Before-and-after photo consent is one of the most common gaps in small aesthetic clinics. Most clinics photograph every injectable treatment, and many share the best results on Instagram. Yet the photo often sits on a practitioner's phone, covered by one tick box on a general consent form. Under UK rules, taking a photo for the clinical record and posting it online are two different uses, and each needs its own justification.
In short
- An identifiable photo that shows a treatment area or outcome is personal data, and usually health data. Under UK GDPR that makes it special category data.
- Photos kept for the patient's care and photos used in marketing need separate decisions. For marketing, get specific, explicit consent that the patient can withdraw.
- The GMC expects consent or other valid authority before making recordings, no use outside the original consent without asking again, and secure storage.
- Ads with before-and-after photos must be genuine and representative, and imagery of prescription-only medicines such as botulinum toxin is very likely to count as advertising them.
Why before-and-after photos count as special category data
UK GDPR defines health data as personal data about a person's physical or mental health that reveals information about their health status. A photo of a patient's face before and after filler, with their name in the record and the treatment logged against it, shows a medical procedure and its outcome. In most clinics that makes the photo health data, and health data is one of the special categories set out in UK GDPR.
The ICO is careful on one point: a digital photo is not automatically biometric data, even if it identifies someone. It only becomes biometric data through specific technical processing, such as creating a face template for automated matching. For most clinics, the relevant category is health, not biometrics.
Consent for the record and consent for marketing are not the same
Special category data needs both a lawful basis and an additional condition. The ICO lists the conditions, and explicit consent is only one of them. Another covers processing needed for health care or treatment, carried out by or under the responsibility of a professional who owes a duty of confidentiality.
Photos for the clinical record
Where a regulated professional photographs a patient to plan, carry out and review treatment, the health care condition may be the more accurate basis for data protection purposes. That does not remove the need to ask. Professional guidance still expects the patient to agree to being photographed, and the GMC's principles on recordings say doctors should make recordings only with appropriate consent or other valid authority, with no pressure on the patient, and stop, where practicable, if the patient asks. The GMC guidance applies to doctors; nurses and other registrants have equivalent duties of confidentiality under their own codes, such as the NMC Code. If your clinic includes practitioners who are not regulated health professionals, check which condition applies to them before relying on it, and take advice if you are unsure whether explicit consent is the better route.
Photos for marketing, training or case studies
Posting a result on Instagram, adding it to a website gallery or using it in a training talk is a separate purpose. The GMC says identifiable recordings should be disclosed only with consent or other valid authority, which for marketing in practice means consent, and not used outside the scope of the original consent without asking again. In data protection terms, the clear route is explicit consent: specific to the use, given freely, recorded, and as easy to withdraw as it was to give. A general line in a treatment consent form does not meet that standard. Our article on aesthetic consent forms covers what the treatment consent itself should record.
| Use of the photo | What you need | Where to keep it |
|---|---|---|
| Clinical record (assessment, treatment planning, review) | Patient agreement to be photographed, recorded in the notes; an identified UK GDPR basis and condition | In the patient record, not on a personal phone |
| Marketing (social media, website, ads) | Separate, explicit consent for that use, with the option to withdraw | Consent stored with the patient record; published copies tracked |
| Training or case presentations | Separate consent, or anonymise if that still serves the purpose | Record which images were used and where |
Storage: where the photos actually live
The weak point in many clinics is not the consent form but the camera roll. Photos taken on a personal phone get backed up to personal cloud accounts, shared in messaging apps and kept long after a practitioner leaves. The GMC expects secure arrangements for storing recordings, and UK GDPR requires appropriate security for personal data. In practice, clinical photos belong in the patient record, with access limited to the people treating the patient and a clear rule about deleting copies from devices.
Advertising rules for before-and-after photos
Once a photo is used to promote a treatment, advertising rules apply as well. CAP guidance on before-and-after photos says advertisers should hold signed and dated proof that photos are genuine and have not been manipulated, and that images must not exaggerate the results people can expect. Prescription-only medicines may not be advertised to the public, and before-and-after imagery of a prescription-only product is very likely to be seen as an implied ad. For clinics offering anti-wrinkle injections, that in practice rules out the most common Instagram post.
