1. What the regulation says
Systems or processes must be established and operated effectively to ensure compliance with the requirements in this Part. (Reg 17(1): the umbrella duty)
assess, monitor and improve the quality and safety of the services provided in the carrying on of the regulated activity (including the quality of the experience of service users in receiving those services) ... assess, monitor and mitigate the risks relating to the health, safety and welfare of service users and others who may be at risk which arise from the carrying on of the regulated activity. (Reg 17(2)(a) and (b): quality and risk)
maintain securely an accurate, complete and contemporaneous record in respect of each service user, including a record of the care and treatment provided to the service user and of decisions taken in relation to the care and treatment provided. (Reg 17(2)(c): accurate service-user record)
The full text of the regulation is at https://www.legislation.gov.uk/uksi/2014/2936/regulation/17. The data-protection duties that govern clinical images sit in the UK GDPR and the Data Protection Act 2018; their full text is at https://www.legislation.gov.uk/eur/2016/679/contents and https://www.legislation.gov.uk/ukpga/2018/12/contents. Where this policy and the regulation diverge, the regulation wins.
2. Plain-English summary
You have to run effective systems and processes to comply with everything else in Part 3. The regulation lists six things those systems must enable in particular: quality assessment and improvement, risk management, accurate service-user records, accurate employment and management records, seeking and acting on feedback, and continually evaluating and improving how you process all this. If CQC requests a written report on quality and risk plus your improvement plans, you have 28 days from the day after the request.
Clinical photography is health information and potential special category data under the UK GDPR. Good governance of those images means consent is obtained and recorded, storage and access are controlled, and use, withdrawal, deletion and breach are all managed against current data-protection law and professional image guidance.
3. Purpose
This policy sets out how the Clinic obtains consent for before-and-after photography, stores clinical images and controls use of images for records, teaching, audit and marketing.
It treats clinical photography as health information and potential special category data under UK GDPR.
4. Scope
This policy applies to:
- before-and-after photographs
- treatment-planning photographs
- wound or complication photographs
- images used in clinical records
- images used for referral, supervision, audit or teaching
- images used for website, social media, print or advertising
- patient withdrawal of image consent
- image deletion requests
- image access control
- unauthorised image use or disclosure
This policy applies to staff-owned phones and cameras as well as Clinic devices. Staff do not store patient images on personal devices.
5. Photography consent process
The Clinic separates procedure consent from photography consent.
5.1 Clinical-record photography
Clinical-record photography is used where it supports assessment, treatment planning, progress review, complication review or continuity of care.
The clinician explains:
- why the image is needed
- what area will be photographed
- where the image will be stored
- who can access it
- whether it forms part of the clinical record
- how long it will be retained
- what happens if the patient refuses
The Clinic records whether the patient agreed or refused. Refusal of non-essential photography does not prevent clinically appropriate care.
5.2 Marketing and advertising photography
Marketing use needs separate explicit consent.
The Clinic does not rely on clinical-record consent for:
- website use
- social media use
- printed marketing
- paid advertising
- before-and-after gallery use
- third-party platform use
- training material shared outside the Clinic
The consent record states the specific uses the patient agreed to. The Clinic does not bundle marketing image consent into procedure consent.
5.3 Special category data wording
UK GDPR Article 9 says processing of "data concerning health" is prohibited unless an Article 9 condition applies.
Where the Clinic relies on explicit consent for marketing images, Article 9(2)(a) says "the data subject has given explicit consent to the processing of those personal data for one or more specified purposes".
The Clinic verifies the current Article 9 wording and the relevant Data Protection Act 2018 condition before adoption.
6. Image capture and storage
The Clinic uses approved devices, approved storage and controlled access.
6.1 Capture standards
Staff record:
- patient identity
- date
- treatment area
- image purpose
- photographer
- device used
- consent status
- any requested restrictions
Images are taken respectfully. Staff explain positioning, privacy and what will be visible before taking an image.
6.2 Storage and access control
The Clinic stores clinical images in the approved clinical record or secure image store.
The local procedure covers:
- access by role
- upload timing
- deletion from capture device after upload
- encryption or secure storage
- audit trail
- backups
- sharing rules
- retention period
- access review
Staff do not send patient images through personal messaging apps, personal email accounts or unapproved cloud storage.
6.3 Withdrawal and deletion
Patients may withdraw consent for optional uses such as marketing images.
