Privacy Policy
Version 2026-08-16 · Last updated 2026-08-16
This notice explains what personal data Amplivate collects, why, and what rights you have over it. It covers the Amplivate coaching platform — used by coaches to run their practice and by their clients (“coachees”) through a client portal — and the public Amplivate website.
Amplivate is operated from the United Kingdom.
1. Who we are, and who controls your data
Amplivate provides software that coaches use to run their coaching practice: scheduling, session notes, secure messaging, and AI-assisted drafting and summarising features. “We”, “us” and “our” below mean the operator of Amplivate.
Data protection uses two different roles — controller (decides why and how data is processed) and processor (processes it on the controller's instructions). Amplivate's role depends on whose data, and for what:
- Your coach account, billing, and platform-usage data. Amplivate is the controller. We decide why we collect it (to run the Service and bill for it) and how it is used.
- Coaching content about a coachee — session notes, journal entries, goals, messages, uploaded files, check-ins. The coach decides why and how this is processed to run their practice, so the coach is generally the controller and Amplivate is the processor, processing it under the coach's instructions to provide the software.
- Crisis and safety screening of coachee messages (see “The AI-consent model” below). We run this screening on our own initiative, for a safety purpose the coach does not configure, independent of the coaching engagement. Whether Amplivate acts as a controller, a processor, or a joint controller for this specific, narrow purpose is a genuine open question.
A data processing agreement (DPA) between coaches and Amplivate, covering the processor relationship, is referenced in our Terms of Service but no DPA or Standard Contractual Clauses template has been drafted yet — this is a real gap, not only a wording one, and needs to exist before coach onboarding can be considered fully compliant.
2. Who this notice covers
This notice applies to:
- Coaches — the businesses and individuals who subscribe to Amplivate.
- Coachees — a coach's clients, where the coach has invited them to use the client portal.
- Visitors to the public Amplivate website, including anyone who joins our waitlist.
3. The personal data we collect
Account data
Name, email address, role (coach or coachee), and organisation. Passwords are never transmitted in cleartext or stored by us in plain text — sign-in uses the SRP protocol, which proves your password without sending it over the network.
Coaching content
Session notes, journal entries, goals and action items, direct messages between a coach and coachee, AI-drafted messages and summaries, uploaded files and knowledge-base documents, Wheel of Life snapshots, and free-text check-in and feedback responses. Some of this content is described further in “Special category data” below.
AI-generated content
Drafted message replies, client summaries, trajectory insights, and automated nudges generated by our AI features — see “How our AI features work”.
Billing data
A coach's subscription and billing details are handled by our payment processor, Stripe. We never see or store your full card number.
Waitlist
If you join our waitlist, we store your email address, the date you joined, your browser's user-agent string, and a hashed version of your IP address used only to detect abuse — we never store your raw IP address for this purpose.
Technical and usage data
IP-derived data used only for abuse and rate-limit protection, browser user-agent, and a structured audit log of actions taken in your account (who did what, when — not the content itself). The public marketing site also records cookieless page-view and button-click analytics — see “Cookies and similar technologies”.
4. Special category data
Because Amplivate is a coaching platform, the content coachees and coaches put into it — session notes, journal entries, messages, check-ins — can reveal information about health, mental or emotional wellbeing, or other special categories of data under Art. 9 UK GDPR, even though Amplivate is not a medical or mental-health service.
Our general lawful basis for processing this content for AI features is your explicit consent (Art. 9(2)(a)) — see the next section. The one exception is automated crisis and safety screening, which we run on the basis of protecting vital interests (Art. 6(1)(d) and, for the special-category inference it draws, Art. 9(2)(c)) — described in full below, because it runs regardless of whether AI consent has been given.
5. How we use your data, and our lawful bases
- Providing the platform (accounts, scheduling, notes, messaging) — performance of a contract (Art. 6(1)(b)), or our legitimate interest in operating the software a coach has engaged us to provide.
- AI drafting, summaries, insights, and nudges — consent (Art. 6(1)(a) and, for special-category content, Art. 9(2)(a)) under the AI-consent model described below.
- Crisis and safety screening — vital interests (Art. 6(1)(d) / Art. 9(2)(c)), regardless of AI consent state.
- Billing and subscription management — performance of a contract, and legal obligations around tax and accounting records.
- Security, fraud and abuse prevention, audit logging — our legitimate interest in keeping the platform and your account secure (Art. 6(1)(f)).
- Legal compliance — responding to data-subject rights requests and regulatory or lawful requests (Art. 6(1)(c)).
6. The AI-consent model
A coachee's consent to AI processing has three states, which we call granted, declined (this covers both an explicit decline and a later revoke), and pending (never asked, or there is no coachee account to ask — for example, a client a coach has added but not yet invited to the portal). Consent is recorded from the coachee portal and logged with a timestamp and the version of the consent text shown.
Only an explicit decline or revoke blocks AI processing. A “pending” status — a coachee who has simply never been asked yet — is treated as allowed, not suppressed, so AI drafting and summary features work by default rather than being permanently unavailable for a client who has no way to clear the gate. Granting or declining consent controls: AI-drafted message suggestions, AI-generated client summaries, AI-derived insights, pre-session briefings, and automated nudges. Revoking consent expires any pending AI-drafted messages and clears any cached AI summary for that coachee.
Crisis and safety screening is the one exception, and it is not gated on this consent setting at all. Every message a coachee sends to their coach, and every check-in submission, is automatically screened for indications of crisis, self-harm, or risk of harm — using a keyword-based detector and, in some cases, a secondary AI-model screen — before any AI drafting happens and regardless of whether the coachee has granted, declined, or revoked AI consent. This runs even if a coachee has switched AI features off. We rely on this being necessary to protect vital interests (see the lawful bases above) — a coachee in crisis should not lose the safety net because they declined a drafting feature. When something is flagged, the message is stored but never sent to the AI model for drafting, pre-written crisis-support resources are shown, and the coach receives a priority notification.
