Security and your data
HeartLedge is practice management software for independent coaches.
How HeartLedge protects your practice’s data and your clients’ data, and what it does not claim.
Last updated
How your data is protected
Where is HeartLedge data stored?
HeartLedge stores your data in the European Union. Some service providers, including Stripe, are based in the US, so information moves between the two regions in normal operation.
Is my data encrypted?
Yes, on the way. Everything you and your clients send to HeartLedge travels over an encrypted connection, so it stays private between your browser and HeartLedge.
Is my data backed up?
Yes. HeartLedge backs up your data regularly, so your practice records can be recovered if something goes wrong.
Can other coaches see my clients?
No. Each practice’s data in HeartLedge is kept separate, so one coach can never see another coach’s clients.
Who at HeartLedge can access my data?
Very few. Access is limited to the people who run HeartLedge, to keep the service working and secure or when the law requires it.
How are sign-ins protected?
Coach accounts are protected against repeated attempts to guess a password. Clients sign in with a one-time link sent to their email, so they never have a password to manage.
Payments
Does HeartLedge store card numbers?
No. Card details are entered on Stripe’s own pages and never reach HeartLedge’s servers.
Where do client payments go?
Client payments go straight to the coach’s own Stripe account, and HeartLedge never holds the money.
Privacy
Do you sell my data or use it to train AI?
No. HeartLedge does not sell your data or your clients’ data, or share it for advertising. HeartLedge does not use client personal information to train AI models.
Can my clients see my session notes?
No. Session notes in HeartLedge are private to you and never appear in the client portal. The session agenda is different: clients see it unless you mark it coach only.
Does HeartLedge use tracking cookies?
No. HeartLedge uses essential cookies only, and analytics on its public pages are cookieless. There is no advertising, marketing, or cross site tracking.
Who owns my data and my clients’ data?
You own the content you put into HeartLedge. Content your clients submit belongs to them, and you have access to it through HeartLedge.
Your data, your control
Can I export my data?
Yes. You can export your practice’s data from HeartLedge at any time, from Settings. The export is a .zip file of JSON and CSV files covering clients, sessions, notes, payments, messages, and offers.
What happens if I delete my account?
Deleting your HeartLedge account starts a 30 day grace period. During that time, you can restore everything by signing in and confirming. After 30 days, your practice data is permanently deleted and cannot be recovered. A small set of records is kept longer, including minimal financial records for seven years.
What HeartLedge does not claim
Is HeartLedge HIPAA compliant?
No. HeartLedge is not a HIPAA-covered service. It is built for coaching, not clinical care, and does not sign business associate agreements. Do not use HeartLedge to store information that requires HIPAA protection.
Does HeartLedge have SOC 2 or ISO 27001 certification?
No. HeartLedge holds no SOC 2, ISO 27001, HIPAA, or PCI attestation. Card data never reaches HeartLedge’s servers, because Stripe handles it.
What happens if there is a breach?
If a breach gives someone unauthorized access to personal information that poses a real risk of harm, HeartLedge notifies the affected coaches without undue delay. Coaches get what they need to notify their own clients.
Who do I ask about security or privacy?
Email questions@heartledge.com with any question about how HeartLedge handles data.