Privacy policy

Who we are

CoachCARE is a product of CARE Business Apps, Snowball Capital Partners Sdn Bhd, Malaysia.

You can contact us at privacy@coachcare.my.

Two kinds of people

Coaches are account holders. Clients are people a coach trains.

The coach decides what client data to enter. We store that data for the coach.

What we store about a coach

We store your name, email, password hash and organisation name. We never store your password as plain text.

We store sign-in sessions, including IP addresses and browser or app details. We also store email verification and password reset records.

We store organisation memberships, roles and invitations. You may also supply a profile image or organisation logo.

We store organisation settings, coach working hours and time off. We keep request counts to limit sign-in abuse.

What a coach may store about a client

A coach may enter a client name, optional email and phone number, notes and an active or archived status.

Training records include sessions, exercises, sets, repetitions, loads and times. They may include notes and completion times.

Session packs include prices, balances and payment records entered by the coach. Payment records include amounts, dates, methods and notes.

We store no card numbers and take no payments.

Booking records include participants, times, recurring schedules, status and notes. They may include cancellation reasons and no-show records.

What a client sees and controls

A recap link shows one session to whoever holds the link. Keep the link private.

The coach can stop sharing the session. The link also stops working when it expires.

If your coach turns on the booking page, it stores a sign-in code. The code works for 10 minutes, and we delete it about an hour after it stops working.

It also stores a browser session for 30 days after you sign in. We delete the session about a week after it ends.

A private booking link works until the coach turns it off. We store when it was last used.

The booking page also stores counters that limit abuse, kept only as hashes.

A new person who asks for a time types a name, phone number and email, and may add a note. We keep these with the request so the coach can answer it. We delete the request about 30 days after it was declined or expired.

To correct or delete your data, ask your coach or write to us at privacy@coachcare.my.

Children

A coach who trains a child must have a parent or guardian's consent before entering the child's data.

Where data is kept and who processes it

Cloudflare provides hosting and databases.

Resend sends our emails. These are account emails and emails about bookings: sign-in codes, confirmations, reminders and requests.

When a coach signs in with JomCARE, JomCARE Accounts confirms who they are.

How long we keep data

We keep account data while the coach's account exists. Deleting the account removes its account and sign-in session records.

Deleting an organisation deletes its training database. Deleting its last owner also deletes the organisation and its training database.

If another owner remains, deleting an account does not delete the organisation data. The self client stays, unlinked from the account.

Author links are cleared, but past bookings keep the coach identifier. Future bookings are cancelled and recurring rules end.

Security

Each organisation's training data is in its own database. Recap link secrets are stored only as hashes.

Connections to the service use HTTPS. These measures reduce risk but cannot remove every security risk.

Your rights under Malaysia's Personal Data Protection Act 2010

You can ask to access or correct your personal data. You can withdraw consent to its use, subject to the law's limits.

Write to privacy@coachcare.my to make a request. Clients can also ask their coach. Withdrawing consent may prevent continued use of the service.

Changes to this policy

We may update this policy as the service changes. We will publish the updated text and date on this page.