Progress photos: how to ask for consent

Your clients' progress photos need their consent before the first photo, requested separately from everything else and explaining what you will use them for, and a secure place to store them that is not your phone's gallery. If one day you want to show a “before and after” on your social media, that is a different use: ask for a separate permission, in writing and for that specific purpose.

Why photos call for more care

A photo in which your client can be recognised is information about them. Regulation (EU) 2016/679 (the GDPR, “RGPD” in Spain) defines “personal data” as “any information relating to an identified or identifiable natural person”.

A photo is not, in itself, specially protected data – the GDPR itself, in recital 51, says that “The processing of photographs should not systematically be considered to be processing of special categories of personal data”, and explains this in terms of biometric data – a photo falls within that definition only “when processed through a specific technical means allowing the unique identification or authentication of a natural person”. It does not mention health.

But a body photo taken to track how a body changes is among the most intimate things a client shares with you. Whether, in your case, those photos reveal information about their health depends on what they show and what you use them for; if in doubt, treat them with the same care as their health data and consult a data protection professional.

How to ask for consent

The GDPR defines consent as “any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her”.

Its recital 32 adds that “Silence, pre-ticked boxes or inactivity should not therefore constitute consent.”

Applied to progress photos, your client should know before the first one:

• What they are for: seeing their progress with you, and nothing else.
• Who sees them: them and you.
• Where they are stored and for how long.
• How to delete them and how to withdraw permission.

Ask for it separately from everything else. Article 7.2 of the GDPR says that, if consent is given in a written declaration that also concerns other matters, the request must be presented “in a manner which is clearly distinguishable from the other matters”.

And Article 7.3 reminds us that the data subject “shall have the right to withdraw his or her consent at any time”.

Where to store them (and where not)

The default route for a photo a client sends you is usually the worst: it arrives by messaging app, stays in your phone's gallery, gets mixed in with your photos and can end up copied to your personal cloud.

Among its principles, Article 5.1(f) of the GDPR requires data to be processed in a manner that ensures “appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage”.

A few simple habits:

• Photos go to a single working location, not to your gallery.
• They do not travel by messaging app or by email.
• Only the people who need them see them: your client and you.
• They are deleted when no longer needed or when the client asks.

Comparing without judging

A single photo says little; two photos taken in similar conditions, some time apart, show the change. To make the comparison fair, agree on how they are taken: same light, same distance, same angles and similar clothing.

When you discuss them, talk about what you agreed to track and let your client put into words what they see. The photos are not an exam: if one day they do not want to take them, that is fine, and if they ask you to delete any, it is deleted.

Posting them on social media: another permission

A client agreeing to photos to track their progress does not mean they agree to see them on your profile. Article 6.1(a) of the GDPR refers to consent given “for one or more specific purposes”, and posting is a different purpose from tracking their progress.

In Spain, moreover, a person's image has its own law. Organic Law 1/1982, on civil protection of the right to honour, personal and family privacy and one's own image, treats as unlawful interference, in its Article 7, “the use of a person's name, voice or image for advertising, commercial or similar purposes” (translated from the Spanish).

Its Article 2 says that no unlawful interference will be found where the rights holder “has given their express consent for that purpose” (translated from the Spanish).

That same article adds that this consent “may be revoked at any time, but any resulting damages must be compensated where applicable” (translated from the Spanish).

And the LOPDGDD (Spain's data protection law), in Article 6.3, says that “performance of the contract may not be made conditional on the data subject consenting to the processing of personal data for purposes unrelated to the maintenance, development or control of the contractual relationship” (translated from the Spanish).

In practice, if you want to post a client's photos: ask in writing and separately, say which photos, where and for how long, and do not make it a condition of training with you. For how it applies to your specific case, consult a professional.

How Entrenify handles it

• Separate consent: progress photos carry a separate consent for body photos; the general health data consent is not enough.
• Given and withdrawn by the client: from their app. If they withdraw it, the app stops accepting new photos.
• Uploaded by them: the client uploads their own photos from their app, each with its angle and date, and you receive an alert that they have uploaded a photo, without the angle or the notes.
• No hidden data – on upload, the photo is saved again as a JPEG to strip out the file's hidden data, such as the GPS location or the phone model.
• No public link: the file is stored outside the public part of the server and only the client and their trainer can see it, and only when logged in.
• Comparison tool: you compare their photos between two dates.
• Real deletion: the client can delete their photos from their app, and both the record and the file are deleted. If you erase their data from their record, all their photos are deleted too.

What it does not do: it does not publish or share the photos on social media or anywhere else, and the permission to post a photo is something you request and keep yourself, outside the app. The essentials of the regulation for your business are in data protection for personal trainers, how photos fit into weekly follow-up is in online client follow-up, and the rest of the product is on the Entrenify home page (in Spanish).

Sources consulted

Checked on 11 October 2026. We link to the original source so that you can consult the current text.

• Reglamento (UE) 2016/679 del Parlamento Europeo y del Consejo, de 27 de abril de 2016 (Reglamento general de protección de datos): considerandos 32 y 51 y artículos 4, 5, 6 y 7. BOE (DOUE).
• Ley Orgánica 1/1982, de 5 de mayo, de protección civil del derecho al honor, a la intimidad personal y familiar y a la propia imagen (texto consolidado): artículos segundo y séptimo. BOE.
• Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (texto consolidado): artículo 6. BOE.