UK rules for fitness creators, from health claims to working status, with release gates

A fitness creator working from England may face several rule sets at once. Content might be general health information, an advertisement, a paid service, personal data use and a platform publication. These categories overlap, but they are not interchangeable.

A disclaimer does not fix an unsafe instruction, a hidden advert or unlawful data use.

Research for this 2027 planning guide closed on 5 September 2026. It gives general information, not medical, legal or tax advice. Publication requires a named registered health professional and named UK reviewers for the legal, privacy, advertising, consumer, intellectual-property, employment and tax issues actually present.

What to take away

Start with the activity, audience and geography

Record what the creator will do, who can receive it and where the service operates. A public strength-training video for adults is different from an individual rehabilitation plan. A free editorial post is different from an affiliate post about the same exercise product. Collecting an email address is not the same processing purpose as collecting an injury history.

Most advertising, consumer, data-protection and tax sources in this guide apply across the UK, although facts may change with the arrangement. The Care Quality Commission regulates specified activities in England. Employment-status guidance from Acas covers Great Britain. CAP records different medical-device frameworks for Great Britain and Northern Ireland, so a UK label cannot erase that territorial distinction.

Use a publication register with these fields:

Keep general information outside individual clinical decisions

General information can explain an exercise in terms that a defined adult audience can understand. It should state eligibility, exclusions, common warning signs, the source date and the route to appropriate care. It should not diagnose a viewer, prescribe for an individual's condition or tell someone to disregard professional care.

The NHS adult physical activity guidance advises people to speak to a GP first if they have not exercised for some time or have medical conditions or concerns, and to choose suitable intensity. Treat that as a referral boundary, not as a universal clearance test.

Titles matter, but title protection and safe scope are separate questions. The HCPC lists physiotherapist and dietitian among protected titles. Its current professional standards define scope by the knowledge, skills and experience needed to practise safely and require registrants to keep within that scope. Registration under one title does not approve every exercise, nutrition or treatment claim.

Some services may also raise provider-registration questions. CQC guidance explains that the England regulated activity of treating disease, disorder or injury turns on what is provided, by whom and in what professional capacity. It includes exclusions and fact-specific examples. A website label or disclaimer cannot decide that scope.

Hold the item if the service description is ambiguous, the professional cannot be verified on the relevant register, the intended audience includes an excluded group, or the referral route is missing.

Substantiate each objective health claim

An objective claim such as a programme reducing pain, treating a condition or producing a defined physical change needs evidence that matches the wording, population, intervention and outcome. Testimonials, creator experience and product popularity do not establish that result.

CAP Code Section 12 covers non-broadcast advertising. It requires evidence for objective health claims and restricts specific advice, diagnosis or treatment for conditions needing medical supervision. Marketers must not discourage essential treatment.

The rule applies to marketing communications, so editors must first decide whether content is advertising. Editorial health content still needs a safety and accuracy review even when the CAP Code does not apply.

A claim file should contain the exact sentence, its commercial status, the evidence relied on, population and outcome fit, limitations, reviewer decision and review date. Reject before-and-after material if consent, typicality, editing history or claim meaning cannot be established. Never add words such as "guaranteed", "safe for everyone" or "clinically proven" merely because a study or qualification exists.

Make advertising apparent at the first encounter

Payment is not the only relevant connection. The CMA's updated content creator endorsement guidance covers free or discounted products, commission and other incentives, as well as a creator's own brand. It says the connection should be disclosed regardless of follower count.

The ASA's current social-media advice expects an upfront, prominent and understandable ad label where influencer content is advertising. A biography, old post, brand tag or ambiguous shorthand is not a safe substitute for a disclosure on the item itself. Check the thumbnail, title, opening frame, spoken audio, caption and landing page as separate surfaces.

Consumer law reaches more than labels. The CMA explains that the unfair-commercial-practices provisions of the Digital Markets, Competition and Consumers Act 2024 apply to practices from 6 April 2025. Misleading actions, omissions and specified banned practices can affect a consumer's transactional decision. Review the offer, price, evidence, scarcity, cancellation route and material restrictions together.

For content directed at or featuring children, CAP Code Section 5 adds specific safeguards. In that code a child is under 16. Its rules include harm, unsafe imitation and direct appeals to buy. This definition is not the same as the ICO children's-code definition of under 18, so the audience record must say which rule is being applied.

