Website Security for UK Business Coaches and Executive Coaches

Why Business Coaches Handle High-Risk Client Data

Business and executive coaches receive confidential information about their clients' professional challenges, business strategies, financial situations, and personal career concerns. This information — shared in confidence as part of a trusted professional relationship — requires careful protection.

Unlike many professions, coaching often involves commercially sensitive data: business strategy, board dynamics, financial performance, acquisition plans, and interpersonal conflicts within organisations. A data breach that exposes a client's confidential business challenges has implications beyond personal privacy.

What Business Coach Platforms Hold

**Coaching intake questionnaires** — Professional background, current challenges, business goals, financial context, and personal motivations submitted at the start of an engagement. This data can include commercially sensitive business intelligence.

**Session notes and progress records** — Notes from coaching conversations documenting strategic decisions, personal challenges, organisational tensions, and professional circumstances. These are confidential client records.

**Corporate contact and billing data** — Where coaching is paid for by a client's employer, billing contacts, invoice references, and company information are involved.

**360-degree feedback and assessment data** — Psychometric assessments, 360 feedback reports, and personality profiles linked to named individuals are sensitive personal data.

**Video call recordings** — Coaching sessions conducted via video platform and recorded for client review contain the most sensitive conversational data in a coaching practice.

Common Security Issues

**Client intake data stored only in email** — Initial questionnaires and intake documents received by email and stored in an inbox are protected only by a single email password. For commercially sensitive client data, this is an inadequate security arrangement.

**Video recordings without access controls** — Session recordings stored in Zoom, Teams, or a cloud drive must be protected with appropriate access controls. A misconfigured sharing setting that makes recordings accessible via link gives anyone with the URL access to sensitive coaching conversations.

**CRM with overly broad access** — Coaches working with associate coaches or virtual assistants sometimes give broad CRM access without scoping it to the minimum necessary. Administrative access to all client records is not needed by everyone who supports the practice.

**Website contact form without privacy consideration** — Lead-generation contact forms that collect professional challenges and business circumstances are collecting sensitive data that should be handled under a disclosed legal basis with appropriate security.

**Psychometric assessment platforms with weak authentication** — Third-party assessment platforms used to administer and store psychometric profiles must have adequate authentication. These profiles, linked to named clients, are particularly sensitive.

Practical Steps

Use a practice management platform designed for coaching or coaching-adjacent professions with appropriate data handling. Document your data retention policy and enforce it — delete old client records once the retention period expires. Enable two-factor authentication on all client-facing and administrative systems. Conduct an annual data audit to identify what you hold and where it is stored.

Yrzo AI scans coaching practice websites and client portals to identify the specific vulnerabilities that put confidential client data at risk.