If you're incorporating wearable device data into exercise classes, you need to make sure you're protecting the sensitive health information they contain.
It’s a fact of life.
We’re living in an age of exponential technological progress, one in which innovation can transform entire industries, seemingly overnight. Like many others, our industry has recently experienced tremendous growth in the use of technology, which has generated torrents of health-related data collected from club members.
It’s an important development, one that raises serious questions about club operators’ responsibility to protect the privacy of those users.
One of the most frequently used fit-tech devices is the smartwatch, which, among other things, tracks steps. The popularity of such wearables has quickly lead to more sophisticated models, which count reps, monitor heart rate at work and rest, calculate VO2 max, track sleep, provide GPS information, and more.
The data tracking trend gained even more momentum in June when Apple announced that its newest watch will boast a GymKit feature that allows members to connect their digital timepieces to cardio equipment made by major manufacturers, allowing them to track their workouts in clubs.
It’s clear this sort of technology is here to stay. In March, CCS Insight, a London-based marketing firm focused on the mobile and wireless sectors, predicted that 96 million wearable devices will be sold this year. The industry is projected to reach $16.9 billion by 2021.
It’s not surprising that many club operators and trainers have chosen to incorporate new fitness technology into their operations and training programs.
Wearables can be a great tool for keeping members motivated and engaged, whether it’s through a group fitness challenge, or by tracking an individual’s progress over time.
Clubs are experimenting with new technologies all of the time—using sensors to check in members, replacing membership cards with facial recognition systems, and, even, deploying chatbots. The latter, a computer program that simulates conversation utilizing instant messaging, encourages new members to keep pursuing their fitness goals.
In many cases, members themselves are fueling the momentum in clubs that haven’t yet adopted such technology. They’re bringing their own devices and sharing the results with their trainers and others.
Fit-tech has created new ways to keep members engaged by tracking and quantifying their activities and progress. However, in doing so, it’s produced a tremendous amount of personal data, which raises important issues. Principal among them is privacy.
The data gathered by fit-tech is often health related, and, therefore, should be treated as sensitive information.
In view of this, many countries have started regulating how this information is collected, handled, and stored. Currently, more than 50 have passed some type of personal data protection law, although the level of protection that businesses are required to provide varies greatly.
For example, in the U.S., the data collected by most fitness devices doesn’t rise to the level of protected health information under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), a law dealing with the privacy and security of medical data. However, in the U.K., this same data likely does qualify as sensitive personal data, requiring a higher level of protection.
That said, regardless of the state, or country, you’re operating in, it’s good policy to regard such data as personal information about your members’ health, and to treat it with respect and care. Your members are likely to be protective of this data, and you should be, too.
At least some people are aware that every device or app provider treats personal data differently—for better or for worse—once it’s amassed and out of their control. In some cases, data brokers buy the information generated by tracking devices, and, in turn, resell it to marketers, or to insurers for their use in determining premiums.
A recent Pew survey found that only a slim majority (52%) of patients were comfortable having their medical information uploaded to a secure site, in order to share it with their doctor. Nearly half of those surveyed—46%—were either opposed to doing so, or would only do so depending on the context.
This is a little startling considering that doctors are the fourth-most-trusted professionals in the world.
What does this mean for clubs?
While your members may love the features and motivation that new devices provide, they still care, very much, about what happens to their personal data.
“While your members may love the features and motivation that new devices provide, they still care, very much, about what happens to their personal data.”
All clubs should consider putting a data privacy policy in place.
Most third-party providers of wearables or apps have privacy terms or policies, often described on their websites, that are designed to protect the user. However, once the data moves beyond the member and the provider, that data isn’t necessarily subject to the provider’s privacy provisions.
When the member’s personal data is in the hands of the club, its security depends on the club’s privacy rights policies.
If you don’t currently have a privacy policy in place, there are that provide model policies you can tailor to your club’s needs.
The explosion in fitness technology is exciting, and you’d be well-advised to capitalize on the opportunities it offers. But don’t forget about the people, the final end users, who are actually employing it—your members.
You worked hard to get them, so make sure that you take the right steps to protect and hold onto them.
Jeff Perkins previously served as IHRSA's Vice President of Governance & Public Affairs—a position that focused on monitoring and influencing legislation at the state and federal level to protect club business models and operations, and help promote the health benefits of exercise.
