A retention schedule for fitness studio attendance and billing exports

Published November 5, 2026

Fitness studios accumulate two kinds of records that look harmless until someone needs them. Attendance exports show who came to class and when. Billing exports show what each member paid, paused, or disputed. Both contain personal information, and both are copied into spreadsheets and email threads during ordinary operations.

A studio that never sets a retention period keeps every copy by default. A studio that deletes too quickly loses the evidence it needs when a member disputes a charge. The useful middle ground is a written schedule that names each record and its owner. It also names the event that starts the retention clock.

Why attendance and billing exports need a schedule

Attendance data is often kept because it is easy to keep. The booking platform exports it, the coach downloads it, and the file sits in a folder named for the month. No one decides how long it should stay or who may open it. That default creates a growing archive with no clear purpose.

Billing exports carry more sensitive detail. They may include names, contact information, plan amounts, payment status, and notes about a freeze or a dispute. A copy sent to a bookkeeper can outlive the original platform record. It can also remain accessible to people who no longer work at the studio.

The NIST Privacy Framework treats data minimization and retention as risk-management decisions. The framework does not prescribe a retention period for a fitness studio. It asks the organization to identify what data it holds and why it holds it. It also asks who is responsible for reducing it.

A written schedule turns those questions into routine work. The assistant can check the schedule each month and flag files that have reached their disposal date. Then the assistant routes the decision to the owner. Without a schedule, deletion depends on memory, and memory is unreliable during a busy season.

Name the records before naming a period

Start with an inventory of the records the studio actually creates. Include the booking platform export, the payment processor report, the accounting ledger, the member agreement, and the freeze request. Add the cancellation note, the door-access log, and any spreadsheet built to reconcile those systems. Leave a column for the system that feeds each record.

Name the system of record for each item. The booking platform may be authoritative for attendance, while the payment processor is authoritative for charges. A spreadsheet that combines both is a derivative copy, not the source. It should usually have a shorter life than the systems it summarizes.

Describe the format and location of each copy. A monthly export in a shared drive, a CSV attached to an email, and a printed roster are three different records. Each has its own access path. The schedule should address all three rather than assuming the platform alone controls the data.

Assign an owner to each record. The owner is the role that can decide whether to keep, delete, or restrict the record. It is not the person who happens to have the file open. For billing records, that may be the owner or bookkeeper. For attendance records, it may be the studio manager or head coach.

Separate operational need from legal obligation

A studio may keep attendance records to answer member questions and plan schedules. It may keep billing records to reconcile payments and support tax filings. Those operational purposes are legitimate. They do not justify keeping every copy forever.

Legal obligations set a floor in some areas. The IRS recordkeeping guidance explains that businesses should keep records that support reported income and expenses. The Department of Labor publishes recordkeeping requirements for employers under wage and hour law. Those rules do not automatically cover every attendance export or every marketing list.

The studio's accountant or counsel should confirm which records fall under a specific requirement and for how long. The assistant can prepare the inventory and the questions. The owner should obtain the professional answer and record it beside the schedule. Record the date of that confirmation as well.

Write the basis beside each retention period. A period copied from another gym's policy without a stated reason is hard to defend and easy to ignore. A period tied to a tax year, a contract term, or a documented operational need is easier to review. It is also easier to explain when circumstances change.

Build a record inventory with owners

A simple inventory table is enough to start. Use one row per record type and columns for the source system, the purpose, the owner, and the retention period. Add the disposal method and the review date. Keep the table in the studio's approved document system rather than a personal folder.

The inventory should distinguish records about members from records about employees and contractors. Payroll, credential, and schedule records follow employment rules and may need a different period than member attendance. Mixing them in one folder makes access control and disposal harder. It also makes a routine audit more expensive.

Include temporary exports in the inventory. A CSV pulled for a monthly review may only need to exist until the review is signed off. A spreadsheet used to reconcile a single billing dispute may only need to exist until the case closes. Naming those temporary records prevents them from becoming permanent by accident.

