Last updated: 2026-08-19
Plain-language guidance, not legal advice. It assumes your clients are in the EU/UK (GDPR); if they are elsewhere, check that place's rules too. When in doubt on a high-stakes point, ask a lawyer.
The moment this information is tied to a named client and tracked over time, it counts as special-category data under GDPR Article 9, the strictest tier. Treat your whole tracker and every chat as health data; don't try to carve out "safe" fields.
For health data you need a specific, separate, opt-in consent that names the data (weight, food, mood, sleep…), the purpose, that an AI processes it, and how to withdraw. The platform shows your Members this step automatically before they start. If you collect data outside the platform, on a form, an intake call or in DMs, you must obtain the same consent there. There is a copy-paste block at the end.
Notion offers a GDPR data-processing agreement (on its business/enterprise plans) with Standard Contractual Clauses, so the tool itself is workable. But the tool is not the problem. The consent is. A Notion intake form needs its own consent block at the point of collection, not a link to a privacy policy. (Notion's HIPAA/BAA option is US healthcare law and irrelevant to GDPR; don't rely on it.)
Your clients are consumers. You cannot cap or exclude liability for injury, death, fraud, or gross negligence. Those clauses are simply void in the EU, however you word them. Don't copy a software company's broad liability cap or indemnity into your coaching terms; it won't hold. Keep a clear injury/medical disclaimer and tell clients to see a doctor where relevant. That is legitimate. Excluding injury liability entirely is not.
If a client copies or resells your programme, it is a breach of your Member terms (you can cut their access immediately) and, because your material is your copyright automatically, you can act on that too. The contract route is faster; the copyright route is stronger against re-sharing once it has left the platform.
Put this in the privacy notice you give your clients: "Our coaching software provider may access my data, and sign in to my account, only to fix problems, and this is logged."
"I agree that [your name] may collect and store my health and lifestyle information (which may include weight, food, sleep, mood, injuries and training) to coach me, and understand it may be processed by an AI assistant to generate coaching responses. I can withdraw this at any time by contacting [your email], and can ask to see, correct, or delete my data."