Gym Data Security for Martial Arts Schools: A Privacy Checklist for Student and Parent Data Before You Sign

Gym data security starts before you sign a software contract, because the vendor you pick will hold every student’s name, birthday, parent contact details, signed waivers and payment information for as long as you stay.

A gym management program runs your school day to day, and it also becomes the place where your families’ information lives. The best time to ask how that information is handled is before the contract is signed, while you can still compare answers and walk away.

This is general information, not legal advice. Talk to a lawyer about your school’s situation.

Why Student and Parent Data Needs Extra Care

Many martial arts students are children, so the school ends up holding more than one person’s details for each student. A typical student record includes:

• the student’s name, birthday and belt history

• parent names, phone numbers and emails, often linked in a family account

• card details for family billing

• signed waivers and consent forms

• photos and videos from classes, gradings and events

• text messages between the school and parents

That’s why having a proper membership database matters. Everything in that list belongs to families who trusted the school with it, so you should know where it is kept, who can see it and how you would get it back.

How the system stores data is also part of that picture. It helps to understand cloud-based vs on-premise dojo management software before you commit. If you might move platforms one day, read up on changing your school’s software so you know what a smooth exit needs.

FERPA and COPPA in Plain Words

Two federal laws come up most often in conversations about student data. Here’s what each one covers.

FERPA

According to the U.S. Department of Education, the Family Educational Rights and Privacy Act (FERPA) applies to schools and education agencies that receive funds from U.S. Department of Education programs. Most private martial arts schools do not receive those funds, so FERPA generally will not apply.

COPPA

According to the FTC, the Children’s Online Privacy Protection Act (COPPA) applies to operators of commercial websites and online services that are directed to children under 13, or that know they are collecting personal information from children under 13. The FTC amended the COPPA Rule in 2025. Before you put together any COPPA compliance checklist for your school’s website, app or sign-up forms, start with the FTC’s own guidance.

State laws

State privacy laws differ, so the rules where you operate may add their own requirements.

This is general information, not legal advice. Talk to a lawyer about your school’s situation.

The Vendor Checklist: Questions to Ask Before You Sign

Bring these questions to every demo and sales call, and to every contract review. Use them alongside a martial arts school software features checklist, so that features and data handling get checked together.

Who can see the data

• Who at your company can see our student and parent records?

• Why would they need to, and is that access logged?

Card payments

• How are card payments handled?

• Do you process payments yourselves, or does a third party handle them?

Getting your data out

• Can we export all our data in a usable format?

• What does an export cost, and how long does it take?

• Does the export include student profiles, family accounts, billing history, attendance, rank and signed waivers?

When you cancel

• What happens to our data after we cancel?

• How long do you keep it, and how is it removed?

If something goes wrong

• How will you tell us about a breach, and how quickly?

• Is that written into the contract?

Subprocessors

• Which other companies handle our data, such as SMS providers and payment providers?

• Will you tell us if that list changes?

The contract itself

• How long is the contract?

• Does it renew automatically, and how much notice do we need to give?

• Is our right to get our data back written into the contract?

Tip: Ask for every answer in writing. That way you can compare vendors on the same terms and refer back to the answers after you sign.

Your School’s Own House Rules

Asking the vendor questions is half the job. The other half is how your team handles data day to day.

• One login per staff member. Shared logins make it impossible to know who changed what. Give everyone their own login and remove it when they leave.

• Billing is for the people who handle billing. Decide which staff need to see card and payment details, usually the owner and whoever runs payments, and keep it to them.

• Watch the front-desk screen. Position screens so parents waiting at the desk can’t read other families’ details, and lock the screen when the desk is empty.

• Paper forms go somewhere locked. If you still take paper sign-ups or waivers, store them securely and decide how long you keep them.

• Store waivers with the student. Keep each signed waiver attached to the right student’s record. If you’re moving off paper, see how to make an electronic waiver, and check that your liability waiver for gym use covers what you need it to.

• Ask before you post. Get each parent’s consent for photos and video before using them, and record it so any instructor can check.

