What Was Adopted and When

On 11 February 2025, the European Union formally adopted the European Health Data Space (EHDS) Regulation. It was published in the Official Journal on 5 March 2025 and entered into force 20 days later. The regulation is not fitness-specific, but its scope is broad enough to pull certain gym operators, digital coaching platforms and wellness-app developers into a new compliance framework — depending on how they collect, process or share data.

Most operational obligations are phased. The general application date is 26 March 2027, with provisions governing primary use of health data and electronic health-record systems taking effect from 26 March 2029 for the first priority data categories.

What the Regulation Actually Does

The EHDS establishes an EU-wide framework giving individuals greater control over their personal electronic health data. It creates technical and governance requirements for electronic health-record systems and sets out responsibilities for organisations classified as 'health-data holders' — entities that hold personal electronic health data and operate within health or care sectors, or that develop products and services for those sectors.

Critically, the regulation reinforces GDPR principles rather than replacing them. Organisations that qualify as health-data holders are treated as data controllers for that data, with obligations around data minimisation, purpose limitation and related requirements applying in full.

Where Fitness Businesses May Fall Within Scope

The European Commission's own guidance draws a specific distinction around fitness-tracker data that training schools, facilities and digital service providers should note carefully. Data from a wearable device may fall within the EHDS framework when it is shared with a healthcare provider or an app developer. Data that remains locally on a user's device, without access by the developer or a healthcare provider, is treated differently and is less likely to trigger EHDS obligations.

For day-to-day personal training practice — recording attendance, general workout preferences, or basic performance notes — the threshold is unlikely to be crossed. A trainer logging session data in a standard client-management system is not automatically a health-data holder under this regulation.

The compliance risk rises significantly where a business:

• Develops or operates a digital health or wellness app that receives wearable-derived physiological data

• Integrates client data with healthcare providers or clinical systems

• Supplies products or services specifically positioned within health or care sectors

• Receives biometric or health-status data from third-party devices and stores or processes it server-side

Why This Matters Now for Training Schools and Employers

The 2027 general application date may appear distant, but governance frameworks, data architecture decisions and product classifications made today will determine whether a business is inside or outside the regulation's scope when that date arrives. Fitness businesses expanding into health-tech, digital coaching or remote monitoring services should not defer this assessment.

For training schools designing curriculum around health technology, biometric coaching, or data-driven programming, the EHDS introduces a regulatory context that is likely to become part of professional competency requirements over time. Graduates entering roles in health-adjacent digital services will need baseline awareness of health-data governance, not merely GDPR in its general form.

Employers in the fitness sector operating any form of health-oriented digital service should begin a preliminary scoping exercise: does the service receive, store or transmit data that could be classified as electronic health data? If so, does the organisation operate within or supply to health or care sectors? The answers to those two questions determine whether EHDS obligations apply at all.

Immediate Steps Worth Taking

Given the phased timeline, no operational obligations apply yet. However, several preparatory actions are reasonable now:

• Map data flows across all digital services to identify where health-adjacent data is received, stored or transmitted

• Review product positioning — services marketed explicitly as health tools are more likely to attract regulatory classification as health-data holders

• Monitor Commission guidance, which continues to develop; the FAQ documentation published through the Commission's health directorate is the most reliable current reference

• Consult legal counsel with EU data-law expertise before building or scaling any service that integrates wearable or biometric data with third-party platforms

The EHDS does not immediately disrupt standard fitness business operations. Its significance lies in the compliance infrastructure it will require from businesses that are — or are moving — into health-data services. That distinction is worth establishing now, well before 2027.