GDPR for Coaches and Personal Trainers: A Client Data Checklist (UK & EU)

Why coaches are squarely in scope

If you coach people in the UK or EU, you collect personal data the moment someone fills in an intake form. Fitness, nutrition and health coaches go further: injuries, medical conditions, weight, body measurements and progress photos are health data, which UK GDPR and EU GDPR treat as special category data with stricter rules.

You are the data controller for your clients. The tools you store their data in (your coaching software, email, cloud storage) are your processors. Most of GDPR for a solo coach comes down to knowing what you hold, why, where it lives, and how you would delete it.

Have a lawful basis, and a condition for health data

For general client details, contract is usually the lawful basis: you need a name, email and schedule to deliver coaching. For health data you also need an Article 9 condition, and for most coaches that means explicit consent.

In practice: add a short consent statement to your intake form that names the health information you collect and why (for example, to plan training safely around injuries), and keep a record of when the client agreed.

Collect less, and keep it in one place

Data minimisation is the easiest win. If you never use a client's date of birth, stop asking for it. Review your intake form and remove anything that doesn't change how you coach.

Then stop scattering what remains. Health details sitting in WhatsApp chats, personal email and phone photos are hard to secure and impossible to delete on request. Keep records, files, check-ins and messages in one system with proper access control.

Check your processors

For each tool that holds client data, know three things: what it stores, where it stores it, and what its data processing terms say. Reputable vendors publish data processing terms and can tell you which sub-processors and hosting regions they use.

If data leaves the UK or EU, the vendor should rely on a recognised transfer mechanism such as adequacy or standard contractual clauses. Ask before you sign up rather than after you have a hundred clients in the system.

Be ready for client requests and incidents

Clients can ask to see, correct or delete their data, and you generally have one month to respond. That's easy when everything lives in one searchable client record and painful when it is spread across six apps.

Decide in advance how long you keep data after a client leaves (many coaches choose a period tied to their insurance and accounting needs) and delete on schedule. If personal data is lost or exposed and the breach is likely to put people at risk, UK coaches must tell the ICO within 72 hours of becoming aware of it.

The afternoon checklist

1. List what client data you collect and why. 2. Add explicit consent for health data to your intake form. 3. Remove fields you don't use. 4. Move client records out of messaging apps into one system. 5. Note each tool's data processing terms and hosting region. 6. Write your retention period down. 7. Know how you would export or delete one client's data today.

CoachevaOS keeps each client's intake answers, files, check-ins and messages in a single client record, which makes access and deletion requests a search rather than a hunt. This checklist is general guidance, not legal advice; the ICO's guidance for small businesses is the best next read for UK coaches.

A realistic compliance routine

Once: write a short privacy notice, list the tools that hold client data, and check each has a data processing agreement. Decide how long you keep records after a client finishes.

Each quarter: delete data you no longer need, remove access for tools you've stopped using, and check your devices are encrypted and locked. When a client asks for their data or for deletion, respond within the month.

Keeping client information in one coaching platform rather than across chat apps, spreadsheets and email makes all of this much easier.

Key deadlines and rights at a glance

General information, not legal advice.