• Record SMS opt-ins and opt-outs. Note which parents have agreed to receive texts, and act straight away when someone opts out.

How Spark Membership Approaches This

In Spark Membership’s martial arts software, billing, attendance, rank, signed waivers and every message sent sit on the same student record. Schools get student profiles and family accounts, with each student’s full belt history.

Spark processes payments in-house through Spark Payments. Spark Membership says its payment processing is “built on industry-standard security protocols.”

Spark offers free student data migration for schools switching platforms. The school exports its data and sends it to the Spark data team, and a dedicated account rep configures billing, attendance and automations.

Parents can text the school, and the team sees every reply.

Bring this checklist to your Spark Membership demo and ask every question on it. Book a demo

Make These Questions Part of Every Demo

Gym data security comes down to three things: knowing what data you’re handing over, knowing how the vendor handles it, and knowing how you’d get it back. The checklist above works for any vendor, Spark’s included. Take it to every demo, get the answers in writing, and set your house rules before your first student is entered into the new system.

Frequently Asked Questions

What is the difference between FERPA and COPPA?

FERPA vs COPPA comes down to what each law is about. FERPA is a federal law about the privacy of student education records held by schools. COPPA is a federal law about collecting personal information from children online. One is about school records, and the other is about websites, apps and online services used by children. If you’re unsure how either one relates to your school, the official guidance from the U.S. Department of Education (FERPA) and the FTC (COPPA) is the place to start.

Does FERPA apply to a private martial arts school?

FERPA is aimed at schools and education agencies that receive federal education funding. Most private martial arts schools don’t, so FERPA generally won’t apply. This is general information, not legal advice. Talk to a lawyer about your school’s situation.

Does COPPA apply to my martial arts school’s website or app?

That depends on how your website or app works and who it’s for, so it’s a question for a lawyer. COPPA is concerned with online services aimed at children under 13 and with collecting their personal information. State privacy laws also differ, so the rules where you operate may add their own requirements. This is general information, not legal advice. Talk to a lawyer about your school’s situation.

What is the difference between data protection and data security?

Data protection covers the rules for personal information: what you collect, why you collect it, who it’s shared with, how long you keep it, and what families can ask you to do with it. Data security covers the safeguards that keep that information from being lost, stolen or seen by the wrong people, such as logins, access settings and how records are stored. A school needs both. Clear rules about data are only useful if the records are actually kept secure, and good security only helps if you know what data you hold and why.

What should I ask a martial arts software vendor about student and parent data before signing a contract?

Treat these questions as a data privacy checklist and bring them to every demo:

• Who at the vendor can see your student and parent records?

• How are card payments handled?

• Can you export all your data in a usable format? What does an export cost, and how long does it take?

• What happens to your data when you cancel?

• How and when will the vendor tell you about a breach?

• Which subprocessors handle your data, such as SMS and payment providers?

• How long is the contract, does it renew automatically, and is your right to get your data back written into it?

Ask for the answers in writing, so you can compare vendors on the same terms.

How do I get my student data back if I switch software?

Plan for this before you sign. Ask the vendor how you export your data, which file format you get, whether there’s a fee, and how quickly the export is delivered. Check the contract for what happens to your data after you cancel, and make sure your right to get it back is written down. Before you give notice, run a full export and check that it includes student profiles, family accounts, billing history, attendance, rank and signed waivers.

How should a martial arts school store signed waivers and parent consent?

Keep every signed waiver and consent form in one place, attached to the right student’s record, and limit who can open them. If you still collect paper forms, store them somewhere locked and decide how long you keep them. Collect separate, clear consent for photos and video and for SMS messages, and record each parent’s opt-in or opt-out so staff can check it before posting a photo or sending a text. Protecting student data includes knowing exactly what each family agreed to.

Who at my school should be able to see student billing details?

Only the staff who need billing details to do their job, such as the owner and whoever handles payments. Give each staff member their own login rather than a shared one, so you can control what each person sees and know who accessed what. Keep billing screens out of view at the front desk, and review access whenever someone’s role changes or they leave.