You're handling sensitive data — probably without realizing it
Progress photos, intake forms, medical clearance, body fat percentage, health history: trainers collect a huge volume of personal information — and much of it is classified as sensitive data under Brazil's LGPD (Law 13.709/2018), which demands extra care. Ignoring this exposes you to complaints, fines, and lawsuits. The good news: getting compliant is simpler than it looks. (This content is informational, not legal advice.)
What counts as personal data vs. sensitive data
- - Personal Data: name, phone, email, address.
- - Sensitive Data: information about health (intake forms, medical clearance, injuries, %BF, measurements, photos revealing physical condition). Has extra protection under the law.
Almost everything a trainer collects about a client is health data — and health data is sensitive.
The principles you need to follow
- 1. Consent: collect data with clear consent, especially for photos and health information. Use a written consent form.
- 2. Purpose: only use the data for what was agreed on (tracking the workout) — not for posting on social media without specific permission.
- 3. Minimization: collect only what's necessary.
- 4. Security: store it securely (not in an open WhatsApp group, an unlocked phone gallery, or a public spreadsheet).
- 5. Data subject's rights: the student can request access, correction, or deletion of their data.
Progress photos: the trickiest part
Using a student's photo as content (marketing) requires specific consent for this purpose — different from consent to being followed. Without it, even if the result looks great, you're exposed. Have a separate, revocable image usage waiver. Here's how that fits into your Instagram marketing safely.
Real risks of non-compliance
- - Student complaint and to the ANPD.
- - Administrative sanctions and fines under the law.
- - Legal action for damages (e.g., a leaked photo or one used without permission).
- - Reputation damage — the worst outcome for anyone whose business runs on trust.
Quick fit-check checklist
- - Separate consent forms for health data and image usage.
- - Secure storage, with restricted, password-protected access.
- - Clear cancellation policy for when a student leaves.
- - Avoid sending sensitive data through open apps/group chats.
How Trainer Connect helps
- - Secure storage: data and photos with restricted access, encryption, and role-based controls.
- - Consent and deletion: the student gets their own app and can request data deletion.
- - Everything in one place: no more scattering sensitive data across WhatsApp and your phone's photo gallery.