Review the inventory when the studio changes platforms or adds a service line. A platform migration can create duplicate exports and orphaned files. The review should confirm that old copies are disposed of under the schedule. It should also confirm that new record types have an owner.

Set retention by purpose, not by file type

Two files with the same extension can have different retention needs. A member attendance summary used for a monthly capacity review may be kept for a short operational window. A billing ledger used for tax reporting may need to stay for the period the accountant specifies. The file type does not decide the period.

Start with the shortest period that satisfies the purpose. If the studio only needs the attendance summary to compare one month with the next, a rolling window may be enough. If a member dispute can arise a year later, the underlying transaction record may need a longer period. The summary and the transaction are different records.

Record the trigger event that starts the clock. Common triggers include the end of the calendar year, the end of the membership, the closure of a dispute, or the date a record was superseded. "Keep for three years" is ambiguous without a start date. The trigger makes the period testable.

Define the disposal event and the evidence

Disposal is a process, not a button. The owner should confirm that the retention period has ended and that no legal hold or open dispute applies. Then the owner should confirm that the record is not needed for a current operational question. Only then can the record be deleted or destroyed.

Keep a disposal log with the record type, the date range, the number of files, the method, and the approver. Do not keep the deleted personal data in the log. A short entry is enough to show that the schedule was followed. It also gives the next reviewer a place to start.

The FTC's business guidance on protecting personal information recommends keeping only the information the business needs and disposing of it securely. That principle supports a documented disposal step. It matters most for exports that contain contact details or payment status. The disposal log can show that the step happened.

Check backups and shared drives before declaring a disposal complete. A file deleted from the active folder may still exist in a synced copy or an email attachment. The schedule should state what the studio can reasonably control. It should also state what the vendor retains under its own policy.

Handle exports, temporary copies, and shared drives

Most retention failures happen in the space between systems. Someone exports a roster to answer a question and emails it to a coach. The original platform record is governed, but the copy is not. The copy often outlives the question that created it.

Create a standard folder for temporary exports with a named owner and an expiry date. Restrict access to the roles that need the file. Delete the folder contents on a fixed schedule rather than waiting for someone to notice. A simple expiry rule is easier to follow than a long policy.

Avoid sending exports as email attachments when a link to the approved system will do. Email creates copies in inboxes, sent folders, and mobile devices that the studio cannot easily inventory. If an attachment is necessary, record it in the case file. Delete it when the case closes.

Put the schedule on a calendar

A retention schedule that lives in a document but not in a calendar will be forgotten. Add a monthly review to the operations calendar and name the person who runs it. The review can be short when there is nothing to dispose of. It still needs a dated entry.

The monthly check should list records that reached their disposal date and temporary exports with expired owners. It should also flag access changes since the last review. Add any new record type that is not yet in the inventory. Close the review with an entry in the disposal log.

Once a quarter, review the schedule itself. Confirm that the stated purposes still apply and that the retention periods still match the studio's obligations. A new service, a new payment processor, or a new state requirement can change the answer. The quarterly review is where that change gets recorded.

The assistant can prepare the monthly list and the quarterly questions. The owner approves disposal and any change to the schedule. That separation keeps the routine moving without giving an assistant authority over legal or financial decisions. It also leaves a clear record of who approved each step.

Limits and sources

This method is a local records protocol, not a universal retention rule. The NIST Privacy Framework provides a risk-management structure, and the FTC provides business guidance on protecting personal information. The IRS and the Department of Labor publish recordkeeping requirements in their respective areas. The Small Business Administration offers general financial management guidance.

None of those sources sets a single retention period for a fitness studio's attendance or billing exports. The studio's own agreements, accountant, counsel, and platform contracts determine the specific obligations. Use this inventory to ask better questions and to keep the answer in one place. Do not treat a sample schedule as legal advice.

For a related look at how attendance data should be defined, read what an attendance percentage hides when drop-ins and comps share a roster. For the member-facing side of a billing freeze, see reconciling a member freeze across billing, access, and the class roster. Both methods depend on records that are complete enough to answer a question. A retention schedule protects that evidence without keeping it forever.