For gyms, studios, boxes & independent trainers · Updated 2026
WMHMDA for Gyms, Studios & Personal Trainers
Local gyms, boutique studios, CrossFit boxes, and independent personal trainers often assume privacy laws like this are aimed at Silicon Valley apps, not neighborhood fitness businesses. But the same intake forms, body-composition scans, and client-tracking apps every fitness business already uses collect exactly the data WMHMDA regulates — see WMHMDA for fitness apps for the software-specific version of this guide.
In short: Digital liability waivers, injury/condition intake forms, and body-composition scan results are all consumer health data under WMHMDA — for a single-location gym or a solo trainer, not just app companies. There's no small-business exemption. Generate your documents below.
Read the full guide for gyms, studios & personal trainers
Why "we're just a local gym" doesn't create an exemption
WMHMDA has no revenue threshold, employee-count exemption, or carve-out for brick-and-mortar or single-location businesses. If a gym, studio, or trainer collects consumer health data from a Washington resident — through a digital waiver, an intake questionnaire, a body-composition scan, or a client-tracking app — the same consent, disclosure, and rights-request obligations apply as they would to a venture-backed health-tech startup.
Data categories a typical fitness business collects
- Injury and medical-condition intake — liability waivers and onboarding forms asking about injuries, surgeries, heart conditions, pregnancy, or physical limitations.
- Body-composition scan results — InBody, DEXA, or caliper-based body fat percentage, muscle mass, and related biometric measurements.
- Workout and program data tied to health goals — programming notes referencing rehab, injury recovery, or weight-management goals.
- Client-management app data — trainer apps (Trainerize, TrueCoach, PT Distinction, and similar) that store client health notes, nutrition logs, or progress photos tied to a health condition.
- Wearable-integration data — heart rate or recovery data synced from a client's wearable into a studio or trainer's system.
Where gyms and trainers get compliance wrong
- Treating the liability waiver as the only needed document — a waiver addresses legal liability for injury, not WMHMDA's separate requirement for a privacy policy, opt-in consent, and a rights-request process for the health data collected on that same form.
- Digital intake forms with no privacy disclosure — moving a paper waiver to a digital form (Jotform, Google Forms, gym-management software) without adding a privacy policy link and consent checkbox for the health questions on it.
- Body-scan results stored indefinitely with no retention policy — InBody/DEXA results kept in club software for years past a member's cancellation, with no documented deletion process.
- Sharing progress data with a nutrition or supplement partner — referring client body-composition data to an affiliated nutrition coach or supplement brand for a referral fee can constitute "selling" consumer health data, requiring a specific authorization.
Example: a boutique studio with digital intake and InBody scans
A boutique fitness studio uses a digital waiver/intake form asking about injuries and medical conditions, offers monthly InBody scans stored in its gym-management software, and refers members to an affiliated nutrition coach in exchange for a referral fee. This studio needs: a privacy policy disclosing that health/injury data and body-composition scans are collected and how long they're retained; opt-in consent before the intake form's health questions are submitted; a separate authorization covering the nutrition-coach referral, since a referral fee tied to member data can count as a "sale"; and a documented process for a member to request their intake and scan data be deleted after cancellation.
Get compliant documents for your gym or training business
The WMHMDA Compliance Pack builds a privacy policy, consent form, sale authorization, retention schedule, and rights form matched to how your intake forms, scans, and client app actually collect and share data. Read everything free before you pay — $99.99 one-time.
Generate My Compliance Pack — $99.99Legal limitations
This guide describes common patterns for gyms, studios, and independent trainers, not a determination for your specific intake forms or software. A review of your actual waiver language, scan-storage practices, and any referral arrangements is recommended before relying on any generated document.
FAQ
Does a gym's digital intake form trigger WMHMDA?
Yes — intake or waiver forms asking about injuries, medical conditions, or physical limitations collect consumer health data under RCW 19.373.
Is an InBody or body-composition scan considered consumer health data?
Yes — body fat percentage, muscle mass, and similar scan results are biometric health data under WMHMDA.
Do personal trainers using a client-management app need a privacy policy?
Yes, if the app or intake process collects health-related client information — this applies to solo trainers, not just studios or gyms.
Does a single-location gym really need to worry about this, not just national chains?
Yes — there's no size or location-count exemption in WMHMDA; scope depends on the data collected, not the number of locations.