Your wellness business does not just manage appointments. It stores health, body and image data every day.

Yes. Gyms, salons, spas and wellness studios collect personal data that can reveal health, body, appearance and lifestyle — membership details, fitness goals, body measurements, health declarations, consultation notes and customer photos — which makes them Data Fiduciaries under the Digital Personal Data Protection Act, 2023. Obligations apply regardless of size, even though you are not a medical provider.

Yes. Customer photos, before-after images, bridal photos and testimonials are personal data, and using them for social media or ads needs separate, documented consent plus a way for the customer to ask for removal. Posting transformation results without specific consent is one of the most common DPDPA exposures in this sector.

Yes. Weight, BMI, body measurements, injuries, allergies, skin/hair concerns and therapy notes are health and body data — high-impact even without a medical diagnosis. Limit who can access it, avoid keeping it in WhatsApp or staff notes without controls, and don't use it for promotion without clear consent.

Staff using personal phones or personal WhatsApp to message customers, store photos or keep notes puts customer data outside any access control — a major risk, especially with shared logins or ex-staff access. Move customer communication to business channels and role-based, reviewed access, and remove ex-staff and old vendor access promptly.

The DPDPA expects data to be kept only as long as the purpose requires. Wellness businesses often keep old customer records, photos and consultation notes indefinitely for repeat bookings or marketing — that's the main exposure. Define a retention period, archive or delete past it, and offer customers a way to request removal of their photos and records.