Before and After Photos Consent in Aesthetic Clinics: Storage and Marketing Rules

Before and after photos consent in an aesthetic clinic should be two separate decisions: one consent for taking photos as part of the medical record, and a second, optional consent for using them in marketing. Store the photos in the clinic's system rather than on staff phones, take them the same way every time, and treat them as health data. In the UAE and Saudi Arabia that means following data protection law and your health regulator's advertising rules before a single image goes on Instagram.

Ask to see a nurse's phone in almost any aesthetic clinic in Dubai or Riyadh and you will likely find hundreds of patient faces, mixed in with family photos and backed up to a personal cloud. Nobody planned it. The phone was in her pocket and the treatment room had good light. That is the problem this guide tries to fix.

This article is general guidance for clinic operators, not legal advice. Rules differ by emirate and country and they change. Confirm your obligations with your health regulator (DHA, DOH or MOH), SDAIA in Saudi Arabia, or a lawyer.

Why do before and after photos matter clinically?

Before marketing, remember why the photos exist: they are part of the medical record.

• They show progress. A filler patient who says "nothing changed" often changes her mind when she sees the before photo.
• They support treatment plans. Across a laser or microneedling series, they show whether the plan is working.
• They protect the clinic. If a patient complains, a dated, standardised photo is your best record of the starting point.
• They help the next practitioner understand what was done.

Clinical photos are not optional extras. Marketing use is.

How should you take before and after photos? A standard protocol

Photos taken differently each time are useless for comparison and misleading in marketing, because angle and light change how a result looks. Agree a protocol with your medical director and stick to it.

1. One place. A fixed spot with a plain, neutral background. Not the treatment chair by the window.
2. Same lighting. Fixed lights in fixed positions, no overhead shadows, no daylight.
3. Same distance and height. Mark the floor for the patient and the camera.
4. Standard angles. For faces: front, both profiles and both three-quarter views, plus close-ups of the treatment area.
5. Neutral expression, no makeup. Hair back, jewellery off. Some treatments also need an animated view, such as frowning for anti-wrinkle injections.
6. A clinic device. A clinic-owned camera or tablet, never a personal phone.
7. Upload straight to the patient file, labelled with date, treatment and view, then delete from the device.

What consent do you need for before and after photos?

Two separate consents, not one line buried in the treatment form.

Consent 1: clinical photography. For the medical record, treatment planning and follow-up, explaining who sees the photos (the treating team) and how they are stored. It can sit inside the treatment consent, as long as it is clear.

Consent 2: marketing use. A separate, optional form. Saying no must not affect her treatment. It should spell out:

• Where the photos may appear: website, Instagram, TikTok, printed brochures, ads
• Whether her face will be shown, blurred or cropped
• Whether any identifying details, such as her name, age or tattoos, will be used
• How long the clinic will use them
• How to withdraw consent, and what happens when she does

Ask for marketing consent at the follow-up, not on treatment day. A patient at her first filler appointment cannot judge whether she wants her face on your Instagram. Once she has seen the result, she can.

Can a patient withdraw consent for photos?

Yes, and you need a process for it. When a patient withdraws marketing consent, remove her photos from your website and future posts and ads, and record the date in her file. Be honest about the limits: you cannot recall a printed brochure or a post someone else has shared, and your form should say so. Her clinical photos stay in the medical record.

Where should before and after photos be stored?

In the clinic system, attached to the patient record. Not on phones, not in WhatsApp, not in a shared folder called "results".

• Staff personal phones
  Why it is a problem or not: Mixed with family photos, backed up to personal clouds, leaves with the employee
• WhatsApp groups
  Why it is a problem or not: Copies on every member's phone, no access control, no audit
• Shared drive folders
  Why it is a problem or not: Easy to over-share, hard to link to the right patient
• Clinic management system
  Why it is a problem or not: Linked to the patient record, access limited by role, stays with the clinic

In the UAE, location matters too. Under Federal Law No. 2 of 2019 on ICT in health fields, health data on services provided in the UAE must by default be stored and processed inside the UAE, with limited exceptions, so ask any software provider where images are hosted. Our guide to aesthetic clinic management and automation covers what else to look for.

WAJ keeps notes and history in each client's record, so every visit sits in one place rather than across five phones, and WAJ's clinic product, Nabd, is built for clinics. Whatever you use, the principle holds: the photo lives with the patient record, and only those who need it can see it.

What do UAE and Saudi rules say about using patient photos in marketing?

Patient photos from a medical treatment are health data, which limits what you can do with them.

Saudi Arabia. The PDPL has been fully enforceable since 14 September 2024, regulated by SDAIA. Health data is sensitive data and cannot be used for marketing. Direct marketing needs opt-in consent with an easy way to opt out, and fines can reach SAR 5 million. Before using any patient image in Saudi marketing, take specific legal advice rather than relying on a general consent form.

UAE. The federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and the health data law above both apply, alongside rules from your emirate's health regulator.

Advertising rules. Medical advertising is regulated separately. The DHA and the MOH both have medical advertising rules, which can cover before-and-after images, claims about results and who may advertise procedures. Injectables and medical lasers are medical acts under DHA rules, for licensed clinics and qualified practitioners only, so advertising them is not like advertising a blow-dry. Check your regulator's current rules, and whether ads need approval, before you publish.

Paid influencer advertising also needs its own licence: GCAM's "Mawthooq" in Saudi Arabia, and a UAE Media Council licence or permit in the UAE. Rules change, so check current requirements.

For clinic content more broadly, see our guide to social media marketing for salons and clinics.

Should you blur faces in before and after photos?

Often, yes. Cropping to the treated area or blurring the eyes makes the patient harder to identify, and many will only agree to marketing use on that basis, so offer it as a choice on the form. It does not remove the need for consent: a distinctive jawline or a visible tattoo can still identify someone.

Before and after photos: do and don't

• Use a clinic-owned device and a fixed photo spot
  Don't: Use personal phones
• Take two separate consents: clinical and marketing
  Don't: Hide marketing consent inside the treatment form
• Ask for marketing consent after the result
  Don't: Ask on the day of the first treatment
• Store photos in the patient record
  Don't: Share photos in WhatsApp groups
• Use the same light, angle and distance every time
  Don't: Change lighting to make results look better
• Crop or blur on request
  Don't: Assume blurring removes the need for consent
• Check DHA, DOH or MOH advertising rules
  Don't: Copy what a competitor posts
• Record withdrawals and act on them
  Don't: Keep using photos after consent is withdrawn

FAQ

Do I need separate consent for before and after photos used in marketing?

Yes. Clinical photography and marketing are different purposes. Keep marketing consent separate and optional.

Can staff take patient photos on their own phones?

They should not. Use a clinic device, upload to the patient record, then delete from the device.

Can I use patient photos in marketing in Saudi Arabia?

Health data is sensitive under the Saudi PDPL and cannot be used for marketing. Get specific legal advice first.

Does blurring a face make the photo anonymous?

Not always. Tattoos or distinctive features can still identify someone, so you still need consent.

What happens if a patient withdraws consent?

Remove her photos from your website and future marketing, record the withdrawal, and keep the clinical photos in her record.

If you want patient records, notes and treatment history in one system instead of on staff phones, book a free WAJ demo: waj.ai/demo.