Who holds a client’s wearable data, and what happens when they withdraw
A coach asking a client how they slept is having a conversation. A coach storing six months of that client’s sleep data is processing special category data. Practitioners cross that line without noticing, and the guidance aimed at them is mostly templates.
- Health data is special category data. Processing it needs explicit consent, not a tick in your intake form.
- Consent must be specific, informed and as easy to withdraw as it was to give.
- Your record-keeping duty applies to your notes, not to raw device exports.
- The cheapest way to answer a deletion request is to not hold the data.
Not legal advice. This is a summary for someone making a decision without a lawyer in the room. Your own counsel and your regulator have the final word.
Practitioners who hear "you will not hold the data" often hear "you will lose your records". That is a fair worry, because professional bodies do impose long retention duties — CNHC tells registrants to keep records for eight years after the last visit, longer for children, and insurers often ask for ten.
Those two things are about different records.
| Record | Yours to keep? | For how long |
|---|---|---|
| Your notes and programme | Yes. This is your professional record | As your body or insurer requires |
| A summary you wrote from their data | Yes, with consent | The engagement, plus your insurer’s period |
| Raw device exports and files | Rarely worth holding | Delete at the end of the engagement |
| Screenshots in email | No | They are already in two inboxes and a backup |
Not holding raw device data does not touch your record-keeping duty. Your notes are still yours, and still your obligation.
- Freely given — not a condition of working with you, unless genuinely necessary.
- Specific — this purpose, named. Not "to improve your experience".
- Informed — what you hold, for how long, who else sees it, including your software.
- Withdrawable — as easily as it was given, and you must act on it.
Bundling it into your terms fails the first two. A separate opt-in, in plain words, recorded with a date, is both more defensible and faster to produce when someone asks.
| Shape | Who is the controller | What you carry |
|---|---|---|
| You collect; a tool stores it for you | You | Lawful basis, privacy notice, subject access, deletion, retention, a processing agreement with the tool, and their breach is your notification |
| Client connects to the tool; chooses what you see | The tool | What you were shown, and whatever you wrote down |
Humotron is deliberately the second. Clients connect their own devices to us, consent to us directly, and decide what you may see and for how long. It is a smaller thing to ask of the client and a lighter obligation on you.
Do I need to register with the ICO?
Most UK practitioners processing personal data electronically pay the data protection fee. It is inexpensive and checkable on the ICO’s own site — do not take this page as the authority on your situation.
Is a step count health data?
On its own, usually not. Held against a named client alongside sleep and heart-rate readings, and used to advise them, treat the set as protected.
A client asked me to delete everything.
Records you must keep by law, by a professional body or by your insurer can stay on that basis, and nothing beyond them. Say which is which when you reply.
Do I need a DPA with Humotron?
For client device data, no — they consent to us directly and we are the controller. Where we process your own notes and programme content for you, our data processing agreement covers it. Ask privacy@humotron.com.