Most fitness businesses treat this as one piece of paper. It’s three, and they do different jobs under different laws.
Collapsing them into a single signup form is the most common mistake in the industry, and it’s the reason waivers get thrown out and membership contracts become unenforceable or refundable.
Key takeaways
You need three documents: a liability waiver, a membership agreement, and a health screening. Different purposes, different rules.
Many states have health club statutes with mandatory contract terms, cancellation rights and bonding requirements. These override your contract.
In most states a parent cannot waive a minor’s claims. Youth programs need separate handling.
The FTC’s click-to-cancel rule was vacated in 2025 and removed from the CFR in 2026. State auto-renewal laws still apply and some are stricter.
Fingerprint or face-scan check-in triggers biometric privacy law, notably Illinois BIPA.
No waiver anywhere covers gross negligence.
The three documents
Document | Purpose | Governed by |
|---|---|---|
Liability waiver / release | Limits claims from ordinary negligence; documents assumption of risk | State common law, varies widely |
Membership agreement | Payment terms, duration, cancellation, auto-renewal | State health club statutes, auto-renewal laws, ROSCA |
Health screening (PAR-Q) | Identifies risk before activity; informs programming | Negligence duty, state data law |
Combining them creates two specific problems. First, waiver language buried in a membership contract is more likely to be read as inconspicuous and struck down. Second, health club statutes often require specific contract formatting, and a hybrid document can fail those requirements.
Keep them separate, signed in sequence.
Do liability waivers actually protect a gym?
Partially, and less than most operators assume.
What waivers generally cover: ordinary negligence, where the language is clear, conspicuous and specific to the risks involved.
What they don’t cover anywhere: gross negligence, recklessness and intentional conduct. A waiver is not a licence to maintain broken equipment.
Where waivers are limited or void: state law varies more than on almost any other contract question. A few states are openly hostile to pre-injury releases, and New York General Obligations Law § 5-326 specifically voids exculpatory agreements at gymnasiums, pools and places of recreation where a fee is paid — which is a direct hit on fitness businesses. Other states void exculpatory contracts broadly by statute, and several appellate courts have refused to enforce releases for recreational activities as against public policy.
Drafting matters: courts construe waivers narrowly and read ambiguity against the drafter. Generic language covering “any and all claims” fares worse than specific recitation of the actual risks — equipment use, free weights, group classes, inversions, heated rooms.
A liability waiver template gives you a structure, but fitness waivers are state-specific enough that adaptation by local counsel is the difference between a document that works and one that doesn’t. [LEGAL REVIEW]
Treat the waiver as one layer. Insurance, equipment maintenance logs, staff certification, incident procedures and supervision ratios do the real protective work.
Can a parent sign away a child’s right to sue?
Usually no, and this is the single most important thing in this article for anyone running youth programs, teen memberships, kids’ yoga or family classes.
In most states, a parent cannot validly waive a minor child’s claims. The child’s cause of action belongs to the child. A parent-signed waiver may not bar the claim at all, and in many states the limitation period does not begin until the child reaches majority — meaning a claim can surface fifteen or more years after the class.
What a parental waiver usually can do: waive the parent’s own derivative claims, document informed consent, and record acknowledgment of risks. Those have value. Barring the child’s claim generally isn’t among them.
Practical consequences:
Insurance matters far more than paperwork for youth programming.
Retention periods for minors’ waivers must run long. See how long to keep signed documents.
Separate minor and adult waiver flows rather than using one form with a checkbox.
Where both a parent and an older minor should sign, that’s a two-signer sequential flow — see sequential vs parallel signing.
[LEGAL REVIEW]
Health club statutes: the rules most gyms don’t know about
This is the layer almost no fitness waiver guide covers, and it’s the one that generates refund claims and regulatory action.
Many states regulate health club and fitness service contracts specifically. Common requirements:
Mandatory cancellation periods — commonly three to five days, independent of anything in your contract
Specific required contract language, sometimes in prescribed type size or placement
Maximum contract lengths, with some states capping terms at two or three years
Cancellation rights on death, disability or relocation beyond a set distance
Registration or bonding requirements, particularly where you sell prepaid or long-term memberships
Limits on prepayment before a facility opens
Named examples: California’s Health Studio Services contract provisions, New York’s General Business Law health club provisions, the Texas Health Spa Act, and equivalent statutes in Florida, Illinois, Ohio and elsewhere.
Why this matters for digital contracts: if your state requires particular language in a particular format, your online signup flow must reproduce it. A responsive web form that reflows or collapses required disclosures can fail a formatting requirement that the paper version met.
Check your state’s statute before building the flow, not after. [LEGAL REVIEW]
What are the current auto-renewal rules for gym memberships?
Memberships are the canonical auto-renewal product, and the federal position changed recently in a way most published guidance hasn’t caught up with.
