Client privacy notice (fitness)

What you need to know

The plain-English guidance that comes with this document.

• Trainers hold health data — this is your GDPR notice. Contact details, PAR-Q answers, injuries and goals are all personal data, and health information is "special category" data with extra protection. UK GDPR requires you to tell clients, in plain language, what you hold and why. Give this to clients at onboarding, alongside the screening and consent.
• You're the "data controller". That's why this notice carries your business name and address. Sole traders are controllers too — being small doesn't exempt you.
• The classic PT data breach: the shared folder and the group blast. Storing client health forms in an open cloud folder, or emailing all your enquiries with an offer, are the two mistakes that get trainers in trouble. Lock health data down, and make marketing opt-in with an easy opt-out.
• Health data needs the client's clear permission. Because it's sensitive, be able to show why you hold it (to train safely) and that the client agreed — the health screening and consent forms plus this notice cover the everyday case. Only collect what you actually need.
• Photos and social media need consent too. Before-and-after photos and posting clients on social media are personal data (and a client's image) — get explicit, specific consent, and honour it if they change their mind.
• Applies UK-wide. UK GDPR and the Data Protection Act apply across the whole UK. The ICO has free, small-business-friendly guidance if you want to go further.