TrainersBookGDPR for gyms and PT studios: who is responsible for client data?
Personal trainers collect sensitive details about real people. This guide explains the roles in plain words and gives you questions to ask a software supplier.
Controller and processor
Under the GDPR, the controller decides why and how personal data is used. The processor handles the data on the controller's behalf. For a gym or studio that employs its trainers, the business is usually the controller of client data, and the software supplier is usually the processor. A self-employed trainer is often the controller of their own clients. Check who holds that role when trainers rent space in your gym.
Why training data needs extra care
Name and email are personal data. Details about someone's health are a special category under Article 9 of the GDPR, with stricter rules. Depending on what you record, notes, measurements and answers on an intake form can fall into that category.
Why you need a data processing agreement
Article 28 of the GDPR requires a written agreement between the controller and the processor. It should set out what data is handled, for what purpose, how it is protected, and which subcontractors are used.
Who in your business should see what?
Only people who need the data should have it. A trainer needs the client's details to coach them. An owner normally needs to know that the client has a trainer and is active, not what the client's measurements are.
Ten questions to ask a supplier
- Who is the controller and who is the processor in your agreement?
- Do you offer a data processing agreement, and how is it accepted?
- Where is client data stored?
- Which subcontractors handle the data, and where are they?
- If you use AI, what is sent to the provider, and is it used for training models?
- Can one trainer see another trainer's clients?
- What can the business owner see about a client?
- Is a change of trainer logged?
- Can clients get a copy of their data, and how is an account deleted?
- What happens to the data if we stop using the service?
How TrainersBook is built
- The trainer or the organisation is responsible for client data, and TrainersBook acts as processor.
- Organisations enter their company details and accept a data processing agreement in the app. The agreement text is being finalised before launch.
- Client data is stored in the EU.
- The server checks access on each request, so a trainer can only reach their own clients.
- The owner's client view leaves out notes, measurements, photos and food logs.
- Changes of trainer are saved in the client's history.
- Known names are replaced with aliases before text is sent to an AI provider.
These are features of the product, not a promise that your use of it meets the GDPR. That assessment is yours to make. See how organisations work in TrainersBook.