This paper presents and evaluates legal aspects related to digital technologies applied in the elite soccer domain. Data Protection regulations in Europe clearly indicate that compliance-by-design is needed when developing and deploying such technologies. This is particularly true when health data is involved, but a complicating factor is that the distinction between what is health data or not is unclear. Add to the fact that modern analysis algorithms might deduce personal medical-related data when correlating and sifting through what might seem more harmless data in isolation. We conclude with a set of recommendations rooted in current legal frameworks for developers of sports and wellness systems where privacy and data protection can be at risk.