Rules and ethics
Part of UK rules for fitness creators, from health claims to working status, with release gates
Fitness creator data protection from sign-up to health screening to marketing
Plan lawful fitness creator data use across sign-up, health screening, research and marketing, including DUAA, UK GDPR, PECR and review gates.
Fitness creators data protection is governed by UK GDPR and PECR, and health data needs an Article 6 basis plus an Article 9 condition. Newsletter delivery, programme administration, audience research, injury screening and advertising profiles are different uses. Each needs its own necessity, data fields, legal basis, recipients, retention and deletion decision.
Data protection is UK-wide, while service or safeguarding duties may depend on territory. A named UK privacy reviewer must approve implementation.
What to take away
- Map each use separately, from newsletter delivery to injury screening, because each needs its own legal basis and retention decision.
- Health information needs an Article 6 basis plus a separate Article 9 condition, and sometimes a Schedule 1 condition too.
- Joining a class or research project does not authorise marketing messages, so keep promotional permission separate.
- Check processor contracts and deletion routes before launch, and recheck detailed ICO pages on publication day.
- Assess whether under-18s are likely to access the service, even if it is not aimed at them.
Inventory the journey field by field
For each form, direct message, wearable export and platform audience, record who decides the purpose and means, its source, access and any supplier processing.
The ICO's current page, 'A guide to lawful basis' (lawful-basis guide), says organisations must select and document a valid basis before using personal information. The Article 6 bases are consent, contract, legal obligation, vital interests, public task and legitimate interests. It also says the basis and purposes belong in privacy information. Do not use "consent" as a default when the actual arrangement does not offer a genuine choice.
Match each use to a basis rather than picking one for everything. Delivering a booked class rests on contract, answering a question about a class or running audience research can rest on legitimate interests, dealing with an emergency where someone cannot consent falls under vital interests, and a newsletter or promotional list should rest on consent.
Collect the minimum needed for the task. If a creator only needs to send a class reminder, an injury narrative or inferred diagnosis is unlikely to be necessary for that purpose.
Worked example: a class sign-up form has name, email, phone, emergency contact, injury or condition notes, and a separate marketing tick box. The injury notes field triggers Article 9, so name the Article 9 condition and the retention period before the form goes live.
Set a retention decision for every use instead of keeping everything until someone asks. Class administration details can be held for the booking and a short period afterwards for queries and accounts, injury screening notes only while the person trains with you and they are needed for their safety, and marketing records only while consent is live; financial records follow the tax rules.
Add the health-data condition
Information about injuries, diagnoses, disability, medication or exercise suitability can concern health. Deliberately inferring a condition from posts or tracker data can also bring special-category rules into view.
The ICO's page, 'Special category data' (special-category data guidance), requires an Article 6 lawful basis and a separate Article 9 condition. The conditions include explicit consent, vital interests, legal claims, health or social care purposes, public health, and archiving, research or statistical purposes. Some of these routes also require a Data Protection Act 2018 Schedule 1 condition, such as preventing or detecting unlawful acts, protecting the public, regulatory requirements, or safeguarding children and individuals at risk, plus an appropriate policy document. Document the route before collection and assess whether a data protection impact assessment is required.
Access to health information does not confer clinical competence. Health and privacy reviewers must assess the questions and processing separately.
Treat later marketing as a new decision
Participation in research, a challenge or a class does not itself authorise promotional messages. The ICO's page, 'Guidance on direct marketing using electronic mail' (electronic-mail marketing guidance), covers email, text and similar stored messages under PECR. It distinguishes consent from the soft opt-in, which applies where you obtained the person's details in the course of a sale or negotiations, you are marketing your own similar products or services, and you offered a simple way to refuse at the time and in every message. Everyone else needs consent, along with sender and opt-out controls.
Keep marketing permission separate from health-data processing. The ICO's direct-marketing guidance, 'Plan direct marketing', says special-category use for targeting generally needs a fitting condition as well as a lawful basis. Public contact details do not prove that a person invited marketing.
Check suppliers and deletion
Map form, mailing, analytics and storage suppliers. Where one is a processor, the ICO's page, 'Contracts and liabilities between controllers and processors' (controller and processor contracts), covers instructions, security, sub-processors, rights assistance and end-of-contract handling.
That detailed page is marked under review because of the Data (Use and Access) Act. The ICO's page, 'The Data (Use and Access) Act 2025: what does it mean for organisations?' (DUAA overview), tracks which of its data-protection provisions have commenced. Treat the overview as the update record, then recheck each detailed topic on publication day.
Make a child-access decision
The ICO Children's code can apply to online services likely to be accessed by under-18s, not only services aimed at them. Its scope guidance expressly includes general health, fitness or wellbeing services within the possible range.
Record the evidence for likely access, age assurance approach, child-facing explanations and default settings. The code's standards cover the best interests of the child, age-appropriate application, transparency, data minimisation, detrimental use of data and privacy by default. Do not infer age, vulnerability or residence from appearance.
Register, explain and honour rights
Most fitness creators are controllers, so they must pay the ICO's data protection fee under the Data Protection (Charges and Information) Regulations 2018 unless an exemption applies, and their details appear on the ICO's public register of fee payers. Check the ICO's fee self-assessment before launch.
Privacy information must name the controller, the purposes, the Article 6 basis and the Article 9 condition, the recipients, any transfers, the retention period and the person's rights. People can ask for access, correction, erasure, restriction, portability or an objection to processing, and can withdraw consent at any time. Tell them how to complain to the ICO, and answer requests without undue delay.
Before you act
- Map every purpose, data field, recipient and retention period.
- Name the Article 6 lawful basis for each use before collecting any personal information.
- Name the Article 9 condition, and any Schedule 1 condition, before processing health data.
- Keep marketing permission separate from health-data processing, and check the soft opt-in before messaging past participants.
- Pay the ICO data protection fee, or record the exemption you rely on.
- Publish privacy information that names the basis, the condition, retention and rights.
- Check processor contracts, sub-processors and end-of-contract deletion.
- Record evidence on likely child access and age assurance.
Hold launch if a purpose lacks a basis, health data lacks its second condition, marketing permission is bundled, processor roles are unclear, deletion cannot be carried out or children's likely use has not been assessed.
Common questions
When does fitness data count as health data?
Information about injuries, diagnoses, disability, medication or exercise suitability counts as health data, and so does a condition you infer from posts or tracker data. That brings the special-category rules into play: you need an Article 6 basis plus an Article 9 condition such as explicit consent or health or social care purposes, and sometimes a Schedule 1 condition and policy document too.
Can a creator email past class participants with offers?
Only if the soft opt-in applies: you collected their details during a sale or negotiations, you are offering your own similar services, and you gave a clear chance to refuse when you collected the details and in every message since. Otherwise you need fresh consent, kept separate from any health information they gave you.
What should happen before launch if something is missing?
Close the gap first: document the missing basis, condition, marketing permission, processor term, deletion route or child-access assessment, and have the named privacy reviewer sign it off. Reopen the review whenever a field, supplier, purpose, audience or retention period changes.
