The CMA Playbook Every UK Gym Meets the Day It Automates WhatsApp

The five rules a UK gym actually meets when it automates WhatsApp

The day a British gym or fitness studio turns on the WhatsApp Business Platform, it inherits five separate rulebooks that most 'gym marketing' guides stitch together loosely if at all. Meta charges under the United Kingdom conversation-pricing band on developers.facebook.com/docs/whatsapp/pricing. The Competition and Markets Authority's Unfair Contract Terms guidance at gov.uk/government/publications/unfair-contract-terms-guidance still governs which membership, minimum-term, and cancellation clauses hold up — the sector's history with the CMA (and its OFT predecessor) is why the standard 'lock-in' cannot simply be transplanted into a WhatsApp sign-up flow. The Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 (legislation.gov.uk/uksi/2013/3134/contents) give a distance-sold member a 14-day cooling-off right that a WhatsApp cancellation thread must recognise. The BACS Direct Debit Guarantee (bacs.co.uk/direct-debit/) sets the 10-working-day notification standard for any collection change, WhatsApp included. And the ICO's PECR direct-marketing regime at ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications draws the line between a class reminder (transactional, no consent needed) and a renewal broadcast (marketing, consent required). Every WhatsApp workflow decision below plays into one of these five.

What Meta actually charges a British gym on the Business Platform

Meta prices per 24-hour conversation window in four categories: marketing (business-initiated promotions), utility (transactional — class confirmations, DD failure notices, PT session acknowledgements), authentication (OTP-style), and service (customer-initiated, free within the session window). The UK sits in its own pricing band on the rate card at developers.facebook.com/docs/whatsapp/pricing; marketing rates are materially higher than utility.

Since 2024 Meta has provided a free tier of 1,000 service-initiated conversations per Business Account per month, which typically absorbs a small studio's inbound-question volume outright. Realistic monthly-cost patterns for a UK operator:

• Small independent studio, ~200 active members, class-reminder utility conversations plus inbound service traffic: low tens of pounds in Meta charges alone, often absorbed by the free tier.
• Mid-size gym, 1,500 active members, weekly renewal or PT-upsell broadcasts: scales into the low hundreds depending on category mix and list size.
• Multi-site chain with automated PT upsell, class waitlist, and event marketing: cost curve is dominated by marketing conversations — worth modelling per-conversation before enabling broadcast flows.

On top of the Meta rate the gym needs a Business Solution Provider (BSP) — 360dialog, WATI, and Twilio publish current tier pricing at 360dialog.com/pricing, wati.io/pricing, twilio.com/whatsapp/pricing. Some UK gym-management platforms (Glofox, TeamUp, Gymcatch, Xplor Gym) sell a 'WhatsApp integration' add-on that still runs through Meta and a BSP underneath — the per-conversation cost applies regardless of who invoices.

The CMA's gym-contract file: what enforcement already forced UK operators to rewrite

The UK gym sector has a well-documented enforcement history with the CMA and its predecessor the Office of Fair Trading. In 2013 the OFT ran a sector-wide investigation into gym membership contracts and secured formal undertakings from several major chains to remove or rewrite clauses considered unfair under the Unfair Terms in Consumer Contracts Regulations 1999 (now consolidated into the Consumer Rights Act 2015). The pattern of terms flagged in that investigation — and repeated in CMA guidance since at gov.uk/government/publications/unfair-contract-terms-guidance — includes:

• Long minimum-term commitments with no escape route for material change in circumstances (relocation, injury, redundancy).
• Onerous cancellation processes that require a specific method (in-person only, registered post) rather than any reasonable written notice.
• Automatic renewal into a further minimum term without a clear opt-out window.
• Price-increase clauses that allow the operator to change the price during the term without proportionate cancellation right.
• Cancellation notice periods long enough (e.g., three months) to be characterised as a penalty.

Where WhatsApp automation walks straight into the CMA's existing pattern:

• A WhatsApp cancellation flow that routes a member through three save-the-sale prompts before acknowledging the cancellation is 'friction-added cancellation' — the ICO has flagged this pattern in adjacent industries and the CMA's contract-terms lens applies to gyms specifically.
• An automated broadcast that says 'your membership will auto-renew for a further 12 months unless you cancel by X' is only enforceable if the underlying auto-renewal clause is itself compliant — the 2013 undertakings restricted this pattern.
• A 'membership save' flow that requires the member to speak to a specific staff member during limited hours before a WhatsApp cancellation is honoured effectively imports the old 'cancellation-in-person only' clause into a digital channel.

The safe default is to treat a WhatsApp cancellation notice with the same weight as an email or letter — acknowledged inside a working day, actioned to the confirmed cancellation date, and any pro-rated fees explained transparently. The CMA guidance is not sector-specific in name, but its evidence base is.

