A fitness studio in Minnesota wants clients to complete an online intake form about injuries, medications, and fitness goals. What should privacy counsel review about the information requested, access controls, service providers, retention, and client notices before the studio launches the form?