Are gyms allowed to track your body metrics under India's data law?

At a glance

Yes — a gym can record your weight, body-fat, and measurements if you agree, but under India’s DPDP Act that’s your personal data. So the gym needs a clear notice and your consent, can use the data only for the fitness purpose you agreed to, and can’t sell it or push it into other apps without asking again. You can withdraw consent and ask for it to be deleted at any time.

Educational resource only. This explains how gyms’ handling of body-metric data is treated under India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.

The situation

Your gym runs a body-composition scan at sign-up — weight, fat percentage, measurements — and logs it in an app, along with your progress over months. It’s useful for training. But it’s also an intimate record of your body sitting on someone else’s server, and you’re within your rights to ask what happens to it.

Is body-metric data covered by the DPDP Act?

Yes — data about your body identifies you, so it’s personal data, and the gym holding it is a Data Fiduciary. There’s a myth to clear here too: because this feels like “health data,” people assume the law slots it into a special high-protection box. The DPDP Act doesn’t have a separate “sensitive data” category — your body metrics are treated as ordinary personal data.

That isn’t a downgrade of your protection; it’s just where the protection actually comes from. The real safeguard for this kind of data isn’t a special label — it’s purpose limitation: the gym can only use what you gave it for the fitness purpose you agreed to, and nothing else. That single rule does most of the work here.

What the gym can and can’t do with it

It can use your metrics to train and track you; it can’t quietly reuse, sell, or hoard them. With your consent and a clear notice (Section 5), a gym can record and use body metrics to plan your workouts and show progress. What the DPDP Act stops it from doing:

• Repurposing it. Using your body data to target you with supplement ads, or feeding it to a partner brand, is a new purpose that needs fresh consent.
• Selling or sharing it with third parties without asking you.
• Keeping it forever. Once you’ve left the gym and the purpose is over, it shouldn’t sit on their system indefinitely.
• What it should do: keep the data secure, use it only for your training, and delete it when the purpose ends.

Can they share it with apps or personal trainers?

Only within the purpose you agreed to — a third-party app or an outside trainer is a line that needs care. If the gym uses an app to store your metrics, that app is acting as its data processor and must handle your data on the gym’s instructions, for your training only — not for its own uses. If the gym wants to hand your data to a separate business (a nutrition brand, an analytics partner, a trainer who isn’t part of the gym), that’s a fresh purpose that needs your specific consent. “We share with partners” tucked into the membership form isn’t the free, specific consent the law expects.

What you can do about it

Ask what’s collected and why, keep your consent narrow, and pull it back when you’re done.

1. Ask for the notice. What metrics, stored where, for how long, and who else sees them.
2. Consent narrowly. Agree to the training use; decline the marketing or “partner sharing” checkboxes — they should be separate, and optional.
3. Withdraw when you want. You can take back consent at any time, and it must be as easy to withdraw as it was to give.
4. Ask for deletion. When you leave, request erasure of your body-metric records and written confirmation (the right to erasure lets you do this once the purpose is over).
5. Escalate if ignored. If the gym won’t explain, keeps repurposing your data, or refuses to delete it, raise a grievance with the gym, then the Data Protection Board of India.

FAQ