Is WhatsApp GDPR Compliant for Gyms? When You Need Consent

Sort what your gym sends into three groups. Only the third needs consent before you send it.

1. Answers. Someone wrote to you and you reply. Lisa Jansen asks whether the Tuesday evening class still has space, and you tell her.
2. Messages that run the membership. Booking confirmations, a class that moves, a reminder of a booked class, a question about a failed payment.
3. Offers. Anything that sells: a ten-class pack, a personal training block, a summer discount, an event with a price.

The test is purpose: a message that advertises is an offer, whatever else it says.

Yes, with a yes first. In the EU and the UK, an offer on WhatsApp needs the person's consent before you send it, unless the members exception below applies. In the US, the rules for marketing texts are written for SMS and it is unsettled whether they cover WhatsApp, so ask for a yes anyway.

In the EU and the UK, one exception fits gyms well: you may send current members offers for your own, similar services without asking first.

For a gym, that can cover a class pack, a PT block or an upgrade offered to a current member. It holds only if:

• The person is a customer. They bought a membership, a class card or another service from you.
• The offer is for your own, similar service. A partner's product does not qualify. Whether an offer counts as "similar" is a judgement call.
• They could say no from the start, and in every message. The law asks for a free, easy way to object when you collected the number, and again in each offer.

Every offer, to anyone, must also name the real sender (your gym's name, no alias) and give a working way to stop.

Yes, about what the lead asked for, once they have agreed to messages from your gym. If Lisa Jansen books a free trial on your website, replying about the time and what to bring answers her own request.

Offers are different, and whether a trial lead counts as a customer depends on the country. In the UK, someone who signed up for a free trial counts, if they gave you the number themselves. Elsewhere they may not. So unless your country's rule says otherwise, a lead does not go on your offers list without a yes: ask for it on the form.

The law is one lock. WhatsApp adds a second one. Its Business Messaging Policy, which covers the Business app and the Platform, says a business may only contact people who gave their number and opted in to hear from it.

This is stricter than the law. A booking confirmation needs no marketing consent, but WhatsApp still expects an opt-in before you start a chat. A member who writes first has started it. For when you can message first, see the WhatsApp 24-hour rule.

The opt-in asks less than many think. Meta says it can be general and does not have to name WhatsApp, but it must make clear the person is opting in to messages from your business, and it must name the business. It can be collected online, in person or on paper.

One form can cover both locks with two separate questions. Example wording for a signup or trial form, not a guarantee of compliance:

☐ Yes, [your gym] may message me on WhatsApp about my trial, bookings and membership. I can ask you to stop at any time.

☐ Yes, also send me offers from [your gym] on WhatsApp, such as class packs and events. I can reply STOP to any offer.

For that second box, consent must be a real choice: no pre-ticked box, and not tucked into your terms and conditions. Withdrawing must be as easy as giving it. And you must be able to show the consent, so keep a record of who ticked what, and when. For the members exception, also keep a record that the number came from a sale (in the UK, a sale or a trial).

Staff messaging members from their own phones is not banned outright, but your gym answers for those chats. Three problems follow:

• The chats leave with the person. When a coach leaves, member numbers and history go with them.
• A delete request has to reach every phone. If Lisa Jansen asks you to erase her data, you cannot do that on a phone you do not control.
• A lost phone can be a data breach. You may have to report it to your regulator within 72 hours.

Class group chats add one more: every member sees every other member's number.

The practical fix is one gym number the team works from, on gym devices or in an inbox, instead of coaches on their own phones. Turn on two-factor authentication. For how a team shares one number, see WhatsApp shared inbox for gyms.

Injuries and medical notes are health data, a special category under the GDPR, so it is wise to keep them out of chat unless you have a clear basis. Never ask for card, bank account or ID numbers on WhatsApp; its own policy forbids it.

Anyone can object to direct marketing at any time. Your gym must stop. The GDPR also says you must point out this right at the latest in your first message.

"Stop" under an offer means stop the offers, not stop answering their booking questions. Record it, take them off your offers list, and keep running the membership.

People can also ask you to erase their data. It has to go when you no longer need it for its purpose; for offers, that is when someone withdraws consent or objects to marketing.

Your privacy notice should say that your gym uses WhatsApp and what for; the GDPR asks you to state purposes and basis when you collect data.

Software that handles member messages for you (an inbox, an AI agent, a booking tool that sends WhatsApp messages) makes its provider a processor, and the GDPR requires a processor agreement with it. WhatsApp's own processing terms cover WhatsApp, not the company in between.

Ask four things:

1. Can I have your processor agreement?
2. Where is our member data stored, and for how long?
3. Who on your side can see our chats?
4. How do I delete one person's data everywhere when they ask?

On the Platform, Meta acts as a processor too, and says its customers must meet their own obligations under the GDPR. For the app and the Platform in daily use, see WhatsApp Business app vs API.

We run on the official WhatsApp Business Platform. Here is Regymo's processor agreement.

1. Sort what you send: answers, membership messages, offers.
2. Add two separate boxes to signup and trial forms.
3. Name your gym and give a way to stop in every offer; record every stop.
4. Move member chats off staff phones onto one gym number, with two-factor authentication.
5. Delete chats you no longer need, everywhere they live.
6. Get a processor agreement from every provider; mention WhatsApp in your privacy notice.
7. Check your national regulator's rule for offers; the details differ per country.