Cybrial
Let’s talk
Independent design. Ongoing growth.Manchester · Working everywhere

Guide · Building

Before-and-After Photographs: Consent, Not Just Lighting

By Measured 4 October 2026

The most persuasive content a clinic owns is also the only content that can generate a data protection complaint and a professional one from the same photograph.

The short answer

A patient photograph is health data about an identifiable person, which under UK GDPR is special category data and needs an Article 9 condition — in a marketing context that means explicit, specific, freely given consent that the patient can withdraw. So the consent has to name the uses you actually intend, including the website and social media, and you have to be able to produce it years later and honour a withdrawal by taking the image down. Separately, the image itself must not mislead: a before-and-after that is unrepresentative, retouched, or differently lit and posed is a problem whatever the consent says. And where a treatment involves a prescription-only medicine, what you may advertise at all is a stricter question covered in a separate guide here.

Two separate problems that look like one

Clinics tend to treat patient imagery as a single question — "are we allowed to show this?" — and it is actually two, with different answers and different consequences.

The first is about the person in the photograph: do you have a lawful basis to publish an image of an identifiable patient and their treatment. That is data protection, and the complaint comes from the patient or the ICO.

The second is about the claim the photograph makes: does this pair of images give an honest impression of what the treatment typically achieves. That is advertising, and the complaint comes from a competitor, a regulator or a member of the public.

You can satisfy one and fail the other. A perfectly consented photograph that flatters the result through lighting and posing is an advertising problem. A scrupulously honest pair published without adequate consent is a data protection problem. Clinics usually worry about the second and get caught by the first.

A photograph of an identifiable patient, in the context of their treatment, is data concerning health. Under UK GDPR that is special category data, and processing it needs both a lawful basis and a separate Article 9 condition. For marketing use the realistic condition is explicit consent.

Explicit consent is a higher bar than a signature on a treatment form, and the parts clinics get wrong are consistent:

  • It has to be specific about the uses. "Clinical records and training" does not cover your Instagram. Name the channels: website, social media, printed material, paid advertising — and get the ones you actually want.
  • It has to be freely given, which means it cannot be a condition of treatment and it must be as easy to decline as to agree. A consent bundled into the treatment paperwork at the point of payment is weaker than one taken separately.
  • It has to be withdrawable, and the patient has to be told that at the time. Withdrawal means the image comes down — so you need to be able to find every place it was published, which is an argument for keeping a register rather than relying on memory.
  • It has to be recorded and retrievable. If you cannot produce the consent for an image published four years ago, you are in practice unable to demonstrate you had it.
  • It should state how long you intend to use the image, rather than implying for ever.

Two practical points that save the most trouble. Re-consent when the use changes materially — a photograph consented for a website gallery in 2019 was not consented for a paid social campaign in 2026. And treat anonymisation carefully: cropping to the treated area does not always make somebody unidentifiable, especially combined with a location, a date and a treatment name.

This is a web studio summarising where published requirements land on a website. It is not legal advice, and your consent forms are a matter for you, your indemnifier and your professional body.

Making the pair honest

The advertising half is simpler to state and harder to do, because almost every flattering photograph is flattering for a reason.

The principle is that the imagery must not mislead about what the treatment typically achieves. A pair where the lighting, angle, distance, expression, posture or makeup changes between the two shots is doing work the treatment did not do, and the viewer cannot tell which is which.

What a defensible pair looks like:

  • Same camera, same distance, same angle, same lighting, same background. A fixed setup used for every patient makes this automatic rather than a judgement each time.
  • Same expression and posture. A neutral face before and a smile after is not a result.
  • No makeup difference, and no retouching of either image. None at all is the only line that is easy to hold.
  • The interval stated — "twelve weeks after the second session" — and the number of sessions.
  • A representative case rather than the best one you have, or an explicit statement that results vary and this is an individual outcome.
  • Where relevant, the patient's starting point, because a result that depended on it is not typical.

The commercial argument for this is better than the compliance one. A prospective patient has seen a thousand impossible before-and-afters and discounts all of them. A pair that is visibly the same setup, with the interval stated and an honest caveat, is read as credible precisely because it is not spectacular.

