Clinical photographs sit at the heart of aesthetic practice, and they are some of the most sensitive data a clinic holds. This guide explains, in plain English, what UK GDPR expects of you. It's general information, not legal advice: check the details with your insurer, your professional body or a data protection adviser.
Clinical photos are health data
A photograph that identifies a person and is taken as part of their treatment is personal data. Because it is about their health, it is also special category data under Article 9 of UK GDPR. That means you need two things: a lawful basis under Article 6, and a condition under Article 9.
For photos taken to plan, carry out and review treatment, clinics usually rely on the provision of health care (Article 9(2)(h)), alongside a lawful basis such as contract or legitimate interests. Explicit consent is still essential in practice, because professional standards expect it before you photograph a patient.
Separate clinical use from marketing
Using a patient's photo on your website, Instagram or in a brochure is a different purpose from keeping it in their record. For that, you need explicit, separate, opt-in consent that the patient can withdraw at any time. Don't bundle it into the treatment consent, and record exactly what they agreed to: which photos, where, and whether their face can be shown.
What a good consent record shows
- Who agreed, and when
- The exact wording they saw, including its version
- What they agreed to: clinical record only, teaching, or marketing
- A signature that can't be quietly edited afterwards
- When consent was withdrawn, if it was
In HonestFace, each consent is signed on the iPad and sealed at that moment, so any later change would show. Every version of your wording is kept, and the activity log records who viewed or changed the record.
Keep photos secure, and know where they are
UK GDPR requires "appropriate technical and organisational measures". For photos of patients' faces, that means encryption, access limited to the people who need it, and knowing exactly where every copy lives. Photos spread across personal phones and messaging apps fail every one of those tests.
How long to keep them
Photos are part of the clinical record, so keep them for as long as you keep the rest of the record. Many clinics follow the retention periods in the NHS Records Management Code of Practice, such as eight years after the last treatment for adults. Your insurer may ask for longer. Decide on a policy, write it down and apply it consistently.
Patients' rights
Patients can ask for a copy of their data, including photos (a subject access request), usually within one month. They can also ask you to correct or restrict it. You should be able to find and export everything about one patient quickly. HonestFace exports a patient's full record, photos included, in open formats.
Register with the ICO
Most organisations that process personal data must pay the data protection fee to the Information Commissioner's Office. If your clinic hasn't, it's quick to do online at ico.org.uk.
A short checklist
- Photograph only with consent recorded in the patient's file
- Ask separately, and explicitly, before any marketing use
- Store photos encrypted, away from personal devices
- Give every team member their own sign-in
- Set and follow a retention period
- Be ready to export one patient's data within a month