The 14-day cooling-off right on a WhatsApp sign-up thread

The Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 (legislation.gov.uk/uksi/2013/3134/contents) apply to consumer contracts concluded 'at a distance' — telephone, website, and instant-messaging channels including WhatsApp. A gym that signs a member up via a WhatsApp thread, a click-through link inside a WhatsApp message, or an in-app payment prompt is selling at a distance for the purposes of the Regulations.

What the 14-day cooling-off actually gives the consumer:

• A right to cancel the contract for any reason within 14 calendar days of contract conclusion.
• If the member starts using the service inside that window at their explicit request, the operator can charge for services actually delivered up to the cancellation date, pro-rated fairly.
• A refund of the balance within 14 days of the cancellation being accepted, using the same payment method the member used to pay.

WhatsApp-specific implications:

• Pre-contract information (headline price, term length, cancellation terms) has to be provided in a durable medium — a WhatsApp message counts if the member can retrieve it, and a link to a durable T&Cs page counts if the page cannot be silently changed after the fact.
• The Regulations require a model cancellation form to be made available; a WhatsApp intake that does not signpost the cancellation right at all is non-compliant even if the contract itself is otherwise sound.
• A cancellation notice sent via WhatsApp inside the 14-day window is a valid cancellation — the operator cannot require the member to phone in or write.

Where operators go wrong on WhatsApp:

• Auto-replies during evenings and weekends that give the member no clear route to cancel effectively swallow days of the cooling-off window.
• Onboarding flows that push the member straight into a class booking without acknowledging the cooling-off right leave the operator with no documentary evidence that the required information was provided.
• Refund messages that promise return 'within 28 days' or 'once your card provider clears' breach the 14-day statutory limit on the refund.

BACS Direct Debit Guarantee: what a WhatsApp failure notice must and must not say

Most UK gym memberships collect by BACS Direct Debit under the scheme rules operated by Pay.UK and set out at bacs.co.uk/direct-debit/. When a collection fails — insufficient funds, cancelled mandate, incorrect details — the gym has to notify the member and either re-attempt or arrange a different settlement path. WhatsApp is a viable channel provided the scheme rules are respected.

Direct Debit Guarantee notification standard:

• The Guarantee requires the payer to be advised in writing of the amount and date of any collection at least 10 working days before it is taken.
• A change to the amount or date of a collection (including a re-presentment after a failure) triggers the same notification requirement.
• WhatsApp counts as 'written notice' for this purpose only if the member has agreed to receive scheme notifications via WhatsApp and the message is retrievable in a durable form.

Failed-collection message content that fits the rules:

• Fact of failure: which collection failed and on what date.
• Amount: what was owed, what was collected (if partial), what remains.
• Reason: where known and where privacy-appropriate to share.
• Next attempt: date and amount of the re-presentment.
• Alternative payment path: a link or instruction to update the mandate or pay by another method.
• Contact route for a dispute: a clear line back to the operator, not just a chatbot loop.

Content and pattern hazards:

• A failed-payment message that also carries a marketing offer ('collection failed — while you're here, take 10% off a personal training session') pulls the whole message under PECR marketing consent rules and may breach BACS scheme rules on notice content.
• Aggressive daily follow-ups create both a PECR risk (if promotional wording is added) and a complaint risk to the Financial Ombudsman Service, which can hear consumer complaints about the way a gym has handled a Direct Debit dispute.
• A message that threatens 'termination in 24 hours' without giving the statutory 10 working days' notice of a schedule change is a documented scheme-rules breach.

Operators that want to combine a failed-DD recovery with a win-back marketing offer should send them as separate messages, gated by separate consents.

CIMSPA scope of practice, PAR-Q data, and the health-question line a chatbot cannot cross

Two distinct rulebooks apply the moment a WhatsApp conversation touches a member's body or health.

Professional scope of practice — the Chartered Institute for the Management of Sport and Physical Activity (CIMSPA, cimspa.co.uk) is the UK's chartered body for the fitness sector. CIMSPA's Professional Standards define what a Level 2 Gym Instructor, a Level 3 Personal Trainer, or a specialised professional (pre-natal, GP referral, cardiac rehab) is qualified to deliver. Answering a member's medical question — 'is it safe to exercise with my sciatica', 'should I take my beta-blocker before class', 'is this class OK for me at 32 weeks pregnant' — is outside the scope of a generic PT and inside the scope of a suitably qualified specialist or the member's GP. A WhatsApp auto-reply that answers those questions with an off-the-shelf template is providing regulated advice by default, and the operator inherits professional-liability exposure.

