This article is written for clinic owners and practice managers, not lawyers, and it isn't legal advice. Requirements for patient consent and privacy vary by country, state or province, and specialty board, so always confirm the specifics that apply to your practice with qualified counsel. What follows is the practical baseline most well-run clinics build their process around.

Treatment consent is not the same as marketing consent

Nearly every clinic already collects consent to treat a patient and, often, consent to photograph for clinical records. That is a different document from consent to use a patient's photo in marketing — on your website, on social media, in an ad, or on a printed brochure. Treat these as two separate permissions, because in most jurisdictions they legally are, and conflating them is one of the most common (and easily avoidable) mistakes clinics make.

What a solid marketing consent form actually needs to cover

  • What will be shown — specific photos, or a general category of photos from the same treatment.
  • Where it will be shown — website, specific social platforms, print, ads. Be specific rather than blanket if you can, since some patients are comfortable with one and not another.
  • Whether the patient will be identifiable — full face versus a cropped or partial image — and what name or details, if any, will accompany it.
  • Duration and revocability — how long the consent lasts, and a clear, easy process for the patient to withdraw it later.
  • Signature and date, kept on file separately from clinical notes, so it can be produced if ever questioned.

De-identification is a real option, and it's underused

Many of the most persuasive before-and-after cases don't need to show a recognizable face at all. Cropping to the treatment area, using an angle that doesn't include identifying features, or blurring the eyes are all legitimate ways to use a genuinely compelling case while reducing the privacy exposure for the patient — and reducing your own risk if consent is ever unclear. When a case is dramatic enough to be worth sharing but a patient is hesitant about being identifiable, de-identifying the photo is often a better answer than not using it at all.

Make declining genuinely easy

Patients should never feel that declining to be photographed, or declining to have their photo used in marketing, will affect the quality of their care. Say this explicitly, in the form and out loud, and mean it. Clinics that get a reputation — even informally — for pressuring patients toward marketing consent tend to see it damage trust well beyond the patients directly involved.

Keep records as carefully as you keep the photos

If a consent is ever questioned, the photo itself proves nothing — the signed form does. Store consent records in a way that's easy to retrieve per patient, and set a process for what happens to a photo if consent is later withdrawn (remove it from active use promptly, and document that you did).

The practical upshot

None of this needs to slow your marketing down. A short, specific, well-designed consent form, collected at the same time as treatment consent, with a simple internal process for storage and withdrawal, covers the overwhelming majority of situations a typical clinic will face. The clinics that get into trouble are almost never the ones with an imperfect form — they're the ones with no form at all.