For the practical side of taking consistent photos, see our guide to using before-and-after images.
Before-and-after photo consent: a checklist
- Split the consent. Separate photography for the clinical record from marketing and training use, with a clear yes or no for each.
- Name the uses. Say where a marketing photo may appear, such as Instagram or the clinic website, and whether the face will be shown.
- Record it with the patient. Store the signed consent and the date in the patient record, linked to the treatment.
- Stop using personal phones. Take or upload photos straight into the record, and delete copies from devices.
- Standardise the photos. Use the same angle, distance and lighting, and keep originals unedited, so you can show they are genuine.
- Handle withdrawals. If a patient withdraws marketing consent, remove the images you control, note the date, and keep the clinical record as normal.
- Check your ads. Don't promote prescription-only treatments with before-and-after imagery, and keep proof for any results you do show.
Frequently asked questions
Are before-and-after photos special category data under UK GDPR?
Usually, yes. An identifiable photo that shows a treatment area or outcome and is linked to a patient's record reveals information about their health, which UK GDPR treats as special category data. A photo is not automatically biometric data, but as health data it needs a lawful basis, an additional condition and appropriate security.
Do I need consent to take clinical photos of an aesthetic patient?
You should always ask, and record the patient's agreement. The GMC expects consent or other valid authority before making recordings, with no pressure on the patient. For data protection, photos kept for care may rely on the health care condition when taken by a regulated professional, but marketing use needs separate, explicit consent.
Can I post a patient's before-and-after photos on Instagram?
Only with the patient's separate, explicit consent for that use, which they can withdraw. The post must also follow advertising rules: photos must be genuine, not manipulated to exaggerate results, and representative. Before-and-after imagery of prescription-only medicines, such as botulinum toxin, is very likely to be treated as advertising a prescription-only medicine, which is not allowed to the public.
What should a clinic do if a patient withdraws consent for marketing photos?
Stop using the images for marketing and remove them from channels you control, such as your website and social media. Record the withdrawal and its date in the patient record. Photos taken for the patient's care stay in the record under your normal retention policy. Copies already shared by others may not be recoverable.
Where MERIDIQ fits
In MERIDIQ's patient records, before-and-after photos are stored with each patient's record rather than on a phone, alongside treatment notes and digitally signed consent forms. Access is role-based and activity is logged, and patient files can only be exported one client at a time by someone with access to that client, as our FAQ explains.
If you want to try the comparison view first, our free before-and-after image slider works in the browser and does not store uploaded images. The same feature is available inside the record, so you can build the comparison for the patient where the photos already live. See how it fits a small clinic on our page for aesthetic clinic software.
This article is general information about UK rules, not legal advice. If you are unsure which lawful basis applies to your clinic, ask your data protection adviser or professional indemnity provider.
Keep clinical photos and consent in one place
Store before-and-after photos, consent forms and treatment notes in the patient record, and test it in your own clinic free for 14 days.
Start your free 14-day trial Book a demoSources
- Information Commissioner's Office, What is special category data?, accessed 5 November 2026.
- Information Commissioner's Office, What are the conditions for processing?, accessed 5 November 2026.
- Nursing and Midwifery Council, The Code: read online, accessed 5 November 2026.
- General Medical Council, Making and using visual and audio recordings of patients: principles, accessed 5 November 2026.
- ASA / CAP, Before and after photos, 5 June 2025.
Read more about patient records
Aesthetic consent forms: what your consent record needs to prove
A signature is not consent on its own. What a UK aesthetic consent record should show, where it usually breaks, and a six-step review for small clinics.
Patient Records and Documentation Requirements for UK Clinics
What UK aesthetic clinics need to record in a patient record: CQC Regulation 17, GMC and NMC guidance, what to document, retention and patients’ right of access.