Your member list is one of the most valuable things your business has. It holds who trains, what they pay, what they've done and how to reach them. When an app platform stores it for you, ownership comes down to what you're able to do with that data in practice, whatever the sales deck says.
These are the questions we'd ask in your position, and the answers worth getting in writing.
Can we export all of it, whenever we want?
A useful export covers each member's profile, their visits and workouts, their payments and plan history, and the messages you've sent them. Ask:
- Can we download a full copy at any time, or only on request?
- Is it in a format our team can open, like spreadsheets, or load into our own systems?
- Can it be copied to our own cloud storage automatically, on a schedule we set?
- Is there a fee for exports, or a limit on how often we can run them?
Tip
Ask for a sample export during the sales process. A real file answers these questions faster than a feature list.
Whose name is the data stored under?
The contract should say plainly that member data belongs to your business and is stored on your behalf. Then ask what the platform itself may do with it: whether it is combined with other clients' data, used to train models, or shared with partners. Each of those can be fine with the right limits, but you should know which ones apply.
Ask about AI separately, since more platforms now run it on member data. Get it in writing whether your members' activity is used to train AI that other businesses use. For Cortex, the AI in our console, your members' data is used for your app only. It is never used to train AI for another business, and it is never sold. The other rules Cortex works inside are under "How Cortex decides" on our security page.
What happens if we leave?
Few people ask this before signing, and it matters most. Get answers to:
- How much notice is needed, and do we get a full export at the end?
- How long is our data kept after we leave, and will you confirm in writing when it is deleted?
- Which developer accounts are the apps published under? App store subscriptions are tied to the account an app is published with, which affects whether paying members can follow you to a new app.
- What happens to the app store listings, the reviews and the download history?
A platform that expects to keep your business on merit will answer these quickly.
How is health data handled?
Fitness apps increasingly collect health information: weight, heart rate, sleep, medication, injuries. If your business works with doctors or other providers, or offers care through the app, HIPAA can apply, and the platform holding that data will need to sign a Business Associate Agreement with you.
Whether or not HIPAA applies, ask how health data is protected:
- Is data encrypted when it's stored and when it's sent?
- Who on the platform's side can see member records, and is each view logged by name?
- Are the security documents your lawyers will ask for ready before launch?
You can read how we answer these on our security page.
Can we handle members' own requests?
Privacy laws such as California's CCPA and Europe's GDPR give members the right to see the data you hold about them and to have it deleted. Requests come to you, the business, so ask whether the platform can export or delete a single member's data when you need it, and how quickly.
Is one member counted once?
A member who trains on a phone, a watch and a TV should appear as one person with one history. If each device creates its own record, your member counts are inflated, your retention numbers are wrong, and the same person gets three copies of every message. Ask how members are matched across devices, and whether you can see how each match was made.
A checklist to bring to the call
- Show us a sample export, and tell us what it includes.
- Confirm in the contract that the member data is ours.
- Tell us what you may do with our data, and what you won't.
- If you run AI on our members' data, confirm in writing that it isn't used to train AI for other businesses.
- Walk us through leaving: notice, final export, deletion and the app store accounts.
- If we handle health data, will you sign a Business Associate Agreement?
- Show us how a single member's data is exported or deleted on request.
- Explain how a member using several devices is counted.
At Click Digital, Helix stores member profiles, visits and payments under your company's name, handles health data to HIPAA standards, and lets you download a full copy whenever you want.
Common questions
- Does a HIPAA-ready platform make our business HIPAA compliant?
- No. A platform can handle the data it holds to HIPAA standards and sign a Business Associate Agreement, but compliance also depends on your own policies, staff training and how your team handles member information.
- Do we need a Business Associate Agreement for a fitness app?
- Only if HIPAA applies to you, which usually means you are a healthcare provider or work with one and the app handles their patients' health information. A general fitness app usually isn't covered, but adding provider visits or prescriptions can change that.
- Can we get our data back if we cancel?
- You should be able to, as a full export in a format you can use. Ask for the exit terms in writing before you sign, including how long the data is kept afterwards.
- Is member data the same as owning the app?
- No. The data is the member records; the app is the software and its store listings. Ask about each separately, because contracts often treat them differently.
Written by
The Click Digital team, which has designed, built and run fitness and health apps since 2012.