Special-category data — injury history, medication, pregnancy status, and any other health-relevant information collected on a Physical Activity Readiness Questionnaire (PAR-Q) or during onboarding is Article 9 special-category data under the UK GDPR. The ICO's guide at ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/special-category-data/ requires an Article 6 basis and a separate Article 9 condition — explicit consent is the common choice for consumer fitness services.

Practical WhatsApp discipline:

• Collect PAR-Q and health disclosures inside a secure intake form (most gym-management platforms include one), not in a WhatsApp thread. Threads accumulate special-category disclosures that are hard to locate, redact, or delete on a subject-access or erasure request.
• Set up WhatsApp intake to recognise medical-question keywords and hand off to a suitably qualified team member or route the member to their GP. Never let a chatbot template 'reassure' a member with clinical-sounding language.
• Retention: define a period tied to purpose — a member's PAR-Q typically has value while they are active plus a short window after cancellation. Indefinite retention of health disclosures is a compliance risk.
• PT-side note-keeping in WhatsApp: coach messages that record 'she reported pain in her left shoulder' or 'he's back on medication for anxiety' are Article 9 data. A purpose-built coach note tool is easier to manage than a shared WhatsApp inbox.

ICO PECR: class reminders vs renewal broadcasts

The Privacy and Electronic Communications Regulations 2003 (PECR) govern electronic marketing in the UK. The ICO's guidance at ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications treats WhatsApp as electronic mail for these purposes.

Transactional (no marketing consent required): class booking confirmations, class reminders, waitlist notifications, PT session confirmations, DD failure notifications, cancellation acknowledgements, membership-expiry notices with no promotional wrap. Contract-performance basis under Article 6(1)(b) UK GDPR covers these.

Marketing (consent required): renewal offers, class-launch promotions, PT-upsell nudges, referral asks, 'we've missed you' win-back to lapsed members, birthday offers, class-pack discount broadcasts. These require either explicit prior consent or the ICO's narrow 'soft opt-in' exception.

Soft opt-in for a UK gym — the three conditions:

1. Contact was obtained during the sale or negotiation of a similar service (existing paying member, past PT client).
2. Marketing is for the operator's own similar services (an existing gym member can be offered PT upsell; a past yoga-workshop attendee at a studio cannot be marketed for a personal training package under the same basis without fresh consent).
3. Easy opt-out at data collection AND in every subsequent message.

Patterns that work:

• Separate unticked checkbox at sign-up for 'WhatsApp offers and promotions'.
• 'Reply STOP to opt out' in every marketing message, honoured within a working day.
• Timestamped consent records the ICO can inspect on a Section 55 notice.

Patterns that fail:

• Adding lapsed members from three years ago to a new-service broadcast list without fresh consent.
• Using a member's cancellation-thread number to send a promo three months later.
• Bundling marketing consent into a class-booking confirmation.

Maximum PECR fine: £500,000; UK GDPR-adjacent breaches can trigger the higher £17.5m or 4%-of-turnover ceiling. The ICO's public enforcement database at ico.org.uk/action-weve-taken/enforcement/ lists past decisions relevant to SMB service operators.

Which UK gym-management platforms integrate with the WhatsApp Business API

The UK gym-software market has several vendors with meaningful footprint; each takes a different approach to WhatsApp.

• Glofox (now ABC Glofox after the ABC Fitness Solutions acquisition; glofox.com) — boutique-studio focused. WhatsApp integration is available via API and add-on partners; the messaging layer still runs through a BSP.
• TeamUp (goteamup.com) — UK-headquartered, popular with independent studios and PT groups. Booking and payment data can be pushed to a WhatsApp automation layer via API or webhook.
• Gymcatch (gymcatch.com) — UK-focused booking and payments platform for small studios and independent trainers. WhatsApp reminders are delivered through third-party integrations.
• Mindbody (mindbodyonline.com) — global platform with UK footprint; WhatsApp integration typically via marketplace partners and Zapier bridges.
• Xplor Gym (xplortechnologies.com/gb/xplor-gym) — enterprise operator in the UK health-club market, WhatsApp typically layered on via BSP partnership.
• Legend / Fitronics / Perfect Gym — larger UK operators using enterprise platforms; WhatsApp integration usually a BSP-side project rather than a click-to-enable toggle.

Underneath any of these, the WhatsApp channel still runs through Meta and a Business Solution Provider on Meta's official directory at business.whatsapp.com/partners. Operators evaluating a platform's 'WhatsApp support' should confirm whether the integration is first-party (BSP-native) or a Zapier-style bridge — the first is more reliable at volume and gives a cleaner audit trail if a member disputes a message or a Direct Debit notification later.