GDPR for Gyms and Studios: Member Health, Wearable and Biometric Data

Who is responsible for member data at a gym#

GDPR splits responsibility between two roles. Article 4 defines the controller as the body which, "alone or jointly with others, determines the purposes and means of the processing of personal data", and the processor as one "which processes personal data on behalf of the controller". The European Data Protection Board (EDPB) puts it in one line: "The controller, alone or jointly with other controllers, decides the purpose and means of data processing operations. The processor processes personal data on behalf of the controller."

In our reading, a gym or studio decides why it collects member data and what it does with it, so it is the controller. The membership, booking or access-control platform that stores the records for it is usually its processor. Some vendors say they are both: Cliniko, practice software for clinics, writes in its help center that "In some cases, we serve as a Processor and a Controller." Ask your own vendor which role it claims for which data, and get the answer in its contract.

Scope is wide. The EDPB's guide for small businesses says GDPR applies to an organization established in the EU or EEA, and to one outside it whose "products or services are offered to individuals who are in the EEA", and that it "applies in the same way to any sub-contractor" processing data on an organization's behalf. A UK gym answers to the UK GDPR and the Information Commissioner's Office (ICO), whose guidance this page also quotes.

Which member data counts as health data#

Article 4(15) defines data concerning health as "personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status". The ICO's guidance reads it broadly and names fitness trackers outright. Applied to what a gym typically holds:

The ICO adds that the special categories "may also catch information that is not seen as particularly sensitive": a broken leg is data concerning health just as much as a mental-health condition.

Lawful basis: two layers, not one#

Every use of member data needs one of the six Article 6 lawful bases, among them consent, "performance of a contract to which the data subject is party", legal obligation and legitimate interests. Membership billing and class bookings usually sit on the contract basis. The EDPB's small-business guide warns that where processing "will nevertheless be necessary (i.e. in the context of a contract), it means that consent is not the appropriate legal basis."

Health and biometric data need a second layer. Article 9(1) says processing of "data concerning health" and of biometric data used to identify someone "shall be prohibited", and Article 9(2) lifts that only under a listed condition. For a gym the realistic one is usually (a), where "the data subject has given explicit consent to the processing of those personal data for one or more specified purposes". The ICO says explicit consent must be confirmed in a clear statement, must specify the nature of the special category data, and should be separate from any other consents.

Consent has to be a real choice. The ICO's own example is a gym: one that makes facial recognition "a condition of entry" with no other way in has no valid consent, because "it is not objectively necessary in order to provide access to gym facilities". If the same gym offers "a choice between access via facial recognition and access via a membership card", it "could rely on explicit consent" for the members who choose the scan.

Article 9(2)(h), health or social care, is the condition clinics lean on, but Article 9(3) ties it to data processed by or under the responsibility of a professional subject to an obligation of professional secrecy. In our reading that may fit an in-house physiotherapist and is unlikely to fit front-desk staff or class instructors; take advice before relying on it. Article 9(4) also lets member states "maintain or introduce further conditions, including limitations" for health and biometric data, so check the national law where your members are.

Wearables, heart-rate screens and biometrics: when a DPIA is due#

Article 35(3)(b) makes a data protection impact assessment (DPIA) mandatory for "processing on a large scale of special categories of data referred to in Article 9(1)". Below that threshold, the EDPB says processing that meets two of nine criteria, among them sensitive data, systematic monitoring and data processed on a large scale, should be assessed through a DPIA in most cases, and gives "processing biometric data, for example scanning fingerprints or facial features" as an example of when one may be required.

The ICO's list is more specific to gyms. It names "smart technologies (including wearables)" as innovative technology, and requires a DPIA when innovative technology is combined with another criterion such as sensitive data. It also lists "any processing of biometric data" and tracking of "an individual's geolocation or behaviour" among the operations that need one in combination with another criterion. In our reading, a gym that pulls members' wearable data into its app or shows live heart rates in class should expect to need a DPIA. If you are building that feature, the wearable side is covered in wearable data APIs.

