The Photograph in the Folder: Consent, Privacy and Your Face at a UK Aesthetic Clinic

A camera in an aesthetic clinic is not automatically a warning sign. Photographs can help a practitioner track change, plan treatment safely and keep an accurate clinical record. But a photograph of your face is also personal data, and when it is used for a clinic’s website or social media, it becomes something else entirely: marketing material. The distinction matters, and it is one that patients are entitled to understand before they agree.

Two cameras, two purposes

Clinical photography and marketing photography may use the same camera, but they do not serve the same purpose. A clinical image is taken for your record: to compare before and after, to monitor a concern, or to document a procedure. A marketing image is taken to promote the clinic, usually on its website, Instagram, Facebook, TikTok or in advertising.

Consent for one is not consent for the other. A form that bundles clinical photography and social media use into a single signature is worth pausing over. A well-run clinic should be able to explain, in plain language, why an image is being taken, where it will be kept, who will see it and whether it will be published. If those answers are vague, it is reasonable to ask for clarity before the camera comes out.

What UK data law expects

Under the UK GDPR and the Data Protection Act 2018, a photograph of an identifiable person is personal data. Clinical images may also reveal health information, which receives additional protection as special category data. The law does not ban clinics from taking or using photographs, but it does require a lawful basis, fairness and transparency.

For marketing use, consent should be specific, informed and unambiguous. In practice, that means an opt-in rather than a pre-ticked box, a clear explanation of what will be published and where, and an easy way to withdraw. A clinic’s privacy notice should explain how images are stored, how long they are kept and who they may be shared with. This article is general guidance rather than legal advice, but the principle is straightforward: your face is your data, and you are entitled to ask how it is handled.

Identifiable, anonymised and in between

Some clinics offer to crop or blur images to protect identity. That can be helpful, but it is not always as anonymous as it sounds. Distinguishing features, tattoos, jewellery, backgrounds, nail colour or a distinctive hairstyle can make a person recognisable even when the eyes are hidden. A caption or a clinic’s tagging habits can also identify someone indirectly.

If anonymity matters to you, ask to see the final image before it is published. Ask whether your name, initials, social media handle or treatment date will appear. Ask whether the image will be used in stories, advertisements or third-party promotions. If you would not be comfortable with a family member or colleague recognising you, say so plainly.

Questions to ask before the shutter clicks

You do not need to be confrontational to be careful. A short, calm list of questions is usually enough:

• Is this photograph for my clinical record, for marketing, or both?
• Can I see the consent wording before I sign?
• Exactly where will the image appear, and on which accounts or platforms?
• Will my name, handle or any identifying detail be used?
• Will the image be cropped, filtered or otherwise edited?
• Who inside and outside the clinic may access or share it?
• How long will it be kept, and how will it be deleted?
• How do I withdraw consent, and what happens if I do?
• Can I review the final image before publication?

A clinic that expects these questions will answer them without defensiveness. A clinic that brushes them aside is giving you useful information about how it treats patient boundaries.

Withdrawal is part of consent

Consent for marketing is not a lifetime commitment. You can withdraw it, ideally in writing, and the clinic should act without undue delay. If an image has already been published, ask for it to be removed from the clinic’s own channels and confirm when that has happened. Keep a copy of your request.

Withdrawal does not usually affect processing that has already taken place, and data protection rights such as erasure are not absolute. A clinic may need to retain certain records for legal or clinical reasons. But a marketing consent should be genuinely revocable, and a patient should not be made to feel awkward for changing their mind. If an image has been shared by others, the clinic can remove its own post but cannot always control reshares; a sensible policy should acknowledge that limit rather than promise more than it can deliver.

When the photograph is part of your record

Clinical photography is different from marketing, but it is not beyond question. You can ask why a photograph is needed, who will have access and how long it will be retained. You also have rights to access your personal data and to ask for inaccurate information to be corrected. Refusing marketing use should never affect the care you receive. If you decline, say so clearly and ask for your decision to be recorded.

A calm position

Before-and-after images can be genuinely useful, but they are also selected, framed and presented. You are not obliged to participate in that culture. A professional clinic should treat a refusal with the same courtesy as a yes. Consent should be specific, understood and revocable; anything less is not really consent. Asking questions is not suspicious. It is simply good consumer care, and it is exactly what a considered UK aesthetic clinic should expect.