The Clinic records:
- date of withdrawal
- image uses affected
- platforms or materials to update
- action taken
- any lawful reason the image must remain in the clinical record
- patient communication
Where a patient requests deletion, Staff follow the Clinic's data-protection procedure and record the Article 17 decision.
7. Breach and unauthorised use response
If Staff identify unauthorised image access, loss, disclosure or use, they record an incident immediately.
The Registered Manager and data-protection lead:
- contain the breach
- preserve evidence
- identify images and patients affected
- assess risk to patients
- decide whether ICO notification is required
- decide whether patient notification is required
- remove unauthorised marketing or social media use
- record action taken
- assign improvement actions
The Clinic does not wait for a complaint before removing unauthorised image use.
8. Responsibilities
- Registered Manager: owns this policy, ensures data-protection governance and signs off annual review.
- Consultant: decides when clinical photography is clinically needed and reviews image use for complex cases.
- Aesthetic Practitioner: obtains image consent, records restrictions and uses images only for approved purposes.
- Clinic Nurse: supports respectful image capture and secure upload where within role.
- Data-protection lead: manages access controls, erasure decisions, breach assessment and ICO contact where appointed.
- Administration and marketing staff: use patient images only where explicit consent and approved copy are recorded.
- All staff: report image misuse, device loss and unauthorised disclosure immediately.
9. Recording requirements
The Clinic keeps the following records:
- image consent form
- clinical reason for photography
- image purpose
- image storage location
- access permissions
- marketing-use consent
- withdrawal of consent
- deletion or retention decision
- image sharing record
- breach assessment
- ICO notification decision
- patient notification decision
- improvement action record
Records are kept in the clinical record or governance record according to local procedure.
10. Audit cadence
The Clinic uses the following Verivius default audit rhythm unless current source material requires a different rhythm:
- Monthly: the Registered Manager reviews open image-consent issues, withdrawal requests and image incidents.
- Quarterly: the data-protection lead audits image access, marketing image consent and storage controls.
- Annually: the Clinic reviews this policy against current UK GDPR, ICO, GMC and CQC source material.
Audit findings are recorded as improvement actions with an owner and review date.
11. Version control and review date
The Clinic keeps a controlled copy of this policy. The footer or document-control table records:
- policy owner
- version number
- date approved
- next review date
- changes made since the last version
- source material checked during the review
12. Related records
- Image consent form
- Clinical photography log
- Marketing image register
- Data protection policy
- Subject access and erasure request log
- Incident register
- Complaint register
- Aesthetic procedure safety policy
- Cosmetic consent and cooling-off period policy
- Improvement action register
Review cadence: annual or on regulatory change, whichever sooner. Owner: Registered Manager.
13. Sources and further reading
This template is based on CQC's guidance for providers and managers, the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, and other topic-specific legislation and guidance listed below. It is a starting point for adaptation, not a substitute for legal, clinical, HR, safeguarding or specialist professional advice.
- CQC Regulation 17: Good governance
- UK GDPR (Articles 5, 6, 9 and 17): https://www.legislation.gov.uk/eur/2016/679/contents
- Data Protection Act 2018: https://www.legislation.gov.uk/ukpga/2018/12/contents
- ICO, special category data guidance
- ICO, right to erasure guidance
- ICO personal data breach reporting guidance
- GMC, Making and using visual and audio recordings of patients
- GMC, Confidentiality
- Professional-body clinical image and data-protection guidance
- NHS Data Security and Protection Toolkit where applicable
- Department of Health, Review of the Regulation of Cosmetic Interventions (the Keogh review) (https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/192028/Review_of_the_Regulation_of_Cosmetic_Interventions.pdf)
14. When to seek further advice
Seek specialist advice where the issue involves serious harm, safeguarding, deprivation of liberty, restraint, children, professional misconduct, controlled drugs, radiation, termination of pregnancy, infection outbreak, water safety, employment dismissal, DBS barring referral, or regulatory enforcement.
15. Document control
| Version | Date | Author | Changes |
|---|---|---|---|
| v1 | 2026-06-10 | Verivius (sample) | Conformed to the Verivius policy standard: added statutory anchor, verbatim Reg 17 quotes, plain-English summary, standard sources, advice and document-control blocks; existing operational sections preserved and renumbered. |
This sample policy template was issued by Verivius. It is a template, not a substitute for legal advice or the tenant's own policy-development process. Where this template and live law or regulator guidance diverge, the live source wins.