Template. Your gym must review and adapt it before adopting it. Last updated: 31 October 2026.

Orlo provides this template to help the gyms that use it meet Article 35 of the GDPR, as part of the assistance we owe as processor (Article 28 GDPR and Schedule 1, paragraph 2.6, of our terms). It is not legal advice. Your gym is the controller, and the assessment is its own: review every section, fill in what is in square brackets, delete what doesn’t apply and keep it signed with your records. If you have a data protection officer, ask for their opinion.

This assessment covers only the Claude and ChatGPT connector (Settings → Integrations). It does not cover the assistant built into Orlo, which works differently.

1. Description of the processing

• Controller: [gym name], [tax id], [address], [contact email].
• Processor: Orlo Ltd, 124 City Road, London EC1V 2NX, United Kingdom, under the Data Processing Terms in Schedule 1 of its terms.
• What happens: people on the gym’s team use an AI assistant (Claude, by Anthropic, or ChatGPT, by OpenAI) connected to the gym’s management system through Orlo’s connector. They ask it about classes, bookings, members, payments and the website, and ask it to make changes, such as changing a class’s trainer or building a page.
• How it works: each person connects their own assistant account with their own Orlo login. When the assistant needs information to answer, it asks Orlo, and Orlo returns only what that person can see in their dashboard. Orlo does not see the conversation.
• Who uses it: [roles or names of the team members with the “Use Claude and ChatGPT” permission].
• Assistant plan: [Claude Team / Enterprise / API or ChatGPT Team / Enterprise / API], with the provider’s data processing agreement (DPA) accepted on [date].
• Data subjects: the gym’s members, clients and prospective clients.
• Planned start date: [date].

2. Necessity and proportionality

• Purpose: to help the team run classes, bookings and member support with less admin. [Describe what you use it for.]
• Lawful basis: the same basis each piece of data already has in Orlo: performance of the contract with the member (Article 6(1)(b) GDPR) to manage their bookings and membership, and the gym’s legitimate interest (Article 6(1)(f)) in organising its work efficiently. [Record the legitimate interests balancing test.] The connector is not used to process special category data, which is excluded (section 3).
• Minimisation: the assistant only receives what it asks for to answer a question, and never more than the person asking can see in the dashboard. Contact details and health data are never sent.
• Alternatives: the team can do all of the same things from the Orlo dashboard. The connector is optional: the owner decides to switch it on, and each person needs a permission that is off by default.
• Telling members: the gym adds the paragraph Orlo provides (Settings → Integrations) to its privacy notice. If the gym’s website is on Orlo, its privacy policy already includes it.

3. Data processed and data excluded

May be sent to the assistant, when it asks for it to answer:

• the member’s name and Orlo identifier;
• bookings, attendance and no-shows;
• membership type, pack and payment status;
• workouts, exercises and weight logs;
• goals and training notes, except those marked as sensitive;
• answers to the gym’s surveys;
• photos from the media library of the gym’s website, which may show members;
• aggregated business and website figures.

Never sent, and there is no setting that allows it:

• email address;
• phone number;
• health questionnaire (PAR-Q) and waiver answers;
• the “Injuries & health” category of member notes;
• notes and goals marked “Sensitive — keep out of AI tools”.

The team can look a member up by email or phone only with the full, exact value. The assistant never receives the email or phone in the answer, and those lookups are rate-limited and logged.

4. Recipients

• Orlo, as the gym’s processor, which hosts the data and passes it to the assistant.
• The assistant’s provider ([Anthropic / OpenAI]), which processes the data it receives as the gym’s processor under the data processing agreement that comes with its business plan. When switching the connector on, the gym commits to using it only with business plans that include that agreement. On a personal plan the provider would be a third party with no processing agreement, and that is not allowed.
• The provider does not use the data to train its models on these plans. [Check and record the clause in its agreement.]

