You're handling sensitive data — probably without realizing it
Progress photos, intake forms, medical clearance, body fat percentage, health history: trainers collect a huge volume of personal information — and much of it is classified as sensitive data under Brazil's LGPD (Law 13.709/2018), which demands extra care. Ignoring this exposes you to complaints, fines, and lawsuits. The good news: getting compliant is simpler than it looks. (This content is informational, not legal advice.)
What counts as personal data vs. sensitive data
- Personal Data: name, phone, email, address.
- Sensitive Data: information about health (intake forms, medical clearance, injuries, %BF, measurements, photos revealing physical condition). Has extra protection under the law.
Almost everything a trainer collects about a client is health data — and health data is sensitive.
The principles you need to follow
- Consent: collect data with clear consent, especially for photos and health information. Use a written consent form.
- Purpose: only use the data for what was agreed on (tracking the workout) — not for posting on social media without specific permission.
- Minimization: collect only what's necessary.
- Security: store it securely (not in an open WhatsApp group, an unlocked phone gallery, or a public spreadsheet).
- Data subject's rights: the student can request access, correction, or deletion of their data.
Progress photos: the trickiest part
Using a student's photo as content (marketing) requires specific consent for this purpose — different from consent to being followed. Without it, even if the result looks great, you're exposed. Have a separate, revocable image usage waiver. Here's how that fits into your Instagram marketing safely.
Real risks of non-compliance
- Client complaint and to the ANPD.
- Administrative sanctions and fines provided by law.
- Lawsuit for emotional damages (e.g., a leaked photo or one used without consent).
- Reputation damage — the worst thing for a trust-based business.
Quick fit-check checklist
- Separate consent form (health data) and image release form.
- Secure storage, with restricted, password-protected access.
- Clear data-deletion policy for when a client leaves.
- Avoid sending sensitive data through open apps/group chats.
How Trainer Connect helps
- Secure storage: data and photos with restricted access, encryption, and role-based controls.
- Consent and deletion: the student gets their own app and can request data deletion.
- Everything in one place: no more scattering sensitive data across WhatsApp and your phone's photo gallery.