- each employee should receive only the permissions needed for their role
- member entry rights are checked separately from staff permissions to edit data
- audit records support investigation but do not replace oversight and procedures
- the gym remains responsible for lawful data entry, retention periods and use
- we do not claim security guarantees or certifications without publicly verifiable evidence
Which data and processes need protection
Gym management systems may hold contact details, membership status, visit records, internal notes, documents and staff activity. Sensitivity is not determined by one field alone: linking a member's identity to arrival times or payment history creates business and privacy context that needs controls.
Before adopting software, list the data your gym actually uses, its purpose, who accesses it and how long it is kept. Do not fill in a field just because it exists. Data minimisation reduces the consequences of errors, misuse and unnecessary exports.
Staff roles and least privilege
Reception staff, trainers, managers and owners do not have the same jobs or reasons to see all data. Apply least privilege: give each employee the lowest access level that enables their specific task. A temporary need should not automatically become permanent administrator access.
Review permissions when employees join, change roles or leave. Shared accounts make it harder to identify who performed an action, so each employee should use their own. The gym owner is responsible for promptly removing their team's access.
| Control | Purpose | Operational check |
|---|---|---|
| Individual account | Links an action to a specific user | No shared administrator access |
| Role | Limits available data and actions | Reception does not receive owner permissions without a reason |
| Periodic review | Identifies outdated permissions | Compare active staff lists with accounts regularly |
| Revocation | Stops access after departure or an incident | An owner and deactivation deadline are defined |
Entry control is not the same as signing into the app
QR scanning at the door should check membership status and access to the relevant location or zone. Staff login to the management system checks different rights: viewing, editing, exporting or administration. Separating these workflows reduces the risk of an entry identifier becoming general access to data.
For fully automated entry, agree in advance what happens during internet or power outages, how lost access is revoked and emergency procedures. Software is only one part: the controller, doors, power supply and physical procedures must be coordinated with the installer and responsible people at the facility.
Auditing, exports and everyday operational protection
Audit records let you later check who performed an important action and when. Log events useful for support and investigation, but avoid unnecessary storage of secrets or full sensitive-field contents in logs. Access to audit data must also be restricted.
Member exports support business continuity but create a new copy outside the system. Files on personal computers, in email or unsecured cloud folders are no longer controlled by app permissions. The gym should restrict who exports data, where files are stored and when they are securely removed.
- use individual accounts and strong, unique passwords
- immediately remove access for people who no longer work at the centre
- export only necessary fields and control copies
- regularly review failed entries and unusual administrative actions
- agree on a contact and process for suspected incidents
Privacy, retention and data deletion
The gym should establish the legal basis and purpose of each processing activity, provide members with appropriate information and set retention periods under applicable obligations. InoGym does not independently determine how long a particular gym must retain business records and cannot replace advice from a qualified lawyer or competent authority.
First identify requests for access, correction or deletion, verify the applicant's identity and establish whether any records must be retained. Removal from the active interface and backup management are not necessarily the same technical process, so expectations and timelines are agreed through documentation and support.
Responding to suspected or confirmed incidents
Your team should know where to report lost devices, suspicious accounts, incorrect exports or unauthorised entry. Initial steps include limiting the impact, preserving relevant evidence, assessing affected data and notifying responsible people. Legal obligations and deadlines depend on the circumstances and applicable rules.
After resolving the cause, document what happened, which control failed and what change prevents recurrence. Testing procedures before an incident — including correct contacts — is more valuable than a plan that exists only on paper.