Your gym software vendor and Article 28#

If the platform is your processor, Article 28 sets the terms. You may use "only processors providing sufficient guarantees", the processor may not engage another processor "without prior specific or general written authorisation of the controller", and the work must be governed by a contract that sets out the subject-matter, duration, nature and purpose of the processing and the type of personal data. That contract must say, among other things, that the processor:

• "processes the personal data only on documented instructions from the controller";
• ensures the people handling the data are bound by confidentiality;
• takes the security measures Article 32 requires;
• assists you with data subject requests and with your obligations under Articles 32 to 36, which include breach notification and DPIAs;
• "at the choice of the controller, deletes or returns all the personal data" when the service ends.

In practice that is the vendor's data processing agreement plus its list of sub-processors and the places your data is stored. Cliniko's, as an example of the shape, is a Data Processing Addendum that "includes Standard Contractual Clauses", which it says it needs because "Cliniko and its subprocessors aren't physically in the EU/EEA". Which studio platforms publish an API, and how each hands out access, is compared in gym and studio management software APIs; the Mindbody and Glofox guides cover two of them.

How long a gym can keep member data#

Article 5(1)(e) says personal data must be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed". The ICO is explicit that "The UK GDPR does not set specific time limits for different types of data" and that you "should not keep data indefinitely 'just in case'". It expects a retention policy with standard periods where possible, and allows you to keep some details of a former customer, for example to deal with complaints, or records a law requires. The EDPB's checklist gives the same caveat: "national legislation may oblige you to keep certain data (i.e. for tax reasons)".

For a gym, our recommendation is to set separate periods for billing records, for health questionnaires and injury notes, for wearable data and for biometric templates, and to delete the health and biometric data when membership ends unless you can name a reason to keep it. The engineering side is in health-data retention and deletion.

Member rights a gym must answer#

The EDPB lists the rights as information, access, rectification, erasure, restriction, data portability, objection, and the right not to be subject to solely automated decisions. Requests must be answered "without undue delay and in any event within one month of receipt", extendable "by two further months where necessary" (Article 12(3)), and free of charge unless a request is "manifestly unfounded or excessive" (Article 12(5)). The EDPB adds that "The data processor must assist the data controller in this task", which is why your vendor's export and delete tools matter.

Two rights bite on fitness data in particular. Access (Article 15) means a copy of everything, wearable history included, provided in a commonly used electronic form when the request comes electronically. Portability (Article 20) means data the member provided, in "a structured, commonly used and machine-readable format", where processing is based on consent or contract and carried out by automated means.

If member data leaks#

Article 33 requires notifying the supervisory authority "without undue delay and, where feasible, not later than 72 hours after having become aware of it", unless the breach is unlikely to result in a risk to people. Health and biometric data raise that risk. The app-side version of this duty is in GDPR for fitness apps.

A gym's GDPR checklist (our recommendation)#

• Map what you hold: membership and billing, health questionnaires, injury notes, wearable and heart-rate data, biometric entry, CCTV.
• Give each a lawful basis, and each health or biometric item an Article 9 condition, usually explicit consent asked for separately and with a non-biometric alternative.
• Sign a data processing agreement with every platform that stores member data, and keep its sub-processor list.
• Screen wearable, heart-rate and biometric features for a DPIA before launch.
• Write retention periods per data type and delete on schedule.
• Make sure your software can export and delete one member's data, so a request can be answered within a month.

Sources and limits#

As of November 4, 2026. The GDPR articles are quoted from the regulation as adopted in 2016, read from legislation.gov.uk's copy of the original EU text; EUR-Lex refused our fetches, so check its current consolidated version for later amendments. The EDPB pages were read directly. The ICO's pages refused direct fetches and were read from Internet Archive captures dated October 2026, and the ICO itself says that because of the Data (Use and Access) Act its guidance "is under review and may be subject to change". How a rule applies to your gym depends on your country, your members and your systems, so treat this as a starting map and take advice from a qualified professional.