Tools and providers
Part of Choosing fitness creator software and suppliers with health boundaries written into the brief
Six questions to settle about a fitness supplier before live use
Check a fitness supplier's identity, health scope, data chain, security evidence, contract, service controls and exit before live use in England.
Fitness creators vendor due diligence should follow the information and decision through the whole service, not stop at a sales page. Complete this checklist for the legal entity, named workers, software edition and intended use.
This England operating checklist was researched on 5 September 2026. No company entry, credential, contract or system was independently tested. Named health, privacy, advertising, cyber-security and contract reviewers must examine the evidence relevant to them.
What to take away
- Due diligence must follow the information and decision through the whole service, not stop at a sales page.
- A pass means evidence was gathered for that use, not that the supplier is endorsed or guaranteed compliant.
- Registration, a disclaimer or a vendor badge cannot replace claim-specific substantiation for health advertising.
- No price comparison is valid until scope and assumptions match between suppliers.
- Stop before live use if the supplier cannot identify its contracting party or return records.
1. Establish who is contracting
Establish who is contracting
- Record the trading name, legal name, company number, address and person authorised to commit the supplier.
- Match the invoice, order form, data terms and insurance evidence to that entity.
- Identify subcontractors and the person who will actually deliver the work.
The Companies House service can show incorporation details, officers, filings, charges and insolvency information. Presence on that service is not proof of competence, solvency, honesty or regulatory approval.
Identify the contracting entity
- Record trading name and legal name
- Record company number and address
- Name person authorised to commit
- Match invoice, order form, data terms
- Match insurance evidence to entity
- Identify subcontractors and actual deliverer
2. Test professional-scope claims
- Write down the exact health judgement being purchased.
- Verify a named individual's profession, current registration and declared competence.
- Reject claims that software itself diagnoses, prescribes or makes content clinically safe.
The HCPC Register covers the professions regulated by HCPC. It does not cover every fitness role or rank registrants. If the work involves objective health advertising, compare the proposed evidence process with CAP Code Section 12. Registration, a disclaimer or a vendor badge cannot replace claim-specific substantiation.
3. Map the data chain
- List every data field, purpose, user, location, retention period and recipient.
- Separate ordinary account data from possible health information.
- Name controllers, processors and subprocessors; record change-notice and objection routes.
- Confirm assistance with access, correction, deletion and incidents.
A worked field list for a class-booking feature:
Map the data chain
- member reference and account email
- date of birth and declared injury or condition
- emergency contact
- attendance timestamp
- payment status
- marketing consent
- retention period
- recipients, such as the payment processor and the email provider
The declared injury field is the one that turns ordinary account data into possible health information.
The ICO's processor-contract guidance addresses instructions, confidentiality, security, subprocessors, rights, deletion and audits. Its notice says the material is under review after the Data (Use and Access) Act 2025. Obtain a current privacy decision rather than copying this checklist into a contract.
4. Ask for security evidence
- Require the authentication, role, administrator and audit-log model.
- Ask how vulnerabilities, support access, backups and incidents are managed.
- Distinguish independent assurance from a supplier's own statement.
- Check which security duties remain with the buyer.
The NCSC's Cloud Security Principles organise questions across asset protection, operations, supply chains, identity and audit information. They are an assessment framework, not approval of a service. Match the depth of review to the sensitivity and business impact.
5. Read the complete commercial terms
Read the complete commercial terms
- Compare the promised deliverable with the contract's service description.
- Record implementation, usage, storage, support, renewal and exit charges using one period and unit.
- Have a qualified reviewer examine liability, suspension, price changes, intellectual property, confidentiality and governing law.
- Preserve the version and retrieval date of every incorporated online policy.
One period and unit means putting every charge on the same time base and the same counting base, for example pounds per active account per month. If one quote is a monthly fee per named user and another is an annual fee for a stated number of accounts, divide the annual figure by twelve and by the account count.
No price comparison is valid until scope and assumptions match. A lower headline fee can exclude migration, professional review or usable export.
6. Prove operation and departure
- Use synthetic cases, including invalid input, revoked access, correction and failed integration.
- Time the support and escalation route without creating a real incident.
- Export content, evidence notes, timestamps and approval history into openable files.
- Confirm deletion, retention and subprocessor handling after termination.
The final record should show evidence, tester, date, unresolved issue and decision for each item. Stop before live use if the supplier cannot identify its contracting party, protect the permitted data, preserve a health-review gate or return the records needed to continue elsewhere.
Before you act
- Record the trading name, legal name, company number and authorised person.
- Verify a named individual's profession and current registration.
- List every data field, purpose, user, location and retention period.
- Require the authentication, role, administrator and audit-log model.
- Compare the promised deliverable with the contract's service description.
- Test synthetic cases including invalid input and revoked access.
Common questions
Does appearing on the Companies House service prove a supplier is competent?
No. Officers, filings, charges and insolvency entries can be checked there, but a listing shows only that the company is registered and has filed. It says nothing about competence, solvency, honesty or regulatory approval, and it does not cover the fitness role being bought.
Can software itself make content clinically safe?
No. A platform cannot diagnose, prescribe or sign off content as clinically safe. That judgement needs a named professional whose registration is current for the health claim being made.
What should the final record show for each checklist item?
For each item, log the evidence seen, who tested it, the date, any unresolved issue and the go or stop decision. Keep the log in a format a replacement supplier could open without your software.
