Gyms: Health Privacy Rules Just Got Real
OAIC’s May 2025 update confirms many gyms and fitness centres are “health service providers”. Here’s what that means for your operations, risk, and reputation—and how to get compliant fast.
1) What Changed—and Why It Matters Now
This is a regulatory update and new compliance obligation with clear cyber, data privacy, and operational risks. If you collect injury history, medical alerts, heart-rate or biometric data, you’re handling sensitive information under the Privacy Act 1988 and the Australian Privacy Principles (APPs). In Victoria and NSW, the Health Privacy Principles (HPPs) also apply.
- APP 3: Have a lawful basis to collect health information; explicit consent is mandatory for sensitive biometric/health info.
- APP 5: Provide clear notices at collection—don’t bury them in T&Cs.
- APP 11/HPP 4: Take reasonable steps to secure data. A new APP 11.3 clarifies this includes technical and organisational measures.
- APP 8: Govern overseas disclosures and vendors.
- Notifiable Data Breaches: Be ready to assess and notify when serious harm is likely.
2) The Everyday Workflow That Creates Big Risk
Picture this: a member completes a pre-exercise form on a tablet. It syncs to an overseas booking tool. There’s no APP 5 notice, staff have broad access, and exports are emailed to personal inboxes.
One compromised inbox could force breach notifications, attract regulator scrutiny, and erode member trust in days.
Hidden consequences
- Unlawful collection or use of sensitive data.
- Uncontrolled overseas disclosure (APP 8 risk).
- Weak access controls lead to internal misuse or external compromise.
- Operational disruption and reputational damage during incident response.
3) Map Your Health Data—Create a Single Source of Truth
Do this first, this week
- List every collection point: onboarding forms, wearables, PT assessments, incident reports, coaching notes, CCTV/biometric access.
- Document where data is stored (devices, cloud apps, backups), including any overseas locations and sub-processors.
- Record who accesses data and why; capture role-based permissions for casual, contractor, and remote staff.
- Define retention and deletion triggers (membership end, program completion, legal holds).
- Identify exports, reports, and emails that move data off-platform; stop ad-hoc “CSV to email” habits.
Deliverable
A one-page data flow and RACI that becomes your privacy register—the single source of truth for decisions and audits.
4) Get Lawful Basis, Notices, and Consent Right (APP 3 & APP 5)
Be clear why you collect health data (e.g., safe program design, incident management). Obtain explicit consent for sensitive health or biometric information, especially when not strictly necessary to deliver the core service. Don’t hide your notice in terms and conditions—put it where the data is collected.
Your collection notice should clearly state:
- What you collect and the purpose (e.g., injuries to tailor sessions safely).
- Whether disclosure overseas occurs (systems, countries, purposes) and how you govern it (APP 8).
- How members can access, correct, or withdraw consent, and who to contact.
- Security measures in plain language and your retention/deletion rules.
- A link to your full privacy policy.
On digital forms, use an unticked checkbox for explicit consent to health data processing—separate from general T&Cs—and keep evidence of consent.
5) Lock Down Access and Security (APP 11 / HPP 4)
APP 11.3 clarifies that “reasonable steps” include concrete technical and organisational measures.
- Restrict access to need-to-know roles; remove shared logins; review permissions quarterly.
- Enable MFA across email, booking, CRM, and training apps; enforce strong passphrases and SSO where possible.
- Stop emailing exports to personal accounts; disable auto-forwarding; use secure file sharing with expiry and access logs.
- Encrypt laptops/tablets; apply mobile device management; auto-lock tablets on the gym floor.
- Turn on audit logs and anomaly alerts; keep an access register for auditors.
- Deliver short, recurring security training for casual and remote staff (phishing, data handling, clean desk/device hygiene).
If you process payments, implement PCI DSS controls or use a PCI DSS-compliant provider to keep card data out of scope.
6) Govern Vendors and Overseas Tools (APP 8)
Your risk travels with your apps and integrations.
- Due diligence: Where is data stored and backed up? Which sub-processors are used? What certifications and penetration tests exist?
- Contracts: Add data processing and cross-border clauses (APP 8), breach notification timeframes, security standards, deletion on termination, and audit rights.
- Configuration: Default privacy-on settings, least privilege, SSO/MFA, disable export-to-email, and set retention rules.
- Verification: Request evidence of controls and deletion certificates; schedule annual reviews.
- Exit plan: Know how you will export, migrate, and verify deletion when you change systems.
Document all this in a vendor register with owners and renewal dates.
7) Be Breach-Ready—and Use Documentation as a Force Multiplier
Under the Notifiable Data Breaches scheme, you must quickly contain incidents, assess within 30 days, and notify OAIC and affected individuals as soon as practicable if serious harm is likely.
Your breach playbook should cover:
- Roles and backups (privacy officer, IT lead, comms lead).
- Containment steps (revoke access, reset credentials, isolate devices).
- Assessment workflow and decision criteria (serious harm test).
- Member and regulator notification templates and channels.
- Post-incident lessons, change management, and control updates.
“Document your business or get out.” Version-controlled SOPs create a single source of truth so remote and frontline teams execute the right steps under pressure.
8) Final Word: Protect Members, Protect the Business
In the next seven days:
- Map every health data touchpoint and update your privacy register.
- Refresh your APP 5 collection notice and explicit consent wording; brief staff and PTs.
- Turn on MFA everywhere, restrict access to least-privilege, and update vendor terms for APP 8, security, and deletion/retention.
If you’re unsure about document control, change management, or aligning policies with practice, start small but start now—your members, regulators, and reputation are watching.
