How long can the gym retain the member's medical questionnaire?

Only while the information has real operational utility and, where appropriate, up to the periods necessary for defence against possible claims arising from incidents during sports practice. As a general criterion, while the member is active the questionnaire should be available and updated periodically (annual review or after incidents); after the member leaves, it should move to a restricted-access archive for the applicable civil period (art. 1964 Spanish Civil Code, five years from when performance could be required) and then be securely deleted. The original explicit consent may be withdrawn by the member at any time; in that case the centre must assess whether it can continue providing certain service modalities (personal training with risk, specific programmes) or whether to redirect the activity to a standard modality.

Medical questionnaires in gyms: member health data and GDPR

Q: Can a gym ask a member for a medical questionnaire at sign-up?

Yes, but the medical questionnaire must be justified by a specific purpose linked to the member's safety during sports practice and the centre's duty of care, and must be limited to strictly necessary information. The data obtained are health data (special category, art. 9 GDPR) and require a dual legal basis: the general basis of art. 6 GDPR (performance of the member contract or legitimate interest of the centre in preventing harm) and an art. 9(2) GDPR exception that allows the processing of special categories (typically the member's explicit consent or, in specific cases, vital interests where the information may be decisive in an emergency). The centre must inform transparently, hold the questionnaire with reinforced measures, restrict access to staff with direct duties and retain it only for the time necessary.

Q: What is the legal basis for processing the member's health data in a gym?

Health data is a special category under art. 9 GDPR and its processing requires a dual basis: one under art. 6 GDPR (performance of the member contract, legitimate interest of the centre in preventing harm or compliance with safety obligations) and an art. 9(2) GDPR exception lifting the general prohibition. The applicable exceptions in a gym are typically: the member's explicit consent (art. 9(2)(a)) for the centre to hold and consult the questionnaire information when designing training or handling incidents, and the vital interests of the member or another natural person (art. 9(2)(c)) where an emergency requires access to relevant medical information without waiting for prior consent. Effective service provision (ordinary sports management) is based on the contract (art. 6(1)(b)); the additional health data layer requires documented explicit consent, separate from the general contract signature.

Q: Who at the gym can access the member's medical questionnaire?

Access must be limited to staff with direct duties over the service provision that motivates the processing: typically the assigned sports coach or trainer, the floor manager who designs the routine, the instructor of the class the member has signed up for, and the centre's sports-medical lead if any. Neither general reception, cleaning staff, the administrative team nor marketing should access. The centre must document the list of authorised profiles, train those persons on reinforced confidentiality of the information, establish technical control measures (restricted folders, management software with role-based permissions, individual passwords) and traceably record access where the system allows. The centre's security policy must expressly describe this point.

Many gyms, CrossFit boxes, pilates studios and personal training centres include an initial medical questionnaire in the member sign-up (also called PAR-Q, physical fitness questionnaire, condition sheet or similar). The aim is reasonable: to know previous injuries, contraindications for certain exercises, chronic pathologies relevant to the activity, allergies and medication that may be decisive in an emergency. But that information is health data: a special category under art. 9 GDPR, subject to a reinforced regime.

This guide explains how to legally handle the member's medical questionnaire: legal bases, explicit consent, secure custody, restricted access and retention periods, in accordance with the GDPR (Regulation (EU) 2016/679) and the LOPDGDD (Spain's Organic Law 3/2018).

The medical questionnaire as a special category under art. 9 GDPR

Although the form is filled in by the member themselves, without the involvement of healthcare professionals, the resulting information is health data for the purposes of art. 4(15) GDPR: information on physical or mental health revealing information about their state. The regime is that of art. 9 GDPR: a general prohibition on processing, unless one of the closed exceptions in art. 9(2) applies.

This triggers the dual legal basis doctrine: any processing of art. 9 data requires simultaneously relying on an art. 6 GDPR basis and an art. 9(2) exception. One alone is not enough.

The applicable dual legal basis

Scenario	Art. 6 basis	Art. 9(2) exception
General sign-up questionnaire	Performance of the member contract or legitimate interest of the centre (6(1)(b)/6(1)(f))	Explicit consent (9(2)(a))
Medical information for emergencies	Legitimate interest of the centre (6(1)(f))	Vital interests of the member (9(2)(c))
Personal training of member with pathology	Performance of personalised service contract (6(1)(b))	Explicit consent (9(2)(a))
Claims or legal defence	Legitimate interest of the centre (6(1)(f))	Legal claims (9(2)(f))

The most common scenario (sign-up questionnaire to guide training and prevent harm) is typically based on performance of the member contract + explicit consent. Consent must be specific, separate from the general sign-up consent, freely given, informed and unambiguous, and must be as easy to withdraw as to give (art. 7(3) GDPR).

How to collect explicit consent correctly

Practices that in other contexts (educational enrolment, hotel check-in, employment contract) might suffice, are not sufficient here. Good operational practices:

Specific unticked box on the online form or paper questionnaire, separate from the general contract signature. The wording must be clear: "I expressly consent that [centre name] processes the medical information provided to design my training, assist me in an incident and hold it in my member file".
Prior information: before the box, a brief notice explaining what data is requested, for what, who will access, for how long and how to withdraw consent.
Granularity: if the centre wishes to use the information also for purposes other than the member's personal training (anonymised internal statistics, specific programmes, commercial contact about associated medical services), an additional separate consent must be requested.
Documentation: the centre must be able to demonstrate that consent was given (signature, electronic record, date) in the event of a claim or inspection.
Operational withdrawal: the member must be able to withdraw consent at any time, at reception or through the app, without penalties.

