What counts as health data in a fitness product
Health data is broader than medical records. In a fitness product it includes anything about a person's physical or mental condition. Rule of thumb: if a field would fit a doctor's intake form, treat it as health data and store it only with consent.
- Mood and pain check-ins after a session, including a simple scale.
- Pain notes and comments about how a joint or a muscle feels.
- Measurements such as weight, fold distance, waist or heart rate.
- Progress photos and any photo in which a body is visible.
- Injuries, pregnancy, conditions and restrictions entered in a quiz.
- Nutrition logs and dietary restrictions when they reveal a condition.
1. Explicit consent with purpose, recipients and withdrawal
Consent for health data must be explicit and separate: a step apart from the terms of service, plain words on what you collect and why, who else receives it, and an unchecked box or a button the person taps.
A purpose reads like this: personalize sessions, track progress, send measurement reminders. Recipients: the hosting platform and the providers that see the data. Withdrawal must be as easy as consent: a profile toggle that stops collection and deletes what was collected. FitCoUp stores mood, pain, measurements and photos only after this consent, which the student can withdraw in the app.
2. Separate marketing consent
An email entered to get a quiz result is given for that result. Newsletters and offers need their own consent, with an unchecked box next to the email field. Service messages, such as a renewal notice or a failed payment alert, are part of delivering the product and need no marketing consent.
Keep records: when consent was given and what text the person saw. Store the marketing flag apart from the health consent flag, so withdrawing one leaves the other intact. In FitCoUp the quiz builder captures the email with a separate marketing consent.
3. Cookie consent before any pixel loads
Meta Pixel, GA4 and TikTok pixel send behavior to third parties, so under EU rules they load only after the visitor gives cookie consent. The banner needs a real choice, accept and reject on the same level, and the page works either way.
Two consequences. Ad attribution will show fewer conversions than the payment records, because some buyers reject tracking; measure the funnel from your own analytics. And test the banner on the quiz pages, where cold traffic lands. FitCoUp loads all three pixels only after cookie consent.
4. Data export and deletion on request
Students have the right to receive their data and to have it deleted. Make both a button in the product, and keep a human path for those who email you.
Export: the student downloads profile, progress, measurements, photos and purchases as a machine readable file, usually JSON. Deletion: the account is scheduled for removal after a short grace period for accidental requests. Document what stays for legal reasons, such as invoices. In FitCoUp students export their data as JSON and delete the account themselves, with a 30 day grace period.
5. EU hosting and the processors behind your app
Where data lives is part of your fitness app privacy requirements. Hosting in the EU keeps personal data within the GDPR framework and avoids a transfer analysis for the core system. Then list every processor that touches personal data: platform, payment provider, video host, email and push services, analytics.
For each one you need a data processing agreement, where it stores data, what it receives and why. Keep the list short: every tool is another recipient to disclose. FitCoUp hosts in Frankfurt, and payments run through Stripe Connect to the creator's own Stripe account.
What the creator is responsible for and what the platform handles
Under GDPR the creator usually acts as the controller: you decide why data is collected and what happens with it. The platform acts as a processor and handles the technical side on your instructions.
- Creator. privacy policy and terms on your legal pages, in your students' language.
- Creator. the purpose wording of consents, your team's access to student data, answering requests in time.
- Creator. how you use exported data, your own email tools and ad accounts.
- Platform. EU hosting, consent storage with withdrawal, separate marketing flags, cookie gated pixels.
- Platform. export and deletion mechanics, masked emails for support roles, an audit log, two factor authentication.
- Platform. a data processing agreement; ask for it before you move students in.