Even if you're not intending to sell your project, a safe approach could be to draw on the IEC 60601-1 standard, namely the part on "Patient leakage current".
A very short summary would give you the following figures: 10 µA max allowable for type CF applied parts in normal condition and 50 µA max in single fault condition.
Type CF basically means direct contact with the heart - for a purely skin contact electrodes device, the type BF is probably adequate, in which case you are allowed 10 times those figures, respectively 100 µA and 500 µA max. Also, if your electrodes are never in the chest area, type BF is definitely the right classification.
Those are figures for a compliant medical device - in practice, you're probably not likely to feel anything under a couple mA, let alone be harmed, although you should obviously play it safe in the chest region.
Don't think a device powered at +/-9V is necessarily safe with contact electrodes though: in case something went wrong with your circuit and you got up to 18 V across your electrodes; with good electrodes and a clean prepped skin, you can get impedances as low as a couple kOhm. Thus several mA. If on your leg or arm, it would probably just tickle, but if in another area, such as close to the heart, that could definitely hurt. Be also careful to avoid areas that could be close to any metallic implant (such as orthopedic screws and the like).
You have to design your input stage to ensure no current above those figures can leak between the recording electrodes. 100 µA would be a good starting point IMO and should not be hard to achieve.
In particular, beware of input bias currents. Also be careful if you design contains a so-called "right leg driver".
Also, even if it's operated on batteries, if your device has any kind of interface to an external device, this interface should be isolated.
As for protecting your inputs, ESD and overvoltage protection are good measures to make sure your device won't get fried while using it. ESD are very likely to occur when we mess with electrodes on the skin.
You can get some ideas here:
http://www.analog.com/en/analog-dialogue/articles/ecg-front-end-design-simplified.htmlEMG and ECG are very close - you may just need to adjust the gain/input signal range.