GDPR for Personal Trainers: Progress Photos, Measurements and Health Data
A practical privacy guide for coaches in the EU. When you need explicit consent, how long you can keep client data, and what to do when a client leaves.
You track your clients' weight and measurements. They send you progress photos. You probably keep notes about injuries, medication, maybe a thyroid condition. Congratulations: you are processing personal data, and specifically the most sensitive category the GDPR recognizes.
Most trainers handle this with a shrug. That works fine until a coaching relationship ends badly. One complaint to a data protection authority later, you are dealing with a problem that two signatures at the start of the engagement would have prevented.
A quick disclaimer before we go further. We are not lawyers and this is not legal advice. It is a practical summary of what we learned while building privacy controls into our own coaching app. For anything contentious, talk to an actual lawyer in your country.
Need a consent document for your clients? Create a free GDPR consent template for trainers. Your details stay in your browser.
Two piles of data
Sort what you collect into two piles. The first is ordinary personal data: name, email, phone number, billing details. You process these under the contract you have with your client, even a verbal one. No separate consent needed. You just have to inform the client about it.
The second pile is where it gets interesting. Weight, circumference measurements, progress photos, injuries, medication, menstrual cycle data. In a context where you use them to track a client's health and fitness, they count as health data under Article 9 of the GDPR, the so-called special category. Ordinary legal bases are not enough here. You need explicit consent.
Explicit means the client actively and specifically agreed to this processing and knows what it is for. A sentence buried in your terms saying "by signing you agree to everything" does not qualify. Neither does a pre-ticked checkbox.
Getting consent right
A short document or an in-app screen is enough. State what you collect (measurements, photos, health history), why (running their training and tracking progress), how long you keep it, and that consent can be withdrawn at any time. The client confirms with a signature or a click. Keep a record of when and how they did.
Two principles will keep you out of most trouble. Collect only what you actually use; if you never work with progress photos, do not ask for them. And never make consent a condition of coaching where the data is not strictly necessary. A client who refuses photos can still train from your plans.
Progress photos deserve special care
A photo of your client in underwear is likely the most sensitive thing you hold. A few rules.
Never move photos through WhatsApp or Messenger. The encryption is fine; that is not the problem. The photo stays in the chat history forever, gets copied into phone galleries and cloud backups on both ends, and you have no way to guarantee deletion. You also have no data processing agreement with the chat provider. Email shares the same problems.
Keep photos in one place that only you and the client can access, not in your phone gallery next to holiday pictures.
And never use them in marketing without a separate consent. Permission to process photos for coaching does not cover a before-and-after post on Instagram. Different purpose, different yes.
Your app is your processor
One thing almost everyone forgets. Under the GDPR you are the controller of your clients' data. Any tool you store it in, whether a spreadsheet on Drive or a dedicated coaching app, is your processor. And every processor relationship requires a data processing agreement under Article 28. Serious tools publish one as a DPA in their terms. If a provider has none, that alone tells you something.
When a client leaves
Clients have the right to erasure, and you have to comply unless another legal ground requires keeping the data. Invoices stay for accounting. But there is no reason to hold a former client's progress photos and measurements for years.
Set yourself a rule, for example deletion within a month of ending the engagement. Write it into the consent. Then actually do it. Ten minutes of housekeeping removes a security risk and a legal one at the same time.
The checklist
You have an agreement with each client; verbal counts, written protects you. You hold explicit consent for measurements, photos and health data, with the purpose stated. Sensitive data never travels through chat apps. You have a data processing agreement with every tool that stores client data. You know where everything lives and can delete it. And your clients know who to ask when they want their data shown or removed.
If you hesitated on any of these, you are in the majority. It is also why we built Article 9 consent directly into Socra.fit: clients confirm it during onboarding, check-in photos live in access-controlled storage, and erasure is one click. We are a Czech-built coaching platform, live and in daily use, and free with no client limit until we switch on paid tiers. If you want client management with privacy already handled, create your account below.