Version 2026.03 — LAZ Coach
LAZ Coach protects your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Québec's Law 25. We also honour the spirit of the Universal Declaration of Human Rights in everything we do.
1. What we collect
- Account data: name, email, phone, password hash (bcrypt).
- Application/intake data: your coaching goals, current challenges, expected outcomes, and package interest, submitted through our pre-screening form.
- Coaching data: contracts, session/booking records, receipts, goals, tasks you create.
- Payments: handled by Stripe; we store provider session IDs and amounts, never your card number.
- Calendar: if Google Calendar is connected, we store OAuth tokens to create session events.
2. Why we collect it (purpose limitation)
Strictly to provide the service you applied for: pre-screen and onboard you as a client, deliver coaching sessions, process payments, and operate the practice safely.
3. Your rights under PIPEDA + Law 25
You may, at any time:
- Access every piece of data we hold about you (`Export my data` in Settings).
- Correct any inaccurate information.
- Delete your account and all associated personal data. Financial records may be retained in anonymised form for the 7-year retention period required by Canadian tax law.
- Port your data in a structured, machine-readable JSON file.
- Lodge a complaint with the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca) or the Commission d'accès à l'information du Québec.
4. AI pre-screening
Your intake application is analysed by Claude Sonnet 4.6 (via Emergent's LLM gateway) to prepare a short internal briefing for your coach before your first review. This is assistive only — a human always makes the final decision on your application. Content is processed in transit and is not used to train models.
5. Security
- Cookies are `HttpOnly`, `Secure`, `SameSite=None`.
- Passwords are hashed with bcrypt. Transport is HTTPS (TLS 1.2+).
- Payment data never touches our servers — handled directly by PCI-DSS-certified Stripe.
6. Data retention
- Active accounts: data retained while the account is active.
- Deleted accounts: personal data purged within 30 days.
- Financial records: retained for 7 years as required by the Canada Revenue Agency, regardless of account deletion.
7. Cross-border transfers
Some service providers (Stripe, Google Calendar, Anthropic/OpenAI via Emergent, Resend) process data in the United States. We use providers that offer contractual safeguards equivalent to PIPEDA / Law 25 standards.
8. Children
LAZ Coach is not directed to children under 16.
9. Contact
- Privacy contact: info@lazcoach.com
- Phone: 204-202-3433
- Founder: Hufrey Merveil La Zoube — Winnipeg, Manitoba, Canada