Access control • Turnstile
Gym access control: card, QR code, wristband and turnstile
Access control is not just a physical barrier: it is where the membership becomes verifiable and where the gym gets its attendance data. A turnstile wired to the member database refuses an expired membership on its own, with no argument at the front desk. Below you'll see how it works, which identification technologies exist and what to do with the resulting data.
How it works (short answer)
- The member presents their card, wristband or phone QR code to the reader at the entrance.
- The reader sends the identifier to the app, which looks up the member and their membership.
- The app checks validity, the membership type and any time-slot restrictions.
- If the membership is valid, the turnstile unlocks and the entry is recorded as attendance.
- If the membership has expired, access is refused and the front desk sees the reason on screen.
Identification technologies
How you identify the member at the gym entrance
| Technology | Advantage | Limitation |
|---|---|---|
| Proximity card | Fast, cheap, familiar to members | Gets lost and can be lent out |
| QR code on the phone | No card to issue, can be rotated periodically | Depends on the phone's battery |
| RFID wristband | Stays on the wrist, useful at the pool and lockers | Higher cost per unit |
| PIN code at the turnstile | A fallback, with no extra hardware | Easily passed between people |
What you gain from attendance data
- You see occupancy by time slot and confirm the 18:00–21:00 peak with figures, not impressions.
- You spot members inactive for three weeks, the ones most exposed to churn.
- You size the trainers' and group classes' schedule to real traffic.
- You justify investment in new equipment with the number of entries per zone and per hour.
- You stop card sharing, by comparing entries with the photo on the member's record.
GDPR for access logs
- An access log is personal data: it needs a legal basis and a defined retention period.
- The usual basis is performance of the membership contract, not consent.
- The member's health declaration is health data and requires separate, explicit consent.
- A fingerprint is biometric data: use a card or QR code if you want to avoid the stricter regime.
- Restrict log access by role — the front desk sees the day's entries, not the full history.
Common mistakes
- Installing the turnstile without wiring it to the member database — it stays a barrier the front desk opens by hand.
- Not setting the time restriction for off-peak memberships, so they have no effect at all.
- Keeping access logs indefinitely, with no retention policy.
- Leaving a single reader at the entrance and blocking the flow at peak hours.
How 4gym helps
- Automatic membership validation at the turnstile, by card, wristband or QR code.
- Time-slot restrictions for off-peak memberships, enforced right at the entrance.
- An attendance and occupancy report by hour, by day and by membership type.
- Data retention policies and role-based access rights, for GDPR compliance.