FW-POL-001: Fitness data protection and consent

Policy · FW-POL-001 · Version 1.0 · Approved by the ASF Expert Committee

Supports: 30.1

At a glance

Health-tracking data is collected only with the member’s informed consent and only for its stated purpose (FW-FRM-001).
Data is secured under the information security policy (DIG-POL-001).
Data is not shared with a third party without the member’s consent.
A breach is reported under the breach procedure (DIG-SOP-001).
Stop and get help straight away if: member health data is shared with a third party without consent.

1. Purpose

To make sure biometric and health-tracking data is protected and used only as the member agreed (30.1).

2. Scope

Applies to	Clinical and support staff in the hospital
Locations	All wards, clinics and departments of the facility
When	Whenever the activity described is carried out
Does not apply to	Activities covered by another document listed in section 15

3. Definitions

Term	Meaning
Clinical lead	The doctor or nurse in charge of the area at the time

4. Background

Heart rate, body composition and other data from fitness trackers are personal health information. They must be protected and used only for the purpose the member agreed to.

5. Responsibilities

Role	Responsibility	Competence
Fitness service lead	Owns the data rule	Clinician or manager
Instructor and front desk	Collect data only with consent	Staff

6. Materials and equipment

Item	Requirement	Condition
Records and forms named in this document	Current version	Checked before use

7. Safety

Stop and call for help if a patient is at immediate risk. Do not delay urgent care to complete paperwork.

8. Before you start

Confirm the forms and equipment named in this document are available and current.

9. Procedure

Step 1. Consent.

Record the member’s consent for each data use on FW-FRM-001 before collection.

Key point: Consented.

Step 2. Secure.

Store the data under the information security policy.

Key point: Secured.

Step 3. Limit use.

Use the data only for its stated purpose, and report any breach.

Key point: Limited.

10. Decision points

No decision points in this procedure.

11. Special situations

Situation	Action
Out of hours	Follow the same steps. Use the on-call contact on the wall of the area.

12. Escalation

Any serious problem goes to the duty clinical lead at once and to the clinical director the same day.

13. Monitoring

Measure	Target	Frequency	Owner	If not met
Members with data consent recorded before collection	100%	Quarterly	Fitness service lead	Escalate to medical director

14. Records

Record	Kept in	Retention
Record named in this document	Patient record or the area file	the period set by the facility’s records policy years

15. Training

Staff are trained in this document at induction and refreshed each year, with a recorded competency check.

16. Related documents

ID	Title	Use
FW-FRM-001	Health-tracking data consent record	Record
DIG-POL-001	Information security and access control (existing, reused)	Policy

17. Evidence

Reference	Note
E-009	Based on the WHO guidance on digital health and data protection, the American College of Sports Medicine Guidelines for Exercise Testing and Prescription (11th ed., 2021), and the American Heart Association guidelines for cardiopulmonary resuscitation and emergency cardiovascular care (2020).
E-006	ASF Policy Framework v1.2. Adapted.
E-009	ASF Expert Committee consensus.

18. Change history

Version	Date	What changed	Approval
1.0	the date of approval	First version	set Expert Committee approval

E-learning for this document

Digital Care and AI Systems for Care (FIT-12)

References

Accréditation Sans Frontières (2026). ASF Policy Framework v1.2. (E-006)
Accréditation Sans Frontières (2026). ASF Expert Committee consensus on Standard 1. (E-009)

Download this document as PDF