JobMentis for coaches: client data, GDPR and AI in Europe

Who can open a client's account?

The client and the one coach whose roster they are on. While a coach is inside the account the client sees a banner, the visit is recorded on the client's own timeline, and the client can switch the coach's access off at any time.

• Each client sits on one coach's roster. Every coach action that names a client is checked against it, so another coach in your practice, owners included, cannot open your client.
• While you work inside a client's account they see a banner saying so, and the visit lands on their activity timeline with your name, how long you stayed and which features you used.
• The client can switch off your account access at any time under Settings > Coach access. The connection and your past sessions stay; you just cannot go in.
• Your private notes about a client are visible to you only, never to the client.
• A firm that runs JobMentis under its own brand gets its own Firebase project, so its clients' documents are stored apart from everyone else's.
• JobMentis staff can also open an account for support, under the same banner and the same timeline record.

How do you keep protected characteristics out of scores?

Each of the 90 AI instructions that read a client's text carries a clause forbidding the model to infer, raise or score on a protected characteristic such as health, religion, union membership, orientation, age or nationality, and a test fails the build if a new instruction lacks it.

On 19 September 2026 we ran the CV score and the job-fit score that ship in the product on 48 test CVs: 8 single-line disclosures in 6 languages, each compared with an otherwise identical control CV. Every variant passed: the scores stayed within the control's own run-to-run spread, and the advice never commented on the disclosure.

• No feature stores a classification of a person.
• Scores are for coaching the person, never for selecting them. JobMentis sends no score, rank or report to an employer. If you also recruit, do not use a client's scores to shortlist them for a hiring client: the product is not built for that use.

How is a client's data deleted, and what records do you keep?

One deletion request erases a client's account from 158 mapped locations (databases, file storage and connected services such as payments, email and notetakers), then a verification pass checks the stores. We keep a record of processing activities and a data protection impact assessment, both written against the code.

One exception today: voice-practice conversations held by ElevenLabs follow its own retention and are not yet part of that pass.

• Data is encrypted in transit and at rest, and the notetaker and calendar connections you add are stored under their own encryption.
• No form asks a client for health, religion, union membership or similar details. Clients are told how such details are handled if they mention them, at sign-up or on their first visit.
• The notetakers you connect (Grain, Granola, Fireflies.ai, Fathom, SpeakApp, Zoom) and your scheduling tools work for you, under your own agreements with them. A session write-up reaches a client only after you approve it.