Tools and providers
Part of Choosing fitness creator software and suppliers with health boundaries written into the brief
Fitness creators software selection: the exit test
Fitness creators software selection for England ends with an exit test: export the trial workspace, rebuild an approval trail and check the contract end terms.
A package is chosen only once you can leave it. Before signing, export the trial workspace and rebuild one approval trail outside the service. A feature-rich system that traps health evidence or publication history is a poor operational fit, whatever its demonstration looks like.
What to take away
- Test the exit before signing, using the trial workspace and fictional records.
- Export, then rebuild one approval trail outside the service.
- Check termination, retention, deletion and subprocessor terms in the contract.
- Choose only after the exit works, not before.
- A demonstration shows what was shown, not how leaving would go.
What leaving means for a fitness operation
Leaving is more than downloading a file. A fitness creator needs the published content, the edits behind it, the reviewer's decision on each claim and the record of who had access. If any of these stays behind, the evidence for a past release is gone.
The work is easier when the supplier guide has already defined the job. Name the one workflow you are testing, because an exit test that covers everything proves nothing about anything.
Items that must come out
| Item | Proof that it left | Fail if |
|---|---|---|
| Final content | Reopened in a different tool | It opens only inside the service |
| Edit history | Earlier versions readable | Only the latest version exports |
| Reviewer decisions | Name, decision and date attached to each draft | Decisions are stored as comments that do not export |
| Access record | Who held which role, and when | Roles can be seen only on screen |
| Settings | Written down by hand if no export exists | Nobody can say how the package was configured |
Mark each row as passed or failed against what you actually opened. A row you could not test is not a pass.
Rebuild one approval trail
Use one fictional piece of content that went through a claim correction. Then follow these steps outside the service.
- Export the whole trial workspace in the format the supplier offers.
- Open the files on a device that has never logged in to the package.
- Find the first draft, the correction request and the reviewer's decision.
- Put them in order and write down who approved the final version.
- Note anything you had to guess, because a guess is a gap.
If the trail cannot be rebuilt, the export is a copy of the files and not a record. That matters for health content, where the reviewer's decision is the evidence that the claim was checked.
What the contract must say at the end
The first sentence of any end-of-contract clause should say who decides what happens to the data. Under the ICO's end-of-contract provisions, a processor must, at the controller's choice, delete or return the personal data, and delete existing copies unless UK law requires storage.
The same page accepts that backups and archives may not be wiped at once. Ask the supplier when the next deletion cycle runs, and write the answer into the file. Then check the other clauses in the contract terms for creators, including retention and subprocessor changes.
Deletion is also a security matter
Deletion should leave nothing readable. The NCSC lists data sanitisation among its asset-protection goals and notes that disposing of a managed encryption key can make data irretrievable from a shared storage service.
Ask the supplier how it proves deletion, and what it will confirm in writing after you leave. A supplier that cannot describe the process has not yet earned your records. Put the question beside the other supplier questions you settle before live use.
Who runs the exit test, and when
Run it on the trial workspace, never on live client records. The synthetic-material trial is the natural place, because fictional records can be exported and deleted without privacy concern.
Give the job to someone who did not build the workspace. They will notice what the builder assumed. Record the result in the same decision file that holds the supplier's identity checks from the selection checklist, with the date and the person who ran it.
Health data and what stays out
An exit test does not need real symptoms, diagnoses or measurements. Keep them out of the trial, and read the data protection controls before deciding what a live workspace may hold.
If sensitive material is essential, pause for a named privacy review before inviting suppliers to handle it. The exit then has to cover that material too, with deletion confirmed in writing.
Before you act
- Name the one workflow the exit test covers.
- Export the trial workspace and reopen it elsewhere.
- Rebuild one approval trail and list every guess.
- Ask when backups and archives are deleted.
- Get written confirmation of how deletion is proved.
Common questions
Why test the exit before signing a contract?
After signing, the supplier has the stronger hand. Before it, you can walk away at no cost. A system that traps health evidence or publication history is a poor operational fit, so choose only after the exit works.
What should be exported in the test?
The trial workspace, in full. Then reconstruct one approval trail outside the service, covering the draft, the correction, the reviewer's decision and the final approval.
What does the contract need to cover at the end?
Termination, retention, deletion, subprocessor changes and help with data rights. Check each against the ICO's controller and processor contract guidance, which says what must be agreed when the contract ends.
