GDPR for personal trainers: health questionnaires, client data and photos

GDPR can apply to a sole trader with a small client list. Collect only what is necessary for a defined purpose. The following is a working map, not a complete legal assessment. The basis must match the activity.

Diagnoses, medication, injuries and restrictions revealing health can be special-category personal data. Even a brief note that someone cannot train because of an illness may be health data. Replacing a diagnosis with everyday words does not automatically turn it into ordinary contact information.

Identify both an Article 6 legal basis and an Article 9 condition. Explicit consent is one possibility when freely given, specific and informed. A training contract alone does not lift the restriction on special-category processing. Do not automatically rely on the healthcare exception when an ordinary fitness service is not healthcare.

Ask for information needed to define the service safely, without routinely requesting complete medical records. Consent does not justify excessive collection. If necessary information is unavailable, explain the limits of the service and, where appropriate, suggest clinical advice first; do not promise suitability without it.

A private feedback recording and a public social-media post have different purposes and reach. For promotion, establish permission to capture and publish the person’s likeness as well as a lawful basis for processing personal data. Czech civil-law protection of likeness and GDPR are distinct requirements.

If relying on consent, specify channels and uses, allow genuine refusal without a worse training service and explain easy withdrawal. Keep evidence. Agreement to one photo is not unlimited permission for paid advertising or disclosure of a diagnosis. An identifiable transformation linked to health information may also involve special-category data.

Practically, choose a camera angle without other visitors and agree venue rules. The main client’s consent does not authorise publishing people in the background. Check captions, names, profile tags and visible documents before sharing.

If you independently determine the purposes and means of client records, you are generally their controller. The gym may separately control entry and booking data. Renting space does not automatically make it the processor of your health questionnaire. Joint decisions about purposes may instead create joint controllership.

Check the actual role of a booking or cloud provider. If processing on your behalf under instructions, it needs an appropriate Article 28 arrangement, defined access and clarity about further processors. Check transfers outside the EEA too; a European invoice does not establish where data goes or its transfer safeguards.

When working at Arena Gym, agree which records stay with the trainer, what reception needs and who responds to client requests. Do not assume the operator needs a full questionnaire or automatically takes responsibility for your independent records.

Explain the controller’s identity, purposes and legal bases, recipients, retention periods or criteria and how to exercise rights. There is no universal retention period for invoices, technique videos and health questionnaires: their purposes and reasons differ.

Use individual accounts with limited access, strong authentication and, according to risk, multiple factors. Lock devices, protect backups and paper records, and remove unnecessary sharing. Do not upload health records or identifiable videos to a public AI chat without assessment. Technical security alone does not establish a provider’s lawful role or secondary uses.

When coaching ends, review each category and delete information without an ongoing reason. Withdrawing consent does not make earlier lawful processing unlawful or automatically cancel another duty to retain a document. Respond to rights requests without undue delay, generally within one month; explain any lawful extension within that initial period.

Stop further sharing, revoke an available link, establish the scope and preserve evidence. Record when you became aware, affected information and people, potential consequences and remedial steps. Losing a phone or sending an email to the wrong recipient can be a personal data breach.

Not every breach requires notification to the Czech authority, ÚOOÚ, but every breach needs documentation and risk assessment. Notify without undue delay and, where feasible, within 72 hours of awareness unless risk to individuals’ rights and freedoms is unlikely. Likely high risk also requires informing affected people without undue delay. Obtain prompt specialist help if uncertain; do not start the clock only after an internal investigation ends.