5. International transfers

The providers process the data in the United States. The transfer relies on [the provider’s certification under the EU-US Data Privacy Framework / the European Commission’s standard contractual clauses included in its data processing agreement]. [Check at dataprivacyframework.gov that the provider is still certified and record the date.]

6. Risks and measures

For each risk, the likelihood and severity are Orlo’s estimate with the measures in place. Adjust them for your gym.

1. Data ends up in an account with no processing agreement (for example, a team member’s personal plan). Measures: the owner switches the connector on and accepts a commitment to use only business plans with a data processing agreement; Orlo records who accepted it, when and which version. Each person needs the “Use Claude and ChatGPT” permission, off by default for every role, admins included. [Your own measure: check which accounts the team uses.] Residual risk: medium. Orlo cannot tell which plan an account is on; this is a contractual commitment, not a technical control.

2. Health data in free text (an injury written into a training note). Measures: the “Injuries & health” category and the health questionnaire never leave; trainers mark notes and goals with medical information as sensitive, and those never leave; the notes editor reminds them. Residual risk: medium. It depends on the team marking notes. [Your own measure: train the team.]

3. A team member sees more than they need. Measures: the assistant has exactly the permissions that person has in the dashboard; the connector permission is given person by person; each person connects with their own account. Residual risk: low.

4. An unwanted change (the assistant misunderstands a request). Measures: changes that touch several things are shown first and only made when the person confirms; the assistant cannot refund, charge, change plans or delete anything; every change is recorded in the history with who asked for it and that it came from Claude or ChatGPT. Residual risk: low.

5. Working out a member’s email or phone through repeated searches. Measures: exact matches on the full value only; never returned; a limit on lookups per connection; logged. Residual risk: low.

6. Not being able to say who has seen a member’s data. Measures: Orlo records which members each request returned (identifiers only, never the data) and keeps it for 12 months. Residual risk: low.

7. Misuse of a stolen or abandoned connection. Measures: sign-in through OAuth; access expires after an hour; removing the permission, or switching the connector off, stops access at the next request; a limit on requests per connection. Residual risk: low. [Your own measure: remove the permission when someone leaves the team.]

8. Members don’t know it is used. Measures: the paragraph for the privacy notice (section 2). Residual risk: low, once published.

9. Inaccurate answers about a member. Measures: figures come from the same queries as the dashboard; the assistant makes no decisions of its own with effects on the member; the team member reviews what they do with the answer. Residual risk: low.

10. Transfer to the United States. Measures: section 5. Residual risk: low.

7. Retention

• Conversations: kept in the gym’s assistant account, not in Orlo. The gym sets how long in that account, under the data processing agreement that comes with its business plan. [Record the period you have set.]
• Record of which members each request returned: 12 months in Orlo, identifiers only.
• History of changes: the same period as the rest of Orlo’s history.
• What the assistant writes into Orlo (notes, changes to classes or members) becomes part of the member’s record and follows its normal lifecycle, erasure included.

8. Data subject rights

Members exercise their rights with the gym, at [contact email], as with the rest of their data. Orlo helps the gym respond.

• Access: the gym can ask Orlo which connector requests returned a member’s data in the last 12 months, and when. [If the member asks, also search the conversations in the assistant account.]
• Rectification and erasure: made in Orlo, and they apply to the connector too, because the assistant reads from Orlo on every request. Conversations already in the assistant account are deleted there by the gym.
• Objection: if a member objects, [describe how you handle it: for example, the team does not ask the assistant about that member and marks their notes as sensitive].
• Restriction and portability: as for the rest of the data in Orlo.
• Complaints: to the Spanish Data Protection Agency (www.aepd.es).

9. Conclusion and approval

With the measures described, [the gym] considers the residual risk [acceptable / not acceptable] and that prior consultation with the AEPD (Article 36 GDPR) is [not] needed.

• Approved by: [name and role], on [date].
• Data protection officer’s opinion: [if there is one].
• Next review: [date, within a year at most, or sooner if the connector, the provider or its plan changes].