40 - REDs, period tracking, and privacy: Elle’s wake-up call

40 - REDs, period tracking, and privacy: Elle’s wake-up call

As a rising star at Paddington FC, Elle had always been thorough about her training, and her recovery. She logged her workouts, tracked her sleep, and, like all her teammates, inputted her menstrual cycle data into the club’s health monitoring app every morning. It was part of the club’s commitment to personalised training and injury prevention, especially after a series of ACL injuries last season.

But when Elle started feeling constantly fatigued, her performance levels started to dip and her periods became irregular, she knew something wasn’t right. After a consultation with the club’s medical team, she was diagnosed with Relative Energy Deficiency in Sport (REDs), a condition caused by insufficient energy intake to support the demands of training and normal bodily functions.

REDs and female athlete health

REDs is increasingly recognised in women’s sport, yet it remains underdiagnosed. It affects not just physical performance but also menstrual health, bone density, immunity, and mental wellbeing. For Elle, the diagnosis was a turning point, not just in terms of her attitude towards her training, but in relation to how she thought about her health as a whole.

The club’s use of FemTech tools, like period tracking apps and wellness dashboards, had helped flag the warning signs. But it also raised a new set of questions for Elle, about who sees her data, how it’s used, and what rights she has.

Data protection in women’s sport

Elle’s story highlights a growing tension in elite sport: the balance between performance optimisation and data privacy. When athletes are asked to input sensitive health data, such as menstrual cycles, mood, or sleep patterns, into club-managed apps, several legal and ethical issues arise:

1. Consent and transparency

  • Has Elle been fully informed about what data is being collected and why?

  • Has she freely given explicit, informed consent for the use of her health data?

  • Can she withdraw that consent at any time?

2. Data minimisation

  • Is the club collecting only the data that is strictly necessary?

  • Are there clear boundaries on what coaches, analysts, and third-party app providers can access?

3. Special category data protections

Under the UK GDPR, menstrual and health data is classified as special category data. This means:

  • It requires enhanced protection.

  • Clubs must have a clear lawful basis for processing it. We note that relying on consent as a lawful basis under data protection law is rarely appropriate in an employment setting as it is can be difficult to demonstrate consent to be ‘freely given’ in an employee/employer relationship. The Club must therefore ensure it is relying on an appropriate lawful basis when collecting such data.

  • Data must be stored securely.

4. Third-party app risks

  • If the Club uses an app that has been developed by an external provider, is Elle’s data being shared beyond the club?

  • Are there appropriate and robust data-sharing agreements in place?

  • Is the app compliant with UK data protection laws (ie UK GDPR, The Data Protection Act 2018 or The Data (Use and Access) Act 2025)?

What can Elle and her club do to protect themselves?

For Elle:

  • Ask for a copy of the club’s privacy notice and the app’s data policy (if a third party app provider is involved).

  • Understand her rights under UK data protection legislation, including access, correction, and erasure of her data.

  • Speak up if she feels uncomfortable sharing certain information.

For the Club:

  • Conduct a Data Protection Impact Assessment (DPIA) for any health-tracking technology.

  • Ensure clear communication with players about the use of their data.

  • Provide training for staff on handling sensitive health data.

  • Regularly review and update data governance policies.

  • Ensure that any health and medical data collected from female players is acted upon meaningfully as collecting special category data without follow-up not only undermines trust but also creates ethical and legal risks (eg a claim brought by Elle).

Duty of care: Beyond data collection

Elle’s experience also raises a critical legal and ethical question: what obligations do clubs have once they collect special category health data? In the UK, sports organisations, especially those working with elite or contracted athletes, may be subject to a duty of care under both common law and employment law principles.

This duty of care means that if a club collects data that could indicate a health risk (such as signs of REDs), it must take reasonable steps to respond appropriately. Failure to do so could expose the club to future claims, particularly if the athlete suffers harm that could have been prevented through timely intervention and proper support.

1. Key legal considerations:

  • Assumption of Responsibility: By collecting health data, clubs may be seen as assuming responsibility for monitoring and responding to health risks. This strengthens the argument that they owe a duty of care to their athletes.

  • Legal Risk: If a club collects menstrual or wellbeing data and fails to act on clear warning signs (e.g. irregular cycles, fatigue, weight loss), it could be exposed to liability, especially if the athlete suffers long-term harm.

  • Employment Context: For contracted athletes, the club’s obligations may also fall under employment law, where failure to provide a safe working environment, including adequate health support, could lead to legal consequences.

2. Ethical Implications:

Collecting special category data without the infrastructure to interpret, act on, and support athletes creates a false sense of security. It risks reducing health monitoring to a box-ticking exercise, rather than a meaningful tool for athlete welfare.

What should the Club do?

  • Don’t collect what they can’t support: if the Club lacks the expertise or resources to respond to REDs or menstrual health issues, it should reconsider whether it is appropriate to collect such data at all.

  • Embed medical oversight: ensure that qualified professionals are involved in reviewing health data and that there are clear protocols for follow-up.

  • Document and demonstrate action: the Club should maintain records of how health data is used to support athletes, not just performance metrics.

Looking ahead: Empowerment through protection

Elle’s diagnosis was a wake-up call, not just about fuelling her body properly, but also about owning her data and understanding her rights. She was fortunate that Paddington FC had the expertise, infrastructure, and medical support to use the data collected to spot the warning signs and intervene early. But Elle is acutely aware that not all clubs or sports organisations have the same capacity to monitor and respond to female health issues like REDs.

As FemTech becomes more embedded in sport, clubs must ensure that innovation does not come at the cost of privacy or responsibility. Collecting special category health data without the ability to act on it meaningfully not only undermines trust, but also raises serious ethical and legal concerns.

Protecting players means more than preventing injuries. It means respecting their autonomy, their health, their data and ensuring that every athlete, regardless of where they play, or what level they play at, receives the care and support they deserve.

To learn more, please visit our Women’s health and technology page or Women's sport page.