KVKK and your gym: keeping member data in order

A gym holds unusually sensitive data. Beyond phone numbers and birth dates there's the health questionnaire (PAR-Q), body measurements, and a log of exactly when each person walked through the door. Turkey's data protection law, KVKK, treats some of this as special category data, and the KVKK Board has fined gyms before. Here's where a gym owner stands and how to keep member data in order.

Who is the data controller

The controller decides why and how data is processed; the processor works on its behalf. The gym opens the member record, sells the membership and decides who gets through the door, so the gym is the controller of member data. If you use gym software, the software company is your processor for those records, and you need a data processing agreement with it.

In GamGym it's written down. For member records, memberships, sales and payments, entries, bookings, measurements and notes the gym enters, and signed documents, the controller is the business and GamGym is the processor. The person's GamGym account itself (identity and contact details, login, consents, programs they create) is GamGym's responsibility. The data processing agreement is versioned; when the owner accepts it, the version, the person, the time, the IP and a copy of the text are stored.

Health data: PAR-Q and measurements

PAR-Q answers are health data, special category under Article 6 of KVKK. They're collected to know whether starting exercise carries a risk, and shouldn't be used for anything else. Ask for that consent separately from the general notice and make it optional, limit who can see the answers, and let a lawyer set the retention period, because the rules don't give a number.

GamGym's default KVKK template asks for health data consent as a separate optional yes/no question. Staff permissions are set by role and branch, so the accountant and the front desk don't see the same screens.

QR instead of fingerprints

The KVKK Board has fined gyms for fingerprint and hand-scan entry (decisions 2019/81, 2019/165, 2020/167) and for collecting blood types (2022/1357).

GamGym doesn't use biometrics at the door. The member's QR code changes every 30 seconds, so a screenshot passed to a friend stops working. We explain the details in how QR entry works, with a short definition in the glossary.

How long to keep it

Some periods are set by law, others are recommendations:

Data	Period	Status
Ledger, payments, refunds, receipts, invoices	10 years from year end (Tax Procedure Law 253, Commercial Code 82)	Required
Memberships, sales, cancellation requests and decisions	At least 3 years for online sales; 10 years recommended	Required for online sales
Measurements and notes entered by the gym	Delete or anonymise after the last membership ends (e.g. 6 months) or on request	Recommended
Entry logs	2 years after the membership ends, then aggregate	Recommended

What another gym can see

In GamGym one phone number is one person. The same person can be a member at two gyms, but each business's records are separate. PostgreSQL row-level security enforces that in the database itself.

A front desk looking up an existing person's phone sees only a masked name. Sharing someone's measurement and program history with other gyms is off by default and needs that person's consent. Consents are stored with their versions; withdrawing one adds a new record.

Digital signatures instead of paper

Paper forms get lost and don't show which version was signed. In GamGym contracts, KVKK forms, PAR-Q and waivers are signed on a tablet or in the member portal. The system stores the signature image, the IP, the device and the exact text as signed. Change the text later and old signatures stay attached to the old text.

What reaches you when a member closes their account

A member can close their GamGym account from the member portal (My account › Close account). Before closing they see a summary for each gym: open memberships with the estimated refund, upcoming bookings, debt and pending refunds. The screen suggests "Download my data" first, then asks for explicit confirmation.

Once confirmed, three things reach your gym. First, a termination request for every open membership the person holds with you; it runs through the normal cancellation flow, with the same 7-day decision window and 15-day refund tracking. Second, a "member closed their account" notification to your member staff. Third, the person's first name, last name, phone and e-mail are copied onto your member record. That copy is yours, because you're the controller of the member record; it's there so the termination confirmation and any refund can reach the person. Deleting it later under your own retention rule is your job.

Debt doesn't block closing; it stays in your ledger. Upcoming bookings are cancelled without penalty, and your sales, payments, entry logs, bookings, measurements and assigned programs stay.

What the person created themselves is deleted straight away: their own programs and workout log, social posts, gym reviews, measurements they entered, profile photo and device records. Marketing and history-sharing consents are withdrawn. Their GamGym identity is anonymised after 30 days by default (180 at most); the copy on your record isn't touched. Each erasure and anonymisation step is written to a log kept for at least 3 years.

"Download my data" works without closing the account too. The JSON file is prepared in the background; the link is valid for 60 minutes, the file is kept for 7 days and it can be requested once every 24 hours. It includes a per-gym summary of memberships and payments, but a member who wants a full copy of your records still asks you.

The default KVKK template and the platform texts haven't been reviewed by a lawyer yet, so have your own lawyer look at the template before you use it.

Five things to do this week

1. Check that your privacy notice names your business as the controller.
2. Separate health data consent from the general notice.
3. Review, role by role, which screens your staff can see.
4. Collect and delete old member spreadsheets from office computers; our switching guide covers the order.
5. Make sure you have a signed data processing agreement with your software vendor.

See also membership cancellation and consumer rights, Why GamGym? and the for gyms page.

Number four is the quickest: deleting "members_final.xlsx" from the desktop takes about a minute.

This article is for information only and is not legal advice.