1. Who is the data controller?
The data controller for the personal data of professionals using the My247Coach platform is:
BJ Service BV
Company number (CBE/VAT): BE0439.571.435
Email: info@my247coach.online
Website: https://my247coach.online
For questions about the processing of your personal data, please contact us at the email address above.
Special situation for client data: For personal data of clients entered into the platform by a professional, BJ Service BV acts as a data processor. In that case, the professional themselves is the data controller. Clients should direct questions about their data to their therapist or coach in the first instance.
2. What data do we process, and why?
| Category | Data | Purpose | Legal basis |
|---|---|---|---|
| Professionals — identity | First name, last name, email address, language, country | Account management, communication, invoicing | Performance of contract (Art. 6.1b GDPR) |
| Professionals — usage | Login times, activity log, AI credit consumption | Platform operation, invoicing, security | Legitimate interest (Art. 6.1f GDPR) |
| Clients — identity | First name, last name, email address, language, gender | Client management by the professional | Performance of contract + consent |
| Clients — health data ⚠️ | Therapy subject, goal, difficulties, AI chat conversations, session notes, audio listening behaviour | Therapeutic support via the platform | Explicit consent (Art. 9.2a GDPR) |
| Website — analytics | IP address (anonymised), pages visited, browsing behaviour | Website improvement (Google Analytics) | Consent via cookie banner (Art. 6.1a GDPR) |
3. How long do we retain data?
| Data | Retention period |
|---|---|
| Professional account data | Duration of subscription + 30 days after cancellation |
| Client account data | As long as the professional’s account is active, or until deletion by the professional |
| Client AI chat histories | As long as the client account exists |
| Session notes | As long as the client account exists |
| Activity log (admin) | Rolling 12 months |
| Invoicing data | 7 years (statutory accounting retention obligation) |
| Google Analytics data | 26 months (Google default setting) |
4. With whom do we share data?
My247Coach only shares personal data with carefully selected subcontractors that are necessary for the operation of the platform. A Data Processing Agreement (DPA) compliant with Article 28 GDPR has been concluded with each of these parties:
- Professional AI service provider — for processing AI chat interactions. Chat content is processed to generate a response and is not used to train AI models.
- Professional hosting company (EU) — for web hosting, database storage and email infrastructure.
- Google LLC — for Google Analytics (website statistics). Google may transfer data to the US; this transfer is covered by Standard Contractual Clauses (SCC). You can refuse Google Analytics via the cookie banner.
My247Coach never sells your data to third parties and does not share it for commercial purposes.
5. International transfers
The AI service provider used by My247Coach is based outside the European Economic Area (EEA). The transfer of personal data to that country is covered by a Data Processing Agreement (DPA) with appropriate safeguards in accordance with Chapter V GDPR. You may request further information at info@my247coach.online.
6. Security
My247Coach takes the protection of personal data — and health data in particular — very seriously. Our security measures include:
- Encryption of all health data in the database (AES-256)
- Mandatory HTTPS connection for all communications
- Role-based access control: professionals only see their own clients
- Audit logging of all administrative actions
- Regular backups at the hosting provider
7. Your rights
As a data subject, you have the following rights under the GDPR:
| Right | What does this mean? | How to exercise it? |
|---|---|---|
| Access (Art. 15) | Obtain a copy of your personal data | By email or via the export function in the platform |
| Rectification (Art. 16) | Have inaccurate data corrected | Via your profile or by email |
| Erasure (Art. 17) | Request deletion of your data | By email or via the deletion function in the platform |
| Portability (Art. 20) | Receive your data in a machine-readable format (JSON/CSV) | Via the export function in the platform |
| Restriction (Art. 18) | Request restriction of processing | By email |
| Objection (Art. 21) | Object to processing based on legitimate interest | By email |
My247Coach will process your request within 30 days. If you believe your rights are not being respected, you have the right to lodge a complaint with the Data Protection Authority (GBA/APD): www.dataprotectionauthority.be — Rue de la Presse 35, 1000 Brussels.
8. Cookies
My247Coach uses the following categories of cookies:
- Necessary cookies: for login and session operation of the platform. These cookies are technically required and cannot be refused.
- Analytical cookies (Google Analytics): for measuring website visits. IP addresses are anonymised. You can refuse these cookies via the cookie banner on your first visit.
9. Changes to this privacy policy
My247Coach reserves the right to modify this privacy policy. The most recent version is always available at https://my247coach.online/privacy-policy/. In the event of significant changes, registered professionals will be notified by email.
Version 1.0 — 05/03/2026 — Belgian law, GDPR compliant