Can coaches use AI? What client confidentiality means for session notes and 360s

The Morse teamPublished November 10, 202610 min read

Coaches can use AI, but as of November 2026 the ICF Code of Ethics holds the coach to client confidentiality "through any technology systems," artificial intelligence named among them. Read with the Code's confidentiality rules, that keeps identifiable session notes, transcripts, and a sponsor's 360 feedback out of a personal ChatGPT, Claude, or Gemini account. Most life, executive, and career coaches aren't covered by HIPAA, so the rules that apply come from the coaching codes, the client agreement, and privacy laws like the GDPR.

This isn't legal advice, and it isn't coaching advice either; the subject is where client information goes when AI is involved. On November 10, 2026, we read the ICF Code of Ethics, ICF's AI Coaching Framework and Standards and its Coaching Platform Standards, the Global Code of Ethics first written by EMCC and the Association for Coaching, EMCC's ethics guidance on technology and AI, the GDPR on EUR-Lex, HIPAA's definitions in the eCFR, and the data pages of OpenAI, Anthropic, Google, Otter, Fathom, Zoom, and CoachAccountable. Two vendors deserve credit for plain wording. CoachAccountable's privacy policy opens with "The act of coaching is deeply personal," and OpenAI's page for its recorder puts consent on the user: "You're responsible for making sure that your use of record mode follows applicable laws."

Is it ethical for coaches to use AI?

Yes, under the ICF Code, as long as the AI meets the same duties you do. The ICF Code of Ethics in force since April 1, 2025 has each coach promise to "Fulfill my ethical and legal obligations to my coaching client(s), sponsor(s), colleagues, and to the public at large directly and through any technology systems I may utilize (i.e. technology-assisted coaching tools, databases, platforms, software, and artificial intelligence)" (standard 2.5). The standard before it covers storage: "Maintain, store, and dispose of any records, including electronic files and communications, in a manner that promotes confidentiality, security, and privacy" (standard 2.4). The Code defines confidentiality as protecting "any information obtained in or around the coaching relationship" unless there's a legal requirement, a threat of harm, or "written consent to release is given by the client" (ICF).

Some guides quote the wrong standard. A coaching guide updated October 4, 2026 gives standard 2.5 as the rule on "culturally sensitive boundaries" and says "It does not name AI" (Tandem Coach). In the Code on ICF's site, that boundaries text is standard 3.4, and the glossary entry for "Artificial Intelligence" points to standard 2.5.

The Global Code of Ethics, updated in December 2025 and signed by 12 coaching and mentoring bodies, says the same in its own words. Members keep "all data and records" of client work, "including digital notes, files and communications," in a way that "complies with all relevant laws and agreements that exist in their client's country regarding data protection and privacy," and they take any ethical problem "arising from the use of AI and technology" to their supervisor (Global Code of Ethics). The same Code already expects you to refer to a client "anonymously" in supervision. Describe a client to an AI tool the way you would to your supervisor.

Does HIPAA apply to life coaches?

Usually not. HIPAA covers health plans, clearinghouses, and "a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter," meaning things like insurance claims (eCFR, 45 CFR 160.103). A career or executive coach paid by a client or an employer doesn't bill that way. A health coach who works inside a clinic or bills insurance may be inside it, so check before you assume.

The confidentiality duty stays when HIPAA doesn't apply. Clinicians have a Business Associate Agreement to point to, which we cover in can therapists use ChatGPT for notes. Most coaches have no equivalent contract with an AI company.

Does the ICF AI Coaching Framework cover using ChatGPT?

Mostly not. ICF's Artificial Intelligence Coaching Framework and Standards (version 1.01, revised October 8, 2024) sorts tools into four types and says it focuses "primarily on the latter two categories of application: interactive and conversational," meaning AI that coaches the client itself (ICF). For a coach pasting notes into ChatGPT, the binding text is standard 2.5 of the Code.

The framework is still a good checklist for a notetaker, which fits its "Data Processing" type. Its requirements for that type include documentation of "who within the Provider organization will have access to coach and client data" (A.1.6), encryption for "all data during storage and transmission" (F.12.1), and "explicit consent from the Client for any data processing activities" (F.13.2). Check a notetaker's own pages for all three before you use it with a client.

Can you record coaching sessions with an AI notetaker?

Only with the client's clear agreement, and after you've read what the notetaker keeps. EMCC's guidance for coaching providers using technology says providers "should not routinely record audio or video of CMS [coaching, mentoring, and supervision] conversations unless explicitly agreed with the client and for a specific purpose which they are aware of" (EMCC Global). It's written for providers, and it sets a sensible bar for a solo coach too.

The tools themselves differ on what happens to your client's words:

• Otter lists "training our proprietary AI technology on de-identified audio recordings and on transcriptions (which may contain Personal Information)" among its uses, and warns that a recording "may contain the Personal Information of third parties" (Otter). Our Otter privacy review has the settings.
• Fathom may use de-identified meeting data to train "our in-house artificial intelligence models" unless you opt out in your settings, and says it doesn't let OpenAI, Anthropic, or Google train on it (Fathom). More in is Fathom AI safe.
• Zoom AI Companion can be set to auto-start summaries, and Zoom notes this "does not require the host to be present." An admin can send the summary to "All meeting invitees including those outside of our organization" (Zoom). On a client company's Zoom account, its admin makes that choice, not you.

