendar integration (optional): if you connect your Google Calendar from Settings → Integrations, we store the OAuth tokens needed to read and write events on that calendar in encrypted form. We only read and write events related to your Mindful Space appointments; we do not scan or store the rest of your calendar. You can disconnect at any time, which revokes our access. Google Calendar is the only third-party calendar provider currently supported.
• Browser push subscription (optional): if you enable browser push notifications, we store the push subscription details your browser provides so we can deliver alerts. The subscription is deleted when you turn push off or revoke the browser permission.
• Coach branding assets (coaches only, optional): if you configure branding in Settings → Branding, we store the logo image data, accent colour and display name against your coach profile and embed them in client-facing emails and invoice PDFs.

3. How we use personal data and our legal basis

• To provide the Service (account creation, hosting your coaching workspace, messaging, billing administration) — performance of a contract with you.
• To keep the Service secure (fraud and abuse prevention, authentication, logging) — legitimate interests.
• To improve the Service (diagnostics, aggregated analytics) — legitimate interests.
• To handle support requests — performance of a contract and legitimate interests.
• To comply with legal obligations (tax, accounting, responding to lawful requests) — legal obligation.
• To send service emails (invites, password resets, important account notices) — performance of a contract.

4. Who we share personal data with

• Hosting and infrastructure providers who store and process data on our behalf.
• Paddle.com Market Ltd ("Paddle"), our Merchant of Record, who processes payments, manages subscriptions, handles tax compliance, and issues invoices on our behalf. See Paddle's privacy notice at paddle.com/legal/privacy.
• Email and notification providers who deliver transactional messages.
• Professional advisers (legal, accounting) where necessary.
• Authorities where required by law or to protect our rights.

We never sell your personal data.

5. International transfers

Some of our service providers may process data outside your country of residence, including outside the UK/EEA. Where this happens, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

6. How long we keep personal data

We keep personal data for as long as your account is active and for a reasonable period afterwards to comply with legal, accounting, and reporting obligations. Coaching content is retained while the account exists and deleted or anonymised when no longer needed.

7. Your rights

Depending on where you live, you may have rights to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request deletion of your data;
• request restriction of, or object to, certain processing;
• request portability of your data;
• withdraw consent where processing is based on consent;
• lodge a complaint with your local data protection authority (in the UK, the ICO).

To exercise these rights, contact us at the email shown on the Service. We will respond within one month.

8. Security

We use appropriate technical and organisational measures, including encryption in transit, access controls, and audit logging, to protect personal data. No system is perfectly secure, but we work to keep your data safe.

9. Cookies

We use essential cookies and similar technologies to keep you signed in and to keep the Service working. We do not use third-party advertising cookies.

10. Changes to this notice

We may update this notice from time to time. The "Last updated" date at the top tells you when it last changed. Material changes will be communicated through the Service.