For: operators, dealer implementation teams and IT or privacy leads
The decision: Which data is needed, who can use it, and what happens when the service ends?
60-second answer: Map each dataset to a legitimate operating purpose, accountable owner and vendor terms before enabling unnecessary collection. Access, retention, export and deletion must be resolved explicitly; the presence of a dashboard does not settle those rights.
Inventory the data, not just the screens
Pull the equipment and console list, vendor contracts, account roles, network requirements, available exports and privacy information. Identify whether each dataset concerns an asset, an identifiable person or both. Session counts used for capacity planning may require less detail than the platform is capable of collecting.
NIST’s IoT cybersecurity work provides a security framework context, not a determination of who legally owns gym data. Rights and responsibilities depend on the relevant contracts and law. FEX recommends assigning internal accountability without mistaking that operational role for ownership of all information.
| Dataset or function | Decision it supports | Responsibility to document |
|---|---|---|
| Fault and service records | Maintenance and escalation | Alert recipient, access and case closure |
| Use and session counts | Capacity and equipment planning | Definition, data quality and aggregation |
| User accounts or personal records | Specific enabled user service | Permitted purpose, notice and applicable privacy requirements |
| Administrative access | Configuration and support | Named administrators, authorization and access removal |
| Exports and deletion | Continuity, migration and record obligations | Format, timing, retention basis and vendor assistance |
Resolve the costs of keeping it running
Record subscription fees, staff time, integration work and the cost of recovering access when an employee leaves. Test an authorized export before relying on it for a business process. Ask what happens to historical records, remote diagnostics and equipment functions if the subscription expires or the platform closes.
Agree which alerts require action, who receives them and how acknowledgment is recorded. A dashboard that sends every notification to an unattended mailbox adds little value. Safety-related reports should enter the established safety process rather than remain inside a vendor analytics queue.
Questions for the vendor and internal owner
- What information is collected, and which collection can be disabled?
- Who may access it, including service partners and subprocessors?
- Can the organization export usable records without continued subscription?
- What retention or deletion options exist, and what obligations affect them?
- How are departing staff, transferred machines and closed sites removed from access?
Avoid choosing a universal retention period or assigning every privacy decision to the membership team. The appropriate owner may involve operations, IT, legal or a contracted specialist. Record the decision and basis for each dataset; keep information only as needed for its approved purpose and applicable obligations.
Separate anonymous operating summaries from person-level information where the task permits. The business case for a connected function should identify the decision it improves and the labor it saves or creates. Disable unused features only after understanding their operational dependencies.
Before the next connected-equipment rollout
- Complete the register for one console platform.
- Resolve access, export and retention questions with the appropriate internal and vendor contacts.
- Test alert routing and the process for removing access when an asset or employee leaves.
Continue with FEX
FEX editorial guidance: the decision tools and operating recommendations in this guide are FEX analysis. They are not manufacturer specifications, contractual entitlements or industry benchmarks.
Source notes
- NIST Cybersecurity for IoT Program — Security context; it does not establish commercial data ownership or replace applicable privacy requirements.
Editorial update, October 7, 2026: Clarified that an internal data owner is an accountability role, not an automatic legal ownership claim, and removed unsupported universal role and retention assignments.
