Personal trainer client records: what data you hold, how long to keep it and what to get consent for
A personal trainer holds personal data about every client, including health information from screening, so you need to look after it and be clear with clients about what you keep and why. The UK GDPR sets no fixed retention period: you decide and justify one, and sole traders who use personal information may need to pay the ICO's data protection fee unless they are exempt.
What records does a personal trainer actually hold?
More than most trainers realise. A typical client file includes contact details, payment records, health screening answers, injury notes, body measurements, progress photos, messages and session notes. Each of these is personal data about an identifiable person.
The ICO says health data is special category data. Its definition covers personal data relating to a person's physical or mental health that reveals information about their health status, and it says this includes things such as fitness tracker data. Health screening answers and injury notes held by a trainer clearly fall within that, and the ICO says special category data needs to be treated with greater care.
Do you need to pay the ICO data protection fee?
The ICO says organisations, including sole traders, that use personal information need to pay a data protection fee unless they are exempt. That means a self-employed trainer holding client details may need to pay, depending on their circumstances.
The ICO provides a self-assessment on its website to help you work out whether you need to pay. We have not quoted a fee here because it can change; check the ICO site for the current position.
How long should you keep client records?
The ICO says the UK GDPR does not set specific time limits for different types of data: that is up to you, and you must be able to justify how long you keep personal data based on your purposes for holding it. It says you should establish and document standard retention periods for different categories of information wherever possible, though a small organisation doing occasional low-risk processing may not need a documented retention policy.
It also says you should review whether you still need personal data at the end of any retention period, and erase or anonymise it unless there is a clear justification for keeping it longer.
Insurers sometimes expect records to be kept for a set period after training ends, so check your own policy wording before you decide. Write down the period you choose, and set a reminder to review old files.
Consent for photos, messages and reminders
Some of what you do with client data needs the client's consent: progress photos, using a photo in marketing, or sending reminders and offers by WhatsApp or email. The ICO says valid consent must be freely given, specific and informed, with a clear affirmative act, and that silence and pre-ticked boxes do not count. It also says you must keep records showing consent was obtained, and that the person must be able to withdraw it.
Ask for each use separately, make each optional, and do not make training depend on a yes to marketing. Record the date the client agreed and what they agreed to.
Storing records sensibly, and telling clients what you hold
These are general good practice. Keep paper records in a locked place, protect devices and apps with passcodes and keep health screening separate from casual chat. Avoid keeping client files in messaging apps where they can be forwarded or lost with a phone.
Tell clients in plain words what you hold, why, who sees it and how long you keep it. A privacy notice does this job, and our packs include a GDPR notice template for trainers. The free sheet below covers the consent side.
What a client records and consent sheet should ask
A preview of our free Client Records, Photo and Messaging Consent Sheet. The complete, print-ready version is sent to you by email.
Client details
- Full name
- Preferred contact methodPhone call · Text message · WhatsApp · Email
- + 1 more in the full form
What your trainer keeps (completed by your trainer)
- Information held about youContact details · Payment records · Health screening answers · Injury notes · Measurements · Progress photos · Session notes · Messages
- Where it is storedLocked paper file · Computer · Phone · Online app or cloud service
- + 3 more in the full form
Your choices (each one is optional)
- I agree to my trainer taking progress photographs for my own recordsYes / No
- I agree to my photographs being used in social media or marketingYes / NoIf yes, say whether my face may be shown
- + 3 more in the full form
Your rights
- My trainer has explained how I can ask to see, correct or delete the information held about meYes / No
- I have been told where to find the full privacy noticeYes / No
- + 1 more in the full form
The full form has 16 questions in 4 sections, a signed declaration and space for your business details. Get it free below.
Free template
Get the print-ready Client Records, Photo and Messaging Consent Sheet
A print-ready sheet that tells the client what you hold and records separate yes or no answers for photos and messages. Free, and yours to adapt.
Frequently asked questions
Do personal trainers need to register with the ICO?
The ICO says organisations, including sole traders, that use personal information need to pay a data protection fee unless they are exempt. Use the ICO's self-assessment on its website to check your own position.
How long should a personal trainer keep client records?
The ICO says the UK GDPR does not set specific time limits and that you must justify how long you keep data for your purposes. Check your insurance wording, write down your chosen period and review files when it ends.
Can I post a client's progress photo on social media?
Only if they have clearly agreed to that specific use, and they can withdraw their consent later. Ask separately from other consents and keep a record of what was agreed and when.
Is a client's PAR-Q personal data?
Yes, and the ICO says health data is special category data that needs greater care. Keep screening answers secure and separate, and tell clients how you use them.
Sources
- Data protection fee, Information Commissioner's Office
- Storage limitation, Information Commissioner's Office
- What is special category data?, Information Commissioner's Office
- What is valid consent?, Information Commissioner's Office
Every document your PT business needs
Client agreement, PAR-Q and liability waiver, cancellation policy, GDPR notice and more as editable templates. One payment, no auto-renewal.
See the packs, from £29 →These articles are general guidance for UK personal trainers, not legal, tax, insurance or medical advice. Our forms are editable templates: adapt them to your own services and your insurer's terms, and take advice from a qualified adviser where you are unsure.