Welcome to Qoach, a student coaching platform operated by Qoach Technologies Limited (“Qoach”, “we”, “us” or “our”). These Data Protection and Global Privacy Standards (“Standards”) form a legally binding agreement between you, the parent or guardian (“you”, “your”, “parent” or “Parent Client”) and Qoach, governing your purchase and use of Qoach’s coaching services for your child (“student” or “Student Client”). These Standards apply to Parent Clients and Student Clients worldwide. These Standards are an integral and inseparable part of our Terms and Conditions ("T&Cs") which you have received, and agreed to, separately.

By purchasing a session package or continuing with payment, you confirm that you have read, understood and agree to these Standards.

1. Recording & AI Note-Taking. All Qoach sessions are recorded (audio and/or screen capture) through Qoach’s secure AI-enabled note-taking platform (“Recording”). By purchasing coaching services, you – acting on behalf of your child - and your child agree and consent to: (i) the Recording and secure storage of each session, including student voice, visuals and coach–student interaction; (ii) the use of anonymised or pseudonymised extracts of Recordings for (a) service-quality assurance, (b) coach training and supervision, and (c) research and development of Qoach’s proprietary products, including the Qoach in Your Pocket (QYP) and AI-based coaching tools; and (iii) internal review of Recordings for safeguarding, audit and regulatory purposes. Recorded sessions are not provided to parents or students by default in order to maintain the coaching confidentiality and trust except as required by applicable law or with Qoach’s discretion in exceptional cases. If the parent or student revokes consent to Recording, Qoach reserves the right to suspend or terminate services.

2. Use of AI Notetakers. You understand that Qoach utilizes an AI-powered note-taking assistant to transcribe or summarize sessions. This AI may process the audio/video content of sessions to generate notes. Qoach ensures that any AI processing is done securely (through vetted processors) and that outputs are only used for coaching support, training, or service improvement as described. No automated decision that significantly affects your child will be made without human review; the AI tools are assistive and Qoach oversees all outputs.

3. Data Handling. Recordings and notes are stored securely on Qoach’s systems or those of our contracted service providers. All providers (such as our video platform and AI transcription service) are contractually required to maintain confidentiality and data security equal to our standards. They cannot use your child’s data for any purpose except to provide services to Qoach.

4. Ownership and Intellectual Property. Recordings are the property of Qoach Limited. Qoach retains all intellectual-property rights in data, materials and programme elements derived from Recordings. Students will never be publicly identifiable without separate, explicit consent of the parent.

5. No Unauthorized Recording. You and the student agree not to audio- or video-record any coaching session by any means outside of Qoach’s provided platform. The official session recordings made by Qoach are confidential and for internal use. You shall not publish, share or distribute any Recordings or any excerpts without Qoach’s written consent.

6. Global Privacy Compliance. Qoach Limited acts as Data Controller under the Dubai International Financial Centre Data Protection Law No. 5 of 2020 (as amended). Qoach also designs its policies to meet or exceed the EU GDPR and the UK Data Protection Act 2018.

7. Lawful Bases. Processing is carried out on the bases of contract performance, legitimate interests (service delivery and safeguarding), consent (where required for children and recordings), and legal obligation.

8. Cross-Border Transfers. Where personal data is transferred outside the DIFC, Qoach uses adequacy decisions, Standard Contractual Clauses, or other legally permitted mechanisms consistent with GDPR/DIFC standards. Personal data may be processed on servers located in various countries. Qoach ensures any transfer of personal data out of your jurisdiction is protected by approved safeguards.

9. Retention & Anonymisation. Recordings and associated notes are retained for up to three (3) years after the final session, after which they are either anonymised for aggregate analysis or securely deleted. Earlier erasure may be available where law permits. Personal data will not be retained longer than necessary for the purposes of coaching and safety consistent with applicable laws and regulations.

10. Data Deletion. Parents (or students, if of legal age) may request deletion of personal and identifiable data or recordings. Qoach will honour such requests within legal requirements provided that certain data needed for legal or safeguarding obligations may be retained as required by law.

11. Security. Qoach uses encryption, access controls, audit logging and regular security testing. All staff and coaches receive data-protection training. You acknowledge that no system is completely secure or immune to breaches. Except as required by law, Qoach shall not be liable for unauthorized access, hacking or data breaches perpetrated by third parties.

12. Breach Notification. Qoach will notify the DIFC Commissioner of Data Protection and affected parents of any personal-data breach posing a risk to students’ rights and freedoms without undue delay and within statutory time limits.

13. Third-Party Processors. Qoach’s vendors (e.g., conferencing, AI note-taking, CRM, payments) are bound by written contracts with data-protection obligations equivalent to these Terms and GDPR-standard safeguards.

14. School and Other Partnerships. Qoach will comply with all applicable student data privacy laws, such as the Family Educational Rights and Privacy Act. when working with schools or similar state laws when handling educational records, if applicable.

15. Adult Consent. If the Student Client is 18 or older (or has attained the age of majority in their respective jurisdiction), the student must themselves agree to these Standards (in addition to any parent/guardian who may be paying on their behalf). In such cases, references to ‘Parent Client’ in sections regarding consent and data privacy include the student and the student will have sole rights over their personal data.

16. Consent Transition. If the Student Client reaches the age of majority during a coaching package, he/she will be required to indicate acceptance of these Standards in their own capacity going forward. Qoach will seek the now-adult student’s consent for continued coaching and data processing and the confidentiality provisions will thereafter apply primarily between coach and student.

If your child is under 13, you confirm and warrant that you are the legal guardian and consent to Qoach’s collection and use of the child’s personal data in compliance with applicable laws and regulations relating to the child's online privacy, including (but not limited to) the U.S. Children’s Online Privacy Protection Act and the UAE Child Digital Safety Law.

This clause serves as a direct notice to obtain opt-in consent from you, as a parent or legal guardian, before any personal information is collected from your child. You have the right to review or delete your child’s information at any time.

You represent and warrant that you are the parent or legal guardian of the student and legally authorized to provide such consent for the Student Client. Qoach relies on this representation to provide services and to lawfully process the child’s data. You agree to indemnify Qoach for any claims or losses arising from false representation of your legal authority.

These Standards are an integral and inseparable part of our Terms and Conditions ("T&Cs") which you have received, and agreed to, separately. By using our services, you agree to the terms of the Standards. In the event of any conflict or inconsistency between these Standards and the T&Cs, the provisions of the T&Cs shall prevail to the extent necessary to resolve the conflict. Unless explicitly stated otherwise within the Standards, all clauses, conditions and obligations set forth in the T&Cs, including but not limited to disclaimers, limitations of liability shall continue to apply with full force and effect to any matter arising from or related to these Standards and our data processing activities.