Treat health information as sensitive data where applicable

Email addresses, account identifiers, photographs and device records may be personal information. Injury histories, diagnoses, inferred conditions and some fitness-app data may reveal health information and therefore be special category data.

The ICO's lawful-basis guide says an organisation must choose and document a valid basis before using personal information. The ICO's special-category guidance requires an Article 6 basis plus a separate Article 9 condition. Consent to take part in research is not automatically consent for later promotional profiling.

The Data (Use and Access) Act 2025 amended the data-protection framework. The ICO's DUAA overview states that the data-protection provisions were all operating by 19 June 2026. Some detailed ICO pages still carry an under-review notice. Record the page's status and run a publication-day check rather than relying on a saved summary.

Electronic marketing has another layer. ICO guidance updated in April 2026 explains the PECR rules for email, text and similar stored messages. Determine subscriber type, consent or the exact soft opt-in, sender identity and opt-out. Do not infer permission from a public profile or from participation in a fitness survey.

If an online service is likely to be accessed by children in the UK, assess the ICO Children's code scope. The scope can include general health, fitness or wellbeing services even when they were not designed solely for children.

Put rights, roles and working status in writing

A creator-brand agreement should identify the legal parties, deliverables, approval limits, substantiation owner, disclosure wording, payment and non-cash consideration, correction process, cancellation, complaint handling and governing law. It should also state who may reuse raw footage, edits, voice, music, trademarks and still images, for which media, territory and period.

Copyright generally arises automatically. GOV.UK explains that reusing someone else's copyright material may require permission and that a licence can be limited to specified uses. A platform download button, public post or brand asset folder is not itself proof of a broad licence. Keep releases for identifiable participants separate from copyright permissions.

Where one party handles personal information for another, identify whether each is a controller, joint controller or processor. ICO guidance on controller and processor contracts lists required contract subjects and currently warns that its detail is under review following DUAA changes. A generic marketing-services clause is not enough for processing instructions, security, sub-processors, rights assistance and deletion.

Calling a creator a contractor does not settle status. Acas says employment status depends on the contract and actual working relationship, and tax status is a separate assessment. HMRC's guidance specifically includes income and non-cash benefits from online content. Route actual arrangements to employment and tax specialists; this guide does not determine liability.

Platform settings do not replace the law

Platform terms are private rules layered over external duties; YouTube says creators must declare relevant paid promotion and comply with its paid placement and endorsement rules.

TikTok's current creator-programme page says branded content requires its commercial content disclosure setting.

First-party records can change. Save the version reviewed, check the intended market and confirm the setting on the actual draft account.

A platform label may help, but the UK disclosure still has to be clear in context. Likewise, platform acceptance does not establish health substantiation, professional authority, data lawfulness or a consumer's informed agreement.

Use a release gate, not a disclaimer box

Before publication, the content owner should confirm:

Stop publication if evidence fails a health claim, a protected title or register entry is unverified, an advert is not apparent before engagement, or special-category processing lacks both legal layers. Also stop if a child's likely access is ignored or necessary rights are absent.

Record who stopped the item and what evidence allows a fresh review.

No checklist can guarantee compliance. The defensible outcome may be to narrow the claim, remove data collection, change the audience, obtain permission or keep the item on hold.

Before you act

Common questions

When does a fitness creator need to disclose a commercial connection?

The CMA guidance covers free or discounted products, commission and other incentives, as well as a creator's own brand. It says the connection should be disclosed regardless of follower count. The ASA expects an upfront, prominent and understandable ad label where influencer content is advertising. A biography, old post, brand tag or ambiguous shorthand is not a safe substitute.

What evidence is needed for an objective health claim?

An objective claim such as reducing pain or treating a condition needs evidence that matches the wording, population, intervention and outcome. Testimonials, creator experience and product popularity do not establish that result. For non-broadcast advertising, CAP Code Section 12 requires objective health claims to be backed by evidence and restricts specific advice, diagnosis or treatment for conditions needing medical supervision.

How should a creator handle health information under data protection law?

Injury histories, diagnoses, inferred conditions and some fitness-app data may reveal health information, so they are special category data. The ICO requires an Article 6 basis plus a separate Article 9 condition.

Consent to take part in research is not automatically consent for later promotional profiling. The Data (Use and Access) Act 2025 amended the framework; provisions operate by 19 June 2026.