A coach's own agreement to use AI features at all is part of the subscription terms, not a separate per-message check.
7. How our AI features work
We use AWS Bedrock, which hosts Claude models built by Anthropic, to draft suggested replies for a coach, generate client summaries and trajectory insights, and retrieve relevant excerpts from a coach's own knowledge base to ground those drafts. There is no autonomous “AI coach” mode — every AI-drafted reply is reviewed and explicitly sent (or discarded) by the coach before a coachee sees it; automated nudges that do reach a coachee directly are always labelled as system-generated, never presented as coming from the coach.
AI calls are technically restricted to EU-resident AWS regions — the system refuses to run an AI request if it would be routed outside the EU, rather than allowing a misconfiguration to send your content elsewhere. AWS Bedrock does not use the content sent to it to train Anthropic's or AWS's public or shared models. AI-generated content is encrypted, using your organisation's encryption key, before it is stored.
8. Who else processes your data (sub-processors)
We use a small number of specialist providers to run the Service. None of them can access your data except to provide the specific function listed:
| Provider | Purpose | Region | Data it sees |
|---|---|---|---|
| AWS | Hosting (database, application servers, file storage), encryption key management, identity (Cognito), AI inference (Bedrock) | eu-west-2 (London) | Encrypted content, account identifiers; AI inference sees decrypted prompt content, restricted to EU regions |
| Anthropic (via AWS Bedrock) | AI model inference for drafting and summarising | UK / EU | Prompt and coaching context sent for that request; not used for model training |
| Stripe | Payment processing for coach subscriptions | UK | Coach billing details only — no coachee data |
| Resend | Transactional email (sign-in, notifications, summaries) | United States | Recipient email address and message metadata only — no message thread content |
A current sub-processor register is available on request at privacy@amplivate.ai.
No Data Processing Agreements or Standard Contractual Clauses have been drafted with any sub-processor yet.
9. International data transfers
Our core infrastructure, database, file storage, and AI processing are kept within UK/EU AWS regions. Resend, our email provider, processes data in the United States, which is a transfer of personal data (email address and delivery metadata — not your coaching content) outside the UK.
10. How we keep your data secure
- Encryption at the application layer. Sensitive content — session notes, journal entries, messages, AI drafts, and similar fields — is encrypted before it is written to the database, using an encryption key tied to your organisation. The plaintext is never written to disk.
- Isolation by organisation. Each coach's organisation's data lives in its own database schema, and every query is scoped to prevent one organisation from reading another's data.
- Authentication. Identity is managed through AWS Cognito. Your password is never sent to us or to AWS in cleartext. Session tokens are stored in cookies that are inaccessible to page scripts (httpOnly), sent only over HTTPS (secure), and restricted to same-site requests.
- Encryption in transit. All traffic to Amplivate is served over TLS.
- Audit logging. Actions taken in your account are logged and retained for 7 years to support accountability and, in future, regulated-industry requirements.
We do not yet hold SOC 2 or ISO 27001 certification — these are on our compliance roadmap. Our ICO registration is in progress. Per-organisation cryptographic erasure (destroying an organisation's own encryption key so its data becomes permanently unreadable) is on the roadmap and not yet available; today, encryption keys are shared at the environment level rather than issued one-per-organisation.
11. How long we keep your data
Most coaching content — sessions, client records, goals, journal entries, messages — does not yet have an automated deletion schedule. It is retained for as long as your account or the coaching engagement is active, and deleted on request (see “Your rights” below) or when an account is closed.
What is automated today:
- Platform audit logs — kept 7 years, then deleted.
- Session-type and resource records that have been deleted from your account — kept 7 years past deletion (they are referenced by historical session records), then permanently removed.
- AI-drafted messages that were never sent — their content is cleared 30 days after they go stale (the record itself is kept, without the content, for audit purposes).
- Stripe webhook processing records — kept 30 days, then deleted.
- Database backups — encrypted, retained for 7 days for disaster-recovery purposes, then age out automatically.
12. Your rights
Subject to UK GDPR conditions, you have the right to:
- Access and portability. Request a copy of your personal data. Coachees can self-serve a structured export of their own data from the portal at any time, free of charge — you do not need to wait for us to process a manual request.
- Erasure. A coach can request deletion of a coachee's record, which removes their sessions, messages, uploaded files, and related data. As currently built, some AI-derived coaching notes are flagged for redaction rather than deleted outright as part of this process.
- Rectification and restriction. Ask us to correct inaccurate data or restrict how it is used.
- Objection. Object to processing based on legitimate interests.
- Withdraw consent. Withdraw AI-processing consent at any time from the coachee portal. This does not affect the lawfulness of processing before withdrawal, and does not stop the crisis/safety screening described above, which does not depend on this consent.
- Complain to a supervisory authority. You can lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
To exercise any of these rights, email privacy@amplivate.ai or use the relevant control in your account.
13. Children
Amplivate accounts are intended for adults. Where a coach provides coaching services to a client under 18, the coach — as the controller for that coaching relationship — is responsible for obtaining any parental or guardian consent and following any additional safeguards that require.
15. Changes to this notice
We will update the version and last-updated date at the top of this page whenever it changes. Material changes will be highlighted in the product where practical.
16. Contact us
Questions about this notice, or requests relating to your data, can be sent to privacy@amplivate.ai.