The federal click-to-cancel rule is not in effect. The FTC’s 2024 amendments to the Negative Option Rule, widely called the click-to-cancel rule, were vacated in full by the Eighth Circuit on July 8, 2025 on procedural grounds, and never took effect. The court held that the FTC had failed to comply with the procedural requirements of its Magnuson-Moss rulemaking authority, specifically by skipping a required preliminary regulatory analysis. On 12 February 2026 the FTC issued a final rule at 91 FR 6507 implementing the vacatur, recodifying 16 CFR 425 as it read before the 2024 amendments. Is the FTC Click-to-Cancel Rule Dead? 2026 Status Update +2
But the underlying duties survive. The FTC retains authority under ROSCA and Section 5 of the FTC Act to challenge cancellation practices, and state auto-renewal laws remain enforceable and may impose comparable or more prescriptive requirements. Approximately 30 states have enacted their own automatic-renewal statutes, some of which — California’s Automatic Renewal Law among them — already match or exceed the vacated federal rule. goodwinlawjonesday
And a new rule is in progress. The FTC restarted negative option rulemaking with an Advance Notice of Proposed Rulemaking following the vacatur. The ANPRM comment window closed in April 2026. gibsondunnsubbuddy
Practical reading: build to the stricter state standard rather than the absent federal one. In practice that means clear and conspicuous disclosure of renewal terms before you take payment details, separate affirmative consent to the renewal itself, a renewal reminder, and a cancellation method no harder than signup was. A gym that requires in-person cancellation for an online signup is the exact pattern enforcement targets. [VERIFY — recheck status at publication; this is actively moving]
Payment authorization is a separate signature
Recurring billing authorization isn’t the same document as the membership agreement, and it has its own requirements.
Preauthorized electronic fund transfers from a consumer account generally require written authorization, a copy provided to the consumer, and a route to stop payment. Where authorization is electronic, it needs to satisfy E-Sign requirements for the consumer to have genuinely consented and be able to retain a copy.
Build this as a distinct, clearly labelled authorization — not a line buried in paragraph fourteen. [LEGAL REVIEW]
Health screening and the data you collect
A PAR-Q or health history serves two purposes: it informs safe programming, and it documents that you asked.
Gyms are generally not HIPAA covered entities, so this is usually a state data protection question rather than a HIPAA one. That doesn’t make it low-stakes:
Collect only what you’ll actually use. A health history nobody reads is worse than none — it establishes you were on notice of a condition.
Have a documented response to red flags. If a form discloses a cardiac condition and nothing happens, that’s a liability problem the form created.
Control access. Front desk staff don’t need medical histories.
Set a retention period and stick to it.
Biometric check-in is a separate legal problem
Fingerprint and face-scan entry systems are common in fitness and have generated substantial litigation.
Illinois BIPA requires written notice of what’s collected and why, a published retention and destruction schedule, and written consent before collection. It carries a private right of action with statutory damages per violation, and fitness businesses using fingerprint check-in have been defendants. Texas and Washington have their own biometric statutes, and more states are adding them.
If you use or are considering biometric entry, the consent is a distinct signed document with specific required content. Don’t fold it into the membership agreement. [LEGAL REVIEW]
The same separation applies to photo and video releases. Studios post class photos constantly; a general membership agreement rarely covers that properly, and it should be revocable.
Building the digital flow
Sequence it: health screening → waiver → membership agreement and payment authorization. Separate signatures on separate documents, in that order.
Design for phones. Most signups happen on a phone, often standing at a front desk. Minimise required fields, keep signature blocks thumb-reachable. Forms and fields that get signed and signature field placement cover the specifics.
Sign before arrival where you can. A waiver completed at booking beats one rushed at the door, and it gives you a record before anyone is on the floor.
Use bulk send for events and challenges. A 200-person charity workout or a six-week challenge is one template to many independent signers — see bulk send explained. Authenticate your sending domain first, or waiver emails land in spam and people simply don’t sign: sending from your own domain.
Connect it to your management system. If signed waivers don’t attach to the member record automatically, staff still check manually at the door. Integrations determine what’s possible.
Keep the audit trail. Timestamp, IP and verification method are what make the signature evidentially useful two years later: how audit trails work.
Re-sign on material change. Updated terms, new equipment categories, new class types. Annual re-signing is common and inexpensive once automated.
Personal trainers: if you operate independently inside someone else’s facility, you need your own waiver and insurance. The facility’s waiver protects the facility. A service agreement or independent contractor agreement covers the relationship with the venue.
Common mistakes
One combined document instead of three.
Assuming a parental waiver bars a child’s claim. In most states it doesn’t.
Ignoring the state health club statute.
Following click-to-cancel guidance that was vacated in 2025.
Hard cancellation paths for online signups.
Biometric check-in without BIPA-standard consent.
Collecting health data you never read.
Short retention on minors’ waivers.
Generic “any and all claims” language rather than specific risk recitation.
No re-signing when terms or facilities change.
FAQ
Are digital waivers legally binding for gyms?
Yes. Electronic signatures are valid under ESIGN and state law. Whether the waiver is enforceable is a separate question governed by state law on exculpatory agreements — and in some states, including New York for fee-charging gyms, it isn’t.
Can a parent sign a waiver for a child?
They can sign, but in most states it won’t bar the child’s own claim. It waives the parent’s derivative claims and documents informed consent. Insurance is the real protection for youth programming.
Does the FTC click-to-cancel rule apply to gym memberships?
No. It was vacated by the Eighth Circuit in July 2025 and formally removed from the CFR in February 2026. ROSCA, the FTC Act and roughly 30 state auto-renewal laws still apply, and several are stricter.
What is a health club statute?
State legislation regulating fitness contracts specifically — mandatory cancellation windows, required contract language, maximum terms, and sometimes bonding or registration. It overrides contrary contract terms.
Do waivers cover gross negligence?
No. No state enforces a waiver of gross negligence or recklessness. Equipment maintenance and supervision are what protect you there.
How long should we keep signed waivers?
At least the personal injury limitation period in your state. For minors that period often doesn’t start until majority, so plan for retention well beyond a decade.
Does fingerprint check-in need separate consent?
Yes, in states with biometric privacy laws. Illinois BIPA requires written notice, a published retention schedule and written consent before collection, with statutory damages for violations.
Do personal trainers need their own waiver?
If operating independently, yes. The facility’s waiver protects the facility, not you.