And the question this guide does not answer

If the treatment involves a prescription-only medicine, there is a prior question: whether you may advertise it to the public at all, in any form, including with a photograph.

That restriction is stricter than most clinics expect and it catches ordinary behaviour — naming the product, listing it on a price list, running an offer, posting before-and-after images of it.

This page is not going to summarise it further, because the detail is exactly where the risk sits. The clinic website advertising rules guide on this site sets it out, and if your gallery currently shows injectable results labelled with a product name, that is the page to read before you do anything else on this one.

What the search data says

Our figures for this sector are published in full on the healthcare and dental industry page, and they contain a pair worth noticing.

Same volume, same intent, two phrasings, and one is measurably harder than the other.

Those are terms a studio selling to clinics competes for rather than terms your patients search, and they are published so our own market is checkable. The transferable lesson is the one the pairs demonstrate: which exact words you build a page around changes the difficulty more than the size of the market does.

What to check on your own site

  • For every patient image published, can you produce the consent today?
  • Does that consent name the website and social media specifically?
  • Was it taken separately from the treatment paperwork, and could the patient have declined without affecting their treatment?
  • Were they told they can withdraw, and do you know everywhere each image appears so you could act on that?
  • Does any consent predate the use you are now making of the image?
  • Is the before-and-after setup identical — camera, distance, angle, lighting, background, expression?
  • Is anything retouched?
  • Is the interval and the number of sessions stated?
  • Is the case representative, or captioned to say results vary?
  • Does any image show a result from a prescription-only medicine? Read the other guide first.

The first and the last are the two that cause real trouble. The rest is craft.

Sources

Everything this page relies on.

  1. UK GDPR Article 9 (processing of special categories of personal data) and the Information Commissioner's Office guidance on special category data, including data concerning health and the conditions for explicit consent — ico.org.uk, read 4 October 2026.

  2. The advertising principle stated here — that imagery must not mislead about what a treatment typically achieves — is summarised at the level of principle. The current detail sits with the ASA and CAP Code and with your own professional body, and should be read there rather than taken from this page.

  3. Advertising of treatments involving prescription-only medicines is not covered here. See the clinic website advertising rules guide on this site.

  4. This guide summarises published requirements for the purpose of website implementation and is not legal, clinical or regulatory advice. Consent forms and record-keeping are matters for you, your indemnifier and your professional body.

Common questions

Questions people actually search for.

Do we need special consent for patient photographs?

A photograph of an identifiable patient in a treatment context is data concerning health, which is special category data under UK GDPR and needs an Article 9 condition. For marketing that realistically means explicit consent — specific about the channels, freely given, withdrawable, recorded and retrievable. A signature on a treatment form is not that.

We have consent from 2019. Can we use it on social media now?

Only if that consent named those uses. Consent has to be specific, so a form covering clinical records and training does not cover a paid social campaign. Where the use has changed materially, re-consent. And if you cannot produce the consent for an image published four years ago, you are in practice unable to demonstrate you had it.

What makes a before-and-after misleading?

Anything that changes between the two shots except the treatment. Different lighting, angle, distance, expression, posture, makeup, or any retouching. A fixed setup used for every patient makes an honest pair automatic. State the interval and the number of sessions, and either use a representative case or caption clearly that results vary.

Does cropping make a patient unidentifiable?

Not reliably. Cropping to the treated area combined with a location, a date and a treatment name can still identify somebody, particularly in a small town. Treat anonymisation as something to be satisfied about rather than assumed.

Can we show results from injectable treatments?

That is a prior and stricter question than consent. Where a treatment involves a prescription-only medicine there are restrictions on advertising it to the public at all, and they catch naming the product, price lists, offers and before-and-after images. Read the clinic website advertising rules guide on this site before publishing anything of the kind.

Is an honest before-and-after less persuasive?

In our experience the opposite. Prospective patients have seen a great many impossible results and discount them automatically. A pair that is visibly the same setup, with the interval stated and an honest caveat, reads as credible precisely because it is not spectacular.

Could you produce the consent?

Send me your clinic’s gallery. I will tell you which images would be hard to defend on consent, which pairs are doing work the treatment did not do, and which ones need taking down today.

Let’s talk Healthcare and dental