Short answer
Cookie banners, booking data and health information — what an Irish gym, studio or clinic actually has to get right.
Health data raises the bar
Injury notes, PAR-Q answers, pregnancy declarations and medical screening are special category data under GDPR. If your booking or intake forms collect any of it, you need explicit consent, a clear reason for holding it, and a retention period after which it is deleted. This is stricter than the rules that apply to a plain contact form.
This is general guidance, not legal advice — check with a solicitor or the Data Protection Commission if you handle clinical information.
Cookie banners that are actually compliant
Under Irish ePrivacy rules, non-essential cookies — including Google Analytics and Meta Pixel — must not load until the visitor consents, reject must be as easy as accept, and pre-ticked boxes are not consent. Many Irish wellness sites fire tracking on page load and only then show the banner, which fails on all three counts.
The simplest fix is to use privacy-first analytics that set no cookies at all, which removes the banner requirement for most sites entirely.
The pages you need
A privacy policy naming your business as data controller with an Irish contact point, a cookie policy if you use non-essential cookies, and terms covering memberships, cancellations and refunds. Link all three in the footer of every page.
Where the data lives
Know which processors hold your member data and where. Keep a short list — booking system, payment provider, email tool, analytics — and make sure each has a data processing agreement in place. If a member asks for their data or asks to be deleted, you have one month to act.
Want this handled for you?
Kryson builds websites, booking systems and member portals for Irish wellness businesses. One-time pricing from €497.