GDPR for online coaches
holding health data

This is general information, not legal advice. Check the ICO pages linked below, or ask an adviser.

What counts as health data

UK GDPR defines health data as personal data related to physical or mental health. The ICO lists it as special category data. It says this can include fitness tracker data.

For a coach that means these records:

• Health questionnaire and PAR-Q answers.
• Injury and pain notes.
• Wearable readings such as HRV and sleep.
• Progress photos, which can reveal health. Treat them with care.

What you need to hold it

The ICO says you must identify an Article 9 condition for special category data. You also need a lawful basis.

One route is the client's explicit consent. Read the ICO guidance on the conditions before you choose one.

The ICO data protection fee

The ICO says sole traders who use personal information must pay a fee, unless exempt. Check the ICO fee page for the current rules.

A privacy notice for clients

Give every client a short notice before you collect anything. It should say:

• What you hold, such as health answers and training logs.
• Why you hold it and who can see it.
• How long you keep it.
• How to ask for a copy or ask you to delete it.
• How to contact you.

Phones, laptops and chat apps

• Put a passcode on every device that holds client data.
• Check where chat app messages and backups are stored.
• Do not leave client files in a shared drive anyone can open.

See WhatsApp or a coaching app.

Retention and breaches

Decide how long you keep client records and write it in your notice. Delete what you no longer need.

The ICO says to report a notifiable breach within 72 hours of becoming aware of it. Record every breach, including ones you do not report. Read the ICO breach guide.

Where Trainersight fits

Trainersight keeps health answers, injury notes and wearable data in one record per client.

Related: Onboarding questionnaire, WhatsApp or a coaching app. Tool: Health questionnaire template, Free tools.