Sector reference
DPDP for Gyms, Salons and Wellness
- What is processed
- Membership and service information the gym needs in order to provide what you signed up for.
Why it is allowed, and when
There is no gym specific regime here, so the ordinary rules apply. Entry by fingerprint or face is not treated differently from anything else. It still needs its own reason, and it is still limited to what that reason genuinely requires.
Where the permission stops
Nothing here sets up a special regime for gyms, or for biometrics. There is also no requirement to offer a non biometric alternative, so a gym should not present one as legally compulsory. Equally, it should not present the biometric as legally required either.
Questions people actually ask
Can a gym use my fingerprint or face for entry?
There is no gym specific rule about fingerprints or faces here, and no separate tier for that kind of information either. It still has to meet the ordinary requirements: a proper reason, and no more than that reason needs.
Nothing obliges a gym to offer a card or a PIN instead. That said, the more easily the same purpose could be served by something less intrusive, the harder it becomes to argue the biometric was necessary.
Can a gym keep my health or body measurement data after I cancel membership?
Only while a live reason remains, or while a law requires it. Once the membership is over the reason has usually gone with it, and the measurements should be deleted rather than left on file.
Can they use my check in data or photos for marketing?
Not without asking you specifically. Information collected to let you in, or to run the service you paid for, does not arrive with permission to advertise from it.
The gym posted my before and after photo. Is that allowed?
Not on the strength of the membership form. Your pictures were taken to run the service you paid for, and advertising is a different purpose.
Publishing them needs you to agree specifically, and that agreement has to be free and unbundled rather than buried in the joining paperwork.
You can also withdraw it later, and withdrawing has to be as easy as agreeing was. Once you do, they have to stop, and make anyone they passed it to stop as well.
I cancelled my membership. Do they still have my fingerprint?
They should not, unless something genuinely still requires it. Once the membership ends, the reason the fingerprint was taken for, which was letting you through the door, has gone with it.
At that point the duty is to delete it, and to make any vendor running the access system delete it too. A fingerprint is not a thing to leave sitting in a system because nobody thought to clear it out.
What people get wrong
The data protection law requires biometric attendance.
It requires no such thing. This law neither demands nor specially permits entry by fingerprint or face. Any use of a biometric needs its own reason, and it has to stay limited to what that reason genuinely needs.
We keep your body measurements and health data after you cancel, for your records.
Once the membership ends and the reason has been served, it has to be deleted, unless another law requires it to be kept. Holding on to it in case you come back is not a purpose.
Related questions
- Can I send marketing emails under DPDP?
- How long can I keep personal data?
- Does DPDP apply to my small business?
This sector sits inside the full Sector Reference, which covers 26 sectors and 160 questions. To work through your own organisation rather than the general case, the Template Builder starts from your answers.