Fitness creators entry checklist: the sign-up form fields worth keeping

What to take away

Write the purpose of the form in one sentence, then delete every field that purpose does not need.
Treat injury notes, disability information and tracker records as potential health data.
Document the lawful basis, any special-category condition, access, retention and deletion before launch.
Do not invite medical histories into public comments or ordinary email.
Write escalation routes for people who volunteer health details, and test the exact page with eligible adults.

Start from the purpose of the form

Write the purpose of the form in one sentence before you add a single field. The ICO's data minimisation principle says to identify the minimum amount of personal data you need to fulfil your purpose. Every field must earn its place against that sentence.

A first sign-up form often grows because each extra question feels harmless. Take the audience, geography and task from your plan and test each field against them. A field that does not serve the task is a cost, because you must then protect it, explain it and delete it.

Field	Question to ask	Handling
Name	Does the purpose need a name, or only a way to reach the person?	Keep only if the purpose needs it
Email address	Does the purpose require reaching this person?	Keep, and record purpose and retention
Age confirmation	Does the service need to know the person is an adult?	Ask a yes or no question, not a full date of birth
Free-text "tell us about you" box	Will people type injuries or conditions into it?	Delete it, or replace it with fixed options that avoid health detail
Injury notes or disability information	Is this potential health data?	Needs a lawful basis and any special-category condition, or remove the field
Tracker or app records	Do they reveal health information?	Treat as potential health data
Marketing tick-box	Is it a separate choice from the sign-up?	Keep it unbundled from the service

Three sets of rules frame these answers: the UK GDPR, the Data Protection Act 2018 and, for marketing by email or text, PECR. The ICO regulates all three, so its guidance is the reference for each row.

Treat health details as health data

ICO guidance on special category data says health data includes any information on injury, disease or disability, and data from fitness trackers. A fitness form invites exactly that, so the safest design is one that never asks. If a field can capture it, treat the answers as potential health data.

People still volunteer details. Do not invite medical histories into public comments or ordinary email, and say so beside the form. Give a plain instruction on where to send a health question instead, and make sure that route has a named owner.

Decide what happens to the data

Settle the data decisions before launch, not after the first sign-ups arrive. Each decision needs a written answer that a named person can find. The data protection guide covers the wider rules; this list covers what the form itself must settle.

Name the lawful basis for each purpose the form serves, chosen from the six in the UK GDPR, such as consent, contract or legitimate interests.
Where a field could capture health data, name the additional special-category condition where required, such as explicit consent, or remove the field.
List who can open the responses, and remove access when roles change.
Set a retention period and a deletion routine.
Keep the answers in a file beside the form, with the date and the reviewer.

If a software supplier hosts the form, put the supplier through vendor due diligence first. Try the form on synthetic material before any real person enters data.

Write the routes for people who volunteer health details

Write escalation routes before the form goes live. A reader may mention pain, injury, pregnancy, disordered eating, medication questions or suspected illness in a free-text box, a comment or an email. Each of those needs a named person and a standard reply.

State who must not rely on the material and where personal assessment takes over. The NHS adult physical activity page is a useful general-information reference: it advises people with medical conditions or concerns to speak to their GP and to match activity to their fitness.

The standard reply should send the person to a GP or the relevant service, not answer the question. Do not store the details longer than needed to route them. Remove clinical titles or treatment claims from the reply that cannot be verified.

Test the form with eligible adults before launch

Test the exact page with eligible adults for comprehension, accessibility and unsafe interpretations. Ask whether each question is clear, whether the purpose line is visible and whether anyone read the form as an invitation to share a diagnosis. Log corrections without claiming a health effect.

Publication stays on hold until named reviewers examine the actual data fields, audience and wording, as the launch review sets out. Launch only when named health, advertising and privacy reviewers have signed the final version. The quality checklist shows the wider gates for audience, evidence, disclosure and access.

Before you act

Write the purpose of the form in one sentence.
List every field and delete any the purpose does not need.
Mark injury, disability and tracker fields as potential health data.
Record the lawful basis, access, retention and deletion for each purpose.
Write escalation routes with a named owner for each.
Test the exact page with eligible adults before launch.

Common questions

Should a first sign-up form ask about injuries?

Not unless the purpose truly needs it. Injury notes are potential health data, so asking adds a lawful-basis question, extra protection and a retention duty. A form that avoids the question avoids the burden.

What if someone puts a medical history in a comment or email?

Do not invite it, and say so beside the form. If it arrives anyway, use the escalation route: point the person to their GP or the relevant service, and do not keep the details longer than needed to route them.

Who signs off the final form?

Named health, advertising and privacy reviewers sign the final version. The file cannot certify legal or clinical safety, so it records who examined the actual fields and wording and when.

Can a disclaimer cover a risky question?

No. A form note does not remove the duty to collect only what the purpose needs. If a field is risky, delete it rather than relying on wording around it.