Before-and-After Photos and GDPR: A Guide for Clinics

Are photos health data?

A photo of a face is personal data. When it is taken as part of a treatment and stored with the treatment that was done, it tells something about the patient's health and care, so it is health data. That is a special category under Article 9 of the GDPR, and processing it is prohibited except in the cases the GDPR lists.

An ordinary photo is not automatically biometric data. It becomes biometric only when it is processed with specific technical means that allow a person to be uniquely identified (GDPR Recital 51).

Two purposes, two consents

Documentation: before-and-after photos are taken to track results and document the treatment. The legal basis is the provision of health care (GDPR Article 9(2)(h)), and the photos are part of the patient's medical record.

Marketing: publishing on your website, Instagram, in ads or in lectures is a different purpose. It needs the patient's explicit consent (Article 9(2)(a)). That consent must be freely given, so the treatment cannot depend on it, and clearly separate from other text (Article 7).

Which photos: from which treatment and visit
Where they will appear: website, social media, paid ads, professional lectures
Whether the face will be visible, or the photo cropped or masked
How long the photos will be used
How the patient can withdraw consent and what happens then
Date and signature, stored with the photos they cover

Withdrawing must be as easy as giving consent (Article 7(3)). When a patient withdraws, remove the photos from your channels and stop using them. Tell patients up front that a post others have already shared or saved cannot be fully recalled.

Storage: where photos should not be

On a practitioner's or staff member's personal phone, especially with automatic sync to a private cloud
In WhatsApp or Viber chats with patients or colleagues
In a shared folder that every employee can open, including those who don't need the photos

The GDPR requires security appropriate to the risk (Article 32): limited access, encryption and storage you know the location of. For clinical photos, in practice that means one place, linked to the patient record, with access only for the roles that need it.

How to take comparable photos

The same background, light and distance every time
The same angles: front, 45° and profile, on both sides
Neutral expression, no make-up or jewellery, hair away from the face
Take the "after" photo once the result has settled, not while there is still swelling

Check that there is consent to publish that exact photo on that exact channel. In the EU, prescription medicines, including botulinum toxin, may not be advertised to the public (in Croatia: Ordinance on the advertising of medicines, Article 7), so don't feature the medicine's name in promotional posts. Rules of the national medical chamber on doctors' advertising apply as well.

How Injectly handles it

In Injectly, photos are stored with the right visit and compared side by side over time. They are kept in private storage in the EU, never on a public web address, and when someone with access opens a photo, it is shown through a temporary link that expires after one hour. Only roles with access to treatment photos can view them.

A photo can only be approved for social media or campaigns when the patient has given image-use consent for that visit. The database checks this, so it can't be skipped by mistake. Approved before-and-after photos can be combined with your clinic logo into a finished image, ready to post.

Frequently asked questions

Can I photograph patients with my own phone?

Better not. Photos on a personal phone are hard to protect, often sync to a private cloud automatically and stay on the device when the person leaves the clinic. Use a clinic device or an app that saves the photo straight to the patient record, not to the phone's gallery.

Do I need separate consent for Instagram?

Yes. Publishing is a different purpose from treatment documentation and needs explicit, separate and voluntary consent. Name the channels (website, social media, ads) and say whether the face will be visible.

What if a patient withdraws consent to publish?

Remove the photos from your channels and stop using them. Photos in the medical record stay, because their basis is the provision of care, not the consent to publish.

Can I publish a photo without the face without consent?

Patients can often be recognised without their face, for example by a tattoo, a mole or jewellery, and the photo still shows their treatment. It is safer to take consent to publish for photos without a face too.

Can I name the product I used in a post?

Prescription medicines such as botulinum toxin may not be advertised to the public in the EU, so don't feature the medicine's name in promotional posts. For other products and doctors' advertising, check the rules of your national medical chamber.

Sources

See it in your clinic

Book a short demo and we will show you how lots, stock and treatment records connect in Injectly.

Book a demo