Ask most gym owners whether they run a health service, and they will say no. They run a fitness business. They provide equipment, coaching, classes, and space. They are not a hospital. They are not a physio clinic. The idea that their humble gym is legally sitting in the same category as a medical centre seems far-fetched.

The law sees it differently. Under the Privacy Act 1988, any business that provides a service "intended or claimed to assess, maintain, or improve an individual's health" is classified as a health service provider. And under that definition, the vast majority of gyms, fitness studios, martial arts clubs, CrossFit boxes, yoga studios, and personal training operations in Australia fall squarely into that category.

This classification matters enormously, because health service providers have never been able to rely on the small business exemption. They have always been subject to the full force of the Australian Privacy Principles. And the data they collect — health information — is classified as sensitive information under the Act, which attracts a higher standard of protection than ordinary personal data.

What Makes Data 'Health Information'?

The definition of health information under the Privacy Act is broader than most business owners expect. It is not limited to formal medical records or clinical assessments. If your business collects any of the following from members or clients, you are holding health information:

•Injury history or pre-existing conditions recorded on membership intake forms or health screening waivers.

•Physical assessment data including body weight, body fat percentage, heart rate, or fitness test results.

•Medication details or allergy information collected for safety purposes.

•Fitness goals, physical limitations, or mobility restrictions recorded by trainers.

•Information collected for event or tournament participation, including medical clearances.

•Any notes made by trainers or coaches about a member's physical condition during or after training.

All of this is health information. And health information is sensitive information. Under the APPs, you need a higher standard of care when collecting, storing, using, and disclosing sensitive information compared to ordinary personal data like names and email addresses.

What 'Higher Standard of Care' Actually Means

For practical purposes, the heightened obligations around sensitive health information translate into several specific requirements:

Express consent is required before you collect sensitive health information. Implied consent — the idea that by signing up for a membership a person has automatically agreed to all data collection — is not sufficient for health data. You need a clear, specific, affirmative statement from the member authorising you to collect and hold their health records.

Purpose limitation applies strictly. Health information collected for one purpose — say, a fitness assessment — cannot simply be repurposed for another use, such as marketing a weight loss program, without fresh consent from the member.

Access controls must be tighter. Health information should not be accessible to all staff members. Only those with a genuine operational need to see a member's health records should be able to do so. Role-based access controls in your CRM or management software are the practical tool for achieving this.

Disclosure restrictions are more stringent. Sharing health information with third parties — even business partners like event organisers or equipment sponsors — requires a much stronger legal basis than sharing ordinary contact details.

Why This Is Especially Important for Martial Arts Clubs

Martial arts clubs and combat sports organisations often hold a particularly rich data set when it comes to health information. Health screening waivers for sparring and competition, injury records maintained across years of training, weight cut records and body composition assessments for competition — this is sensitive health data by any measure.

Clubs that run tournaments or events are in an even higher-risk category. Tournament promoters frequently collect medical clearances, blood test results, and physician certification documents from fighters. This is among the most sensitive health data a fitness business can hold, and the obligations around its protection are correspondingly serious.

The OAIC explicitly uses martial arts clubs as examples when illustrating which types of businesses qualify as health service providers. If you are running a dojo, you are in the regulator's frame of reference.

The Data Minimisation Principle: If You Don't Need It, Don't Keep It

One of the most practically useful principles in the APPs is data minimisation: you should only collect the personal information that is genuinely necessary for your business functions. If you do not need a member's home address to administer a gym membership, do not collect it. If health data collected for a specific event is no longer needed after that event concludes, delete it.

This is not just good practice — it is a legal obligation. And it has a direct financial benefit: fines for data breaches are often calculated based on the number of individual records exposed. A club that has diligently archived and deleted old member data will face a significantly smaller potential fine than one that has been hoarding records for a decade because it never got around to cleaning them up.

The recommended practice is to delete sensitive health data after 30 days post-event or post-activity, retaining only the waiver form for insurance purposes. This dramatically reduces your exposure in the event of a breach.

How Cyber Insurance Addresses Health Data Risk

Because health information is classified as sensitive, a breach involving health data is treated as inherently more serious by the OAIC. The likelihood of serious harm to members is higher, which means notification obligations are triggered more readily, and the potential for member lawsuits under the Statutory Tort for Serious Invasion of Privacy is elevated.

A standalone cyber liability policy provides the financial coverage to handle these more serious consequences: the higher notification costs, the regulatory defence against OAIC investigation, the legal costs of defending Statutory Tort claims, and the forensic investigation required to understand the breach in full.

Take Action Today

Your gym, studio, or dojo holds health information. That is simply a fact of running a fitness or wellness business in Australia. What matters is whether you are handling it appropriately.

We specialise in helping fitness businesses understand and manage this risk — both through the right insurance coverage and through practical guidance on compliance steps. Book a conversation with us today to find out exactly where your business stands.