1. Purpose
This policy sets out how the Clinic obtains consent for before-and-after photography, stores clinical images and controls use of images for records, teaching, audit and marketing.
It treats clinical photography as health information and potential special category data under UK GDPR.
2. Sources to verify before adoption
- UK GDPR, Article 5 principles: https://www.legislation.gov.uk/eur/2016/679/article/5
- UK GDPR, Article 6 lawful bases: https://www.legislation.gov.uk/eur/2016/679/article/6
- UK GDPR, Article 9 special category data: https://www.legislation.gov.uk/eur/2016/679/article/9
- UK GDPR, Article 17 right to erasure: https://www.legislation.gov.uk/eur/2016/679/article/17
- Data Protection Act 2018: https://www.legislation.gov.uk/ukpga/2018/12/contents
- ICO, special category data: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/
- ICO, right to erasure: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/
- GMC, Making and using visual and audio recordings of patients: https://www.gmc-uk.org/professional-standards/professional-standards-for-doctors/making-and-using-visual-and-audio-recordings-of-patients
- GMC, Confidentiality: https://www.gmc-uk.org/professional-standards/the-professional-standards/confidentiality
- Department of Health, Review of the Regulation of Cosmetic Interventions: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/192028/Review_of_the_Regulation_of_Cosmetic_Interventions.pdf
3. Scope
This policy applies to:
- before-and-after photographs
- treatment-planning photographs
- wound or complication photographs
- images used in clinical records
- images used for referral, supervision, audit or teaching
- images used for website, social media, print or advertising
- patient withdrawal of image consent
- image deletion requests
- image access control
- unauthorised image use or disclosure
This policy applies to staff-owned phones and cameras as well as Clinic devices. Staff do not store patient images on personal devices.
4. Photography consent process
The Clinic separates procedure consent from photography consent.
4.1 Clinical-record photography
Clinical-record photography is used where it supports assessment, treatment planning, progress review, complication review or continuity of care.
The clinician explains:
- why the image is needed
- what area will be photographed
- where the image will be stored
- who can access it
- whether it forms part of the clinical record
- how long it will be retained
- what happens if the patient refuses
The Clinic records whether the patient agreed or refused. Refusal of non-essential photography does not prevent clinically appropriate care.
4.2 Marketing and advertising photography
Marketing use needs separate explicit consent.
The Clinic does not rely on clinical-record consent for:
- website use
- social media use
- printed marketing
- paid advertising
- before-and-after gallery use
- third-party platform use
- training material shared outside the Clinic
The consent record states the specific uses the patient agreed to. The Clinic does not bundle marketing image consent into procedure consent.
4.3 Special category data wording
UK GDPR Article 9 says processing of "data concerning health" is prohibited unless an Article 9 condition applies.
Where the Clinic relies on explicit consent for marketing images, Article 9(2)(a) says "the data subject has given explicit consent to the processing of those personal data for one or more specified purposes".
The Clinic verifies the current Article 9 wording and the relevant Data Protection Act 2018 condition before adoption.
5. Image capture and storage
The Clinic uses approved devices, approved storage and controlled access.
5.1 Capture standards
Staff record:
- patient identity
- date
- treatment area
- image purpose
- photographer
- device used
- consent status
- any requested restrictions
Images are taken respectfully. Staff explain positioning, privacy and what will be visible before taking an image.
5.2 Storage and access control
The Clinic stores clinical images in the approved clinical record or secure image store.
The local procedure covers:
- access by role
- upload timing
- deletion from capture device after upload
- encryption or secure storage
- audit trail
- backups
- sharing rules
- retention period
- access review
Staff do not send patient images through personal messaging apps, personal email accounts or unapproved cloud storage.
5.3 Withdrawal and deletion
Patients may withdraw consent for optional uses such as marketing images.
The Clinic records:
- date of withdrawal
- image uses affected
- platforms or materials to update
- action taken
- any lawful reason the image must remain in the clinical record
- patient communication
Where a patient requests deletion, Staff follow the Clinic's data-protection procedure and record the Article 17 decision.
6. Breach and unauthorised use response
If Staff identify unauthorised image access, loss, disclosure or use, they record an incident immediately.
The Registered Manager and data-protection lead:
- contain the breach
- preserve evidence
- identify images and patients affected
- assess risk to patients
- decide whether ICO notification is required
- decide whether patient notification is required
- remove unauthorised marketing or social media use
- record action taken
- assign improvement actions
The Clinic does not wait for a complaint before removing unauthorised image use.
7. Responsibilities
- Registered Manager: owns this policy, ensures data-protection governance and signs off annual review.
- Consultant: decides when clinical photography is clinically needed and reviews image use for complex cases.
- Aesthetic Practitioner: obtains image consent, records restrictions and uses images only for approved purposes.
- Clinic Nurse: supports respectful image capture and secure upload where within role.
- Data-protection lead: manages access controls, erasure decisions, breach assessment and ICO contact where appointed.
- Administration and marketing staff: use patient images only where explicit consent and approved copy are recorded.
- All staff: report image misuse, device loss and unauthorised disclosure immediately.
8. Recording requirements
The Clinic keeps the following records:
- image consent form
- clinical reason for photography
- image purpose
- image storage location
- access permissions
- marketing-use consent
- withdrawal of consent
- deletion or retention decision
- image sharing record
- breach assessment
- ICO notification decision
- patient notification decision
- improvement action record
Records are kept in the clinical record or governance record according to local procedure.
9. Audit cadence
The Clinic uses the following Verivius default audit rhythm unless current source material requires a different rhythm:
- Monthly: the Registered Manager reviews open image-consent issues, withdrawal requests and image incidents.
- Quarterly: the data-protection lead audits image access, marketing image consent and storage controls.
- Annually: the Clinic reviews this policy against current UK GDPR, ICO, GMC and CQC source material.
Audit findings are recorded as improvement actions with an owner and review date.
10. Version control and review date
The Clinic keeps a controlled copy of this policy. The footer or document-control table records:
- policy owner
- version number
- date approved
- next review date
- changes made since the last version
- source material checked during the review
11. Related records
- Image consent form
- Clinical photography log
- Marketing image register
- Data protection policy
- Subject access and erasure request log
- Incident register
- Complaint register
- Aesthetic procedure safety policy
- Cosmetic consent and cooling-off period policy
- Improvement action register
Review cadence: annual or on regulatory change, whichever sooner. Owner: Registered Manager.