When a client leaves: what to do with their data

When a personal training client leaves, their data has three paths: keep it archived for as long as you need it, hand them a copy if they ask for one, and delete it if they ask you to or once it is no longer needed. The important thing is to decide with a rationale you can explain, not on the fly, because deleting cannot be undone and keeping data for no reason is not a good idea either.

First, close things properly

Before thinking about data, close the relationship: confirm the date they are leaving, stop charging the fee, close their access to the app and say goodbye with a message. Ask them the reason without arguing; how to spot earlier who is about to leave is covered in how to retain your clients.

And tell them what will happen to their data – whether you will keep it and why, that they can ask you for a copy and that they can ask you to delete it. Better they hear it from you than have to ask.

How long should you keep their data?

On how long, the rule gives a principle, not a deadline. Article 5.1.e) of Regulation (EU) 2016/679 (the GDPR, known in Spain as RGPD) says that personal data must be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed”.

What counts as “necessary” depends on what you held the data for and on whether another rule requires you to keep something, so we give no deadlines here. What is worth doing is deciding in advance: Article 13.2.a) of the GDPR requires you to tell the client, when you collect their data, “the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period”.

In the meantime, keep the data of someone who has left out of your day-to-day view: out of your active client list, your alerts and your message groups.

If they ask for a copy

The right of access is in Article 15 of the GDPR, and paragraph 3 says that “The controller shall provide a copy of the personal data undergoing processing”.

If they also want it to take to another professional, Article 20 gives them, in certain cases, the right to receive the data they provided to you “in a structured, commonly used and machine-readable format”.

In both cases there is a deadline: Article 12.3 says you must inform them of the action taken “in any event within one month of receipt of the request”, with the possibility of an extension in some cases.

If they ask you to delete it

Article 17 of the GDPR governs the right to erasure. Under that article, the controller “shall have the obligation to erase personal data without undue delay” where one of the grounds it lists applies, among them that the data are no longer necessary for the purposes for which they were collected or that the data subject withdraws the consent on which the processing was based and there is no other legal ground for it.

The same article includes exceptions, for example where processing is necessary “for the establishment, exercise or defence of legal claims”.

In Spain, in addition, Article 32 of Organic Law 3/2018 (LOPDGDD, Spain's data protection and digital rights law) says that “The controller shall be obliged to block the data when it rectifies or erases them” (translated from the Spanish).

According to that same article, blocking consists of “the identification and reservation of the data, adopting technical and organisational measures, to prevent their processing, including their display” (translated from the Spanish), except to make them available to judges, courts and other authorities.

What you have to block, for how long and when you can delete it entirely depends on your case: consult a data protection professional before deleting, because deletion cannot be undone.

Checklist for when a client leaves

1. Leaving date confirmed with the client.
2. Fee deactivated, without deleting past payments.
3. App access closed.
4. Goodbye message sent, telling them what will happen to their data.
5. Record archived: out of your active list, with nothing deleted yet.
6. Removed from message groups and broadcast lists.
7. If they ask for a copy: delivered and the date noted.
8. If they ask for erasure: first check what you have to keep, and note when it was done.

How Entrenify handles it

• Archive without deleting: marking a client as having left deletes nothing. They leave your list and your dashboard, their history is kept, their access to the app is closed and any pending invitation is cancelled. The date they left is recorded, and if they come back, you reactivate them and send them access again from their record.
• Plan places: archived clients do not count as active towards the active-client limit of the Esencial plan.
• Fee: you can deactivate it without deleting it; it stops counting towards recurring income and towards who owes you, and its past payments are still there.
• Copy of their data – from their record you download a JSON file with their details, measurements, workouts, check-ins, messages, appointments, fees and payments, among other data; the client can also download it from their app. For photos, the copy includes the date and angle, not the images, and for documents, the title, category and date: if they also ask for the files, you will have to hand them over separately.
• Erasure: from their record you can delete their data, and it is irreversible. Their workouts, measurements, check-ins, photos, documents, messages, meals, appointments, fees and payments are deleted, and their record and account are anonymised.

What it does not do: Entrenify does not apply retention periods for you and has no blocking function: erasure deletes. If in your case you have to keep something, decide before deleting. What to tell your clients about their data from day one is in data protection for personal trainers, and the rest of the product is on the Entrenify home page (in Spanish).

Sources consulted

Checked on 11 October 2026. We link to the original source so that you can consult the current text.

• Reglamento (UE) 2016/679 del Parlamento Europeo y del Consejo, de 27 de abril de 2016 (Reglamento general de protección de datos): artículos 5, 12, 13, 15, 17 y 20. BOE (DOUE).
• Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (texto consolidado): artículo 32. BOE.