The members of a fitness studio rely on the safety concept of the operators. Beginners are introduced to training by the staff. When using the equipment, the staff make sure that no accidents happen. However, one aspect is forgotten: The security of the data provided by members in order to take out a membership. A good security concept should also be in place for this.
The biggest mistakes when handling data in the gym
According to the General Data Protection Regulation (GDPR), health data is considered particularly sensitive data. This also includes weight, height and BMI. This data is often requested when signing up for a gym membership. After all, the advice and training are based on this information. There is also personal data such as name and address and, of course, bank details for the membership fee. The gym may also be under video surveillance. This also falls under data protection. All this data must therefore be stored and handled securely. However, it is not uncommon for mistakes to happen, which are often simply due to carelessness. One of the best-known careless mistakes is not deleting the data of former members on request. If someone ends their membership, they have the right to have all personal data deleted. Failure to do so can result in heavy fines. Gyms are usually an open space. There are usually several people inside. Employees and members. A consultation or personal training session often takes place there too. However, trainers often make the mistake of discussing personal and confidential matters with a member in public. This is a breach of data protection, as the other members should not hear this information. The website of a fitness studio can also be a big data dump. These are often outdated and only created quickly to present opening times and offers. They are often not yet GDPR-compliant. If interested parties want to contact the operators via the website, for example, their data is not secure.
How to make the gym data secure
The first step towards a data-secure gym is the secure storage of data and documents. This applies to both digital data and paper documents. The former should be stored on a computer that is protected by passwords or better protection mechanisms such as 2FA. The documents themselves should always be stored in a cabinet or room that is locked. In addition to personal data, this also includes training plans. As already mentioned, personal conversations must not be held in public. Think of a visit to the doctor. You don’t want the doctor to leave the door open and the whole waiting room to see why you are there. Personal consultations and confidential discussions should therefore always take place behind closed doors. IT security is also important in modern fitness studios. Smart training equipment, for example, stores members’ settings. Access is usually gained via a membership card, on which data is also stored. The IT department must ensure that this data is secure. Certain rules must also be observed for video surveillance. Firstly, it is of course not permitted to film changing rooms or showers. Membership contracts must state that certain areas are subject to video surveillance. This information should also be mentioned verbally before membership. To make absolutely sure that everyone is in the picture, a sign at the entrance indicating video surveillance is a good idea. Recordings from video cameras should not be kept for longer than 72 hours. The exception is if the videos are still needed to investigate an accident or crime. We probably don’t need to mention that the videos are not intended for the public and, like all other data, should be kept under lock and key.
Conclusion
Data protection in the gym sometimes involves more than is apparent at first glance. However, implementing secure data processing does not involve a great deal of effort. It is often only small mistakes that stand in the way of data protection. It is therefore important to train your own staff well and create a secure concept for the data.