CoachAccountable, a coaching platform, takes the opposite line. A post on its blog cites "the number of requests I get to integrate CoachAccountable with AI note takers" and suggests coaches stand out by telling clients "you don't invite a machine to listen in on what are generally intimate conversations" (CoachAccountable).

What does ChatGPT do with a session transcript?

It keeps it, and on personal plans it may train on it. ChatGPT Record, the Mac app's recorder, deletes the audio after transcription; our guide to ChatGPT voice recordings covers the other voice features. On Free, Plus, and Pro with Improve the model for everyone on, OpenAI says "we may use transcripts and canvases from record mode to train our models," and "It may be necessary for our team to review transcripts and canvases when using them for training." With Reference record history on, ChatGPT can draw on past transcripts in new conversations (OpenAI). One client's session could then come up while you prepare for the next.

Turning training off doesn't cover feedback. OpenAI says a thumbs up or down means "the entire conversation associated with that feedback may be used to train our models," even if you opted out (OpenAI). Claude's consumer plans keep data "for up to 5 years" in training pipelines when the training setting is on, and keep feedback for 5 years (Anthropic). Google says human reviewers, including its "trained service providers," read some Gemini chats, keeps reviewed chats for up to three years, and asks you not to "enter confidential information that you wouldn't want a reviewer to see" (Google).

Does GDPR apply when a coach uses AI?

Yes, if you or your client are in its reach, since the GDPR's household exemption covers only processing "with no connection to a professional or commercial activity" (recital 18). Coaching notes that mention health, religion, or sexual orientation fall under Article 9's special categories, which need an exception such as "explicit consent" for "specified purposes," and handing them to a vendor calls for the Article 28 contract that a consumer chatbot's terms don't provide (GDPR).

Can the employer paying for coaching see your notes?

Only what your agreements say it can, and an AI company is a party none of those agreements names. ICF standard 2.2 asks for "a clear agreement about what information is exchanged and how it is exchanged among all parties involved," and the Code's "sponsor" is the entity or individual "paying for and/or arranging or defining" the coaching. Standard 3.2 has you manage conflicts with clients and sponsors through the coaching agreement, "addressing organizational roles, responsibilities, relationships, records, confidentiality, and other reporting requirements" (ICF). ICF's Coaching Platform Standards (version 1.1, revised March 2026) require a platform to say who among the coach, the client, the sponsoring organization, and the provider sees "Session notes," "Client coaching goals," and "Survey and assessment results" (ICF).

360 feedback adds people you never met. A rater's comment can be personal data about the rater as well as about your client. GDPR Article 14 sets what a controller must tell people when personal data "have not been obtained from the data subject," including "the recipients or categories of recipients." Uploading a 360 report to a chatbot adds a recipient that no rater was told about.

What coaches owe clients, by record type

We applied the texts above, read on November 10, 2026, to the records a coaching practice keeps. "Personal AI" means a consumer ChatGPT, Claude, or Gemini account.

How Morse keeps a client's confidences out of an AI company's hands

Most risks in this article come from an AI service storing what you typed or said about a client, on its own servers, for its own purposes. Your client never agreed to that, and neither did the sponsor paying for the engagement. Morse removes the stored copy by design. The history of your chats lives in your browser, encrypted, and Morse's servers don't keep the messages or log their content. Use Morse between calls, for session prep like planning the next conversation, testing a question, or turning your own notes into a plan.

• E2EE, for thinking through a session after the call. Before anything leaves your device, your browser verifies the secure enclave's hardware attestation and encrypts your de-identified notes for that one enclave, so Morse's servers pass along ciphertext they can't open. Only your browser decrypts the answer. Third-party providers run the enclaves, not Morse, and this holds as long as the enclave hardware and attestation work as designed. E2EE runs open-weight models only, such as GLM, Kimi, and DeepSeek, without web search or image generation.
• Private, for the material you sell and share. A new chat opens in Private, which runs open-weight models such as DeepSeek, Kimi, and GLM, plus xAI's Grok. It suits a group program outline, a reflection worksheet, or a blank intake form. Morse has zero data retention agreements with its inference, search, and other providers, so they keep nothing (what zero data retention means).
• Anonymous, for asking GPT, Claude, or Gemini about a coaching model or an assessment. Morse's proxy strips your account, email, and IP address and sends the question under Morse's own account, so the provider sees it without knowing it's you. The provider may keep it for a limited time to check for abuse, under its own policy, so a question here should read like one you'd bring to supervision, with no client in it.

Whichever mode you pick, Morse doesn't train AI on what you write, sell your data, or show ads, so there's no training setting to find. Prep you'll discard after the session fits a Temporary chat, which stays in memory only. A file you attach goes out with that one message, and Morse never stores it. When you sign out, your history locks, and opening it again needs a key held on your device plus one Morse's server gives you at sign-in. If a court order ever reaches Morse, we usually have very little to give authorities, because we don't store chats (privacy policy). The same design means Morse can't restore a chat lost to a cleared browser, so the note your coaching agreement says you keep goes into your client records.

Try a chat from the Morse home page without an account, or start free with no card. End-to-end encrypted chats come with Pro, at $19 a month.