An "I accept the general terms" of the sign-up is not valid as explicit consent under art. 9(2)(a) for the medical questionnaire data.

Vital interests: when it really applies

The exception in art. 9(2)(c) GDPR (vital interests of the data subject or another natural person) is designed for situations where the person is not in a condition to give consent (unconsciousness, medical emergency) and the information may be decisive in preserving their life or health. In a gym, this translates into specific scenarios:

An incident on the floor (dizziness, fall, loss of consciousness) where the coach needs to know whether the member has a known cardiac condition, severe allergy or critical medication before emergency services arrive.
Communication to the emergency medical team, once on site, of the relevant information held by the centre.

Vital interests are not a permanent basis for holding the questionnaire: they legitimise access and communication in the emergency, but ordinary prior custody is based on the member's explicit consent. The centre must describe this articulation clearly in its internal documentation.

Secure custody of the medical questionnaire

Technical and organisational measures must be reinforced compared to the centre's general standard:

Physical format: if the questionnaire is on paper, locked cabinet, access restricted to authorised staff, "clean desk" policy and destruction by shredder when retention periods expire.
Digital format: management software with granular role-based permissions, encryption at rest, encrypted backup, access logs where the system allows.
Authorised staff: closed list of profiles with access (assigned coach, floor manager, class instructor, sports-medical lead if any). General reception, cleaning, marketing and pure administration should not access.
Operational ban on transmitting the questionnaire via WhatsApp, unencrypted email or personal channels of staff.
Specific training for authorised staff on reinforced confidentiality of the information and protocols of use.
Provider contracts with the management software that include adequate measures for art. 9 GDPR data and, where applicable, safeguards for international transfers (Data Privacy Framework where the provider is US-based).

"The member's medical questionnaire is not a stationery formality: it is health data protected by law under a reinforced regime. Asking for it on a sheet signed alongside the general contract, leaving it in an open folder at reception and discussing it out loud is not an administrative detail. It is a breach with consequences."

Mario P. Talamillo · Managing Partner, Certix®

Retention periods

The questionnaire should be retained only while it has real operational utility and, where appropriate, up to the periods necessary for defence against possible claims arising from incidents during sports practice. Practical criteria:

Active member: questionnaire available and updated periodically (annual review or after a relevant incident).
After member departure: blocked archive with very restricted access for the applicable civil period (art. 1964 Spanish Civil Code, five years from when performance could be required) and secure deletion thereafter.
Withdrawal of consent: the centre must assess whether it can continue providing certain modalities (personal training with risk) or redirect to standard activity. Withdrawal does not affect the lawfulness of prior processing (art. 7(3) GDPR).
Anonymisation: if the centre wishes to retain internal statistics on types of pathologies to design its offering, it must anonymise irreversibly.

Common mistakes to avoid

Asking for the questionnaire at sign-up without a specific privacy notice.
Confusing the general contract signature with explicit consent under art. 9(2)(a).
Leaving paper questionnaires in plain sight at reception.
Sharing member medical information via WhatsApp between instructors.
Retaining questionnaires indefinitely "just in case", without a blocking and destruction policy.
Not differentiating the role of authorised staff from the rest of the team.
Not updating the questionnaire after a relevant incident (injury, surgery).

Medical questionnaire checklist

Specific privacy notice before the questionnaire, separate from the general contract.
Explicit consent under art. 9(2)(a) with specific unticked box.
Description of the processing in the records of activities with correct legal bases (dual basis).
Closed list of profiles with authorised access.
Reinforced technical measures (locked cabinet or software with role-based permissions and encryption).
Specific training for authorised staff.
Documented consent withdrawal procedure.
Retention and blocking policy after the member leaves.
Procedure for incidents and emergency access (vital interests).
Art. 28 GDPR contracts with management software providers adequate for art. 9 data.

Frequently asked questions

Can a gym ask a member for a medical questionnaire at sign-up?

Yes, justified by the member's safety and limited to necessary information. It is art. 9 GDPR data requiring a dual basis: art. 6 (contract or legitimate interest) and art. 9(2) (explicit consent or vital interests). The centre must inform transparently, hold it with reinforced measures and restrict access to staff with direct duties.

What is the legal basis for processing the member's health data?

Dual basis: art. 6 (performance of the member contract, legitimate interest) and art. 9(2) (member's explicit consent or vital interests in emergencies). Consent must be specific and separate from the general sign-up consent. Vital interests cover access in the emergency, not ordinary custody.

Who at the gym can access the member's medical questionnaire?

Only staff with direct duties: assigned coach, floor manager, class instructor, sports-medical lead if any. General reception, cleaning, marketing and pure administration should not access. Documented list, specific training and role-based permissions in the software.

How long can the gym retain the medical questionnaire?

While the member is active, available and updated periodically. After they leave, blocked archive for the applicable civil period (art. 1964 Spanish Civil Code, five years) and secure deletion thereafter. Withdrawal of consent does not affect the lawfulness of prior processing.

This content is merely informative and educational; it does not constitute specialised legal advice in any case. The application of the regulation to each specific case requires individualised analysis. Spanish regional sector regulations may extend or modify periods and requirements.

Want to organise the processing of your members' health data?

At Certix we assign you an expert in sports sector compliance. Individualised analysis of the questionnaire, clauses and custody.

Talk to an expert