The test is relevance, not name-matching
A Subject Access Request covers personal information relating to the individual. It is not a request for every record their name happens to appear in. The SAR Prep Assistant gathers records that relate to the member; you then review each one and decide what is genuinely their personal data and what should be withheld.
Categories Bliply gathers
- Personal & contact details — profile, contact information, emergency contact, linked family profiles.
- Membership & subscription history — plans, changes, holds and cancellations.
- Payments, invoices & transactions — invoices, adjustments, discounts used, payment disputes.
- Bookings & attendance — class bookings, waitlists, check-ins, no-shows and historical attendance.
- Communications — emails and messages sent to the member, chat conversations, in-app notifications.
- Waivers, agreements & contracts — signed documents, with the original files attached.
- Performance & health information — personal records, workout results, injuries logged, nutrition summaries, badges, engagement scores.
- Staff notes, complaints & incidents — tasks and notes recorded against the member.
- Marketing & communication preferences — consent and notification settings.
- Account & activity history — account actions recorded in the activity log.
- Uploaded media & files — profile photo and progress media.
The SAR response information sheet
Every pack includes a sheet covering the contextual information a SAR response normally needs: purposes of processing, categories of personal data, recipients, retention, the source of the data, and automated decision-making. Bliply pre-fills what it can determine from its own processing. Anything marked [FOR THE GYM TO COMPLETE] must be completed by you — for example your own retention periods and any recipients outside Bliply. Bliply will not invent this information.
What Bliply cannot see
Bliply only holds what is in Bliply. You must check elsewhere for:
- Emails in your own inbox or sent from a personal or business email account outside Bliply.
- WhatsApp, SMS or social media messages on staff phones or accounts.
- CCTV footage, door-entry logs and other on-site systems.
- Paper records, printed forms and handwritten notes.
- Records held by third parties on your behalf — payment providers, accountants, insurers, debt recovery.
- Wearable or third-party training apps the member connected themselves.
Third-party information
Where a record may contain information about someone else — a group chat, a family member's booking, a dispute involving another person, a staff note naming a colleague — Bliply flags it for manual review. Do not disclose another person's personal data without considering whether it is reasonable to do so; redact or exclude where it is not.
Exemptions
Some information can be withheld — for example confidential references, legally privileged material, or information that would prejudice an ongoing investigation. Bliply does not apply exemptions for you. Use Exclude with a reason so your decision is recorded.