Consent and Records: What Protects the Patient Also Protects You
Consent in aesthetic practice is widely treated as a form to be signed before treatment. It is not a form; it is a conversation, and the form is only evidence that the conversation took place. Where complaints escalate, the question is almost never whether a signature exists — it is whether the patient understood what they were agreeing to.
What makes consent informed
Elective cosmetic treatment carries a higher standard than clinically necessary care, for an obvious reason: nobody needs it. A patient who declines loses nothing medically, so their decision must be genuinely theirs.
A defensible conversation covers what is proposed and why it suits this patient, what result is realistically achievable and what is not, what recovery involves in practical terms, the risks — including the rare serious ones, named rather than implied — the alternatives including doing nothing, what happens if the result disappoints, and what it costs, in total.
Two things are worth stating explicitly because they are so often skipped. Serious risks must be named even when unlikely: for injectables that means vascular occlusion, skin necrosis and, in the relevant regions, visual loss. And consent must be taken with enough time to think — a patient signing a form while sitting in the treatment chair with product already drawn up has not made a considered decision.
Where consumer law sits alongside clinical duty
Aesthetic treatment sold to a member of the public sits awkwardly between clinical and consumer law. The Consumer Rights Directive carves healthcare out of much of its scope, and whether a given cosmetic treatment counts as healthcare is contested and answered differently across member states. But the unfair commercial practices rules and the information duties on service providers apply regardless, and national consumer law frequently goes further. Whichever way the classification falls, the practical duty is the same: the price presented must be the total the patient will pay, inclusive of taxes and unavoidable charges, and it must be given clearly before commitment rather than at the counter afterwards [2].
The practical implications are mundane and frequently ignored: no surprise supplements after treatment, no "from" prices that nobody actually pays, and clarity about what a follow-up or a correction will cost. Where treatment is arranged at a distance — booked and paid online — additional information duties apply.
Who may perform the treatment is a separate question with its own legal framework, and it varies by country. Professional qualification and scope of practice are national matters within an EU-wide recognition framework, and "I trained on a course" is not the same as "I am permitted to do this here" [3].
Photographs and data
Clinical photographs are health data about an identifiable person, and they attract the strictest protections under EU data protection law. Two separate things are involved and they must never share a tick box — but they are not two consents. Images taken as part of the clinical record are processed in order to provide healthcare, which normally rests on Article 9(2)(h) with Article 6 rather than on consent; that is precisely why a patient cannot simply withdraw them from a record you are legally required to keep. Using any image for marketing is different, and does require the patient's separate, explicit consent under Article 9(2)(a). Confirm the correct basis for your own jurisdiction — this is among the most commonly misapplied points in aesthetic practice [1].
Marketing consent must be explicit as well as specific and freely given — an unambiguous, affirmative, preferably written statement, never inferred from a patient's good mood on the day — and as easy to withdraw as it was to give. It cannot be a condition of treatment, and it cannot be assumed from a patient who was happy at the time. Withdrawal has to be honoured in practice, which in practice means clinical images must never be taken or stored on a personal phone. Use a clinic-controlled device and a system with access controls and an audit trail, under a written processing agreement with the provider. Personal-phone photography backed up to a personal cloud account is the most common serious data-protection failure in aesthetic practice, and it makes an image impossible to delete on request.
Records should be kept securely and remain accessible to the patient on request. Retention, however, is not the clinic's choice: medical record retention periods are set by national law and usually run for many years after the last contact. Deleting early is not data minimisation — it breaches a retention duty and destroys the evidence you would need to answer a complaint.
What a defensible record contains
- What the patient asked for, in their words.
- What you assessed and what you advised, including anything you recommended against.
- The risks discussed and the questions the patient asked.
- The product used with batch and lot numbers, and the areas treated.
- Aftercare given, and how the patient can reach you.
- Any decision to decline, and the reason.
The last of these is the one most often omitted and the most useful. A record showing that you considered treating and chose not to demonstrates judgement in a way no consent form can.
The professional point
Good documentation is not defensive paperwork; it is the same act as good practice, written down. The practitioner who explains thoroughly, prices honestly and records what happened will rarely need the record — and will be glad of it on the one occasion they do.