Data protection for trainers: the essentials

Data protection for a personal trainer boils down to five questions: who decides about your clients' data, what you rely on to process it, what you tell them when you collect it, how you handle health data and what you do when they ask to see or delete it. Here is what the regulation says on each point, in its literal wording, kept separate from what Entrenify does. This is not legal advice: how it applies to your business depends on your case.

Who is the controller

Regulation (EU) 2016/679 (the GDPR, “RGPD” in Spain) defines the “controller” as “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data”.

If you are the one who decides what data to ask your clients for, what you use it for and with what tools, you probably fit that definition. If you work for a gym or another company, it depends on how it is organised: do not take it for granted.

What you rely on to process their data

Article 6.1 of the GDPR says that processing “shall be lawful only if and to the extent that at least one of the following applies”. Two of those conditions relate directly to your relationship with a client:

• Their consent: “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”.
• The contract: “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”.

Which basis applies to each item depends on your case: the email you need to provide the service is not the same as a photo you might want to post. What helps is having it written down, item by item.

What you have to tell them

Article 13 of the GDPR says that, when you collect data from the data subject themselves, the controller “shall, at the time when personal data are obtained, provide the data subject with all of the following information”. That information includes:

• “the identity and the contact details of the controller”;
• “the purposes of the processing for which the personal data are intended as well as the legal basis for the processing”;
• “the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period”;
• their right to request access to, rectification or erasure of their data, among others, and to withdraw consent where the processing is based on it.

In Spain, Article 11 of Organic Law 3/2018 (LOPDGDD, Spain's data protection law) allows this to be done in two layers: giving the data subject basic information and indicating “an electronic address or other means which allows easy and immediate access to the remaining information” (translated from the Spanish).

In practice: a short text that you give them when you sign them up, with a link to the full information, and a record that you gave it to them.

Health data – explicit consent

Part of what you record when training someone may be information about their health. The GDPR defines “data concerning health” as “personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status”.

Its Article 9.1 prohibits processing, among other categories, “data concerning health”. One of the exceptions, in Article 9.2(a), is that “the data subject has given explicit consent to the processing of those personal data for one or more specified purposes”.

If you rely on that consent, Article 7.1 says the controller “shall be able to demonstrate that the data subject has consented to processing of his or her personal data”.

And Article 7.3 says the data subject “shall have the right to withdraw his or her consent at any time” and that “It shall be as easy to withdraw as to give consent.”

Body photos deserve a chapter of their own: we cover them in progress photos and consent.

When they ask to see, correct or delete their data

Your client can exercise several rights in relation to you. Here are four of them:

• Access: Article 15.3 says “The controller shall provide a copy of the personal data undergoing processing”.
• Rectification: Article 16 gives them the right to obtain “the rectification of inaccurate personal data concerning him or her”.
• Erasure: Article 17 governs it for a series of cases, such as the data being “no longer necessary in relation to the purposes for which they were collected” or the data subject withdrawing the consent on which the processing is based where there is no other legal ground for it.
• Portability: Article 20 allows them, in certain cases, to receive the data they provided to you “in a structured, commonly used and machine-readable format”.

And there is a deadline: under Article 12.3, you will inform them of what you do about their request “in any event within one month of receipt of the request”, extendable in some cases. What to do with the data of someone who stops training with you is covered in a client leaving and their data.

Security also depends on you

Article 32 of the GDPR asks the controller and the processor to apply “appropriate technical and organisational measures to ensure a level of security appropriate to the risk”. A good part of those measures are your habits, not the tool's:

• Do not keep your clients' photos or health data in your personal phone's gallery.
• Do not forward them by messaging app or email if you can share them inside the tool.
• Use a different password for each service and do not share it.
• Lock the phone and computer you work with using a passcode.

What Entrenify does and what is up to you

Entrenify gives you tools for several of these points, but it does not decide for you or replace the information you give your clients:

• Health consent: the client gives it from their app and the date is recorded; you cannot accept on their behalf. Without it their measurements cannot be recorded, including those you take yourself, nor can they send their check-in.
• Photos: they carry a separate consent, which the client can withdraw from their app; once withdrawn, the app stops accepting new photos.
• Copy of their data – the client can download it from their app, and you can from their record.
• Erasure: it is handled by the trainer, who can delete their client's data from their record. It is irreversible.
• Alerts without health data – when a check-in or a new photo arrives, the alert says that it has arrived, not what it contains.
• No public links: photos and documents are served only with a logged-in session, to their client and their trainer. The exception is the document you send for signing: it opens with the signing link that reaches them by email, for as long as that link remains valid.

What is up to you: deciding what you rely on for each item of data, writing the information you give your clients and handling their requests on time. And something worth knowing: from their app the client can withdraw both the health data consent (in their profile) and the photo consent, and you cannot change it for them. If a client tells you they are withdrawing it, talk to them and, if they want you to delete their data, you can erase it from their record. What data to ask for in the record is covered in the client record, and the full product is on the Entrenify home page (in Spanish).

Sources consulted

Checked on 11 October 2026. We link to the original source so that you can consult the current text.

• Reglamento (UE) 2016/679 del Parlamento Europeo y del Consejo, de 27 de abril de 2016 (Reglamento general de protección de datos): artículos 4, 6, 7, 9, 12, 13, 15, 16, 17, 20 y 32. BOE (DOUE).
• Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (texto consolidado): artículo 11. BOE.