Using before-and-after photos on your clinic website: consent and good practice (not legal advice)

Before-and-after photos show patients what a treatment involves in a way words can't. They are also personal images of real people, often taken at a vulnerable moment. Using them well takes clear consent, honest photography and careful storage.

This guide covers good practice for clinics in the USA and Pakistan. Rules differ by country, by state or province, and by professional regulator, so treat it as a starting point for a conversation with your own advisers.

Get written consent that names each use

A quick "Is it OK if we use your photos?" at the end of an appointment is not enough. Patients may agree without picturing their face on your Instagram grid.

Good consent is written, specific and separate from general treatment consent. The form should say:

• Which photos: the treatment, date and body area.
• Where they will appear: your website, your own social media accounts, printed brochures, in-clinic screens, paid ads. Let patients tick each one separately.
• Whether they will be identifiable: full face, partial face with eyes covered, or body area only.
• How long you will use them, or until when.
• How to withdraw consent and what happens when they do.
• That saying no won't affect their care.

Ask when the patient has time to read, not while they are lying on the treatment bed. Offer a copy of what they signed.

A note for US covered entities

If your practice is a HIPAA covered entity, identifiable patient photos are generally protected health information. The HIPAA Privacy Rule requires a written authorization for uses and disclosures for marketing (opens in a new tab), with narrow exceptions, and a valid authorization must include specific elements such as a description of the information, the purpose, and an expiration date or event. The US Department of Health and Human Services has guidance on marketing under HIPAA (opens in a new tab). Your consent form may need to meet those requirements, so have it reviewed.

Record consent so you can find it later

Consent you can't find is consent you can't prove. For every photo set you publish, you should be able to answer in under a minute: who agreed, when, to what, and on which form.

Keep a simple record for each patient:

Link the record to the photos themselves, so nobody publishes a picture without its consent attached.

Make withdrawing consent easy

Patients can change their minds. A new job, a new relationship or simply feeling differently a year later are all good reasons.

Plan for withdrawal before it happens:

• Tell patients how in the form: an email address, a phone call or a message to reception.
• Remove photos promptly from your website, your own social media and any active ads.
• Record the date you received the request and the date you removed the photos.
• Be honest about limits. You can remove what you control. You can't always recall printed brochures or copies someone else saved or reshared.

For US covered entities, the HIPAA rule states that an individual may revoke an authorization in writing at any time (opens in a new tab), except to the extent the covered entity has already acted on it.

De-identify with care

Cropping out the face helps, but it doesn't make a photo anonymous by default. People can be recognized by:

• Tattoos, scars and birthmarks.
• Jewelry, nail designs or hairstyles.
• Backgrounds, such as a recognizable room or window view.
• File names and metadata, including dates, locations and device information.
• Captions, like "our lovely patient Ayesha from DHA".

Before publishing, check every image for identifying details, strip metadata, and use neutral file names. For US covered entities, note that HIPAA's de-identification standard lists "full face photographic images and any comparable images" (opens in a new tab) among the identifiers that must be removed under its safe harbor method.

Even for de-identified images, get consent. Patients may recognize themselves, and finding their body on your website without being asked damages trust.

Photograph consistently, edit honestly

A before-and-after comparison is only fair if the only thing that changed is the result of the treatment.

Keep conditions the same:

• Same room, background and lighting.
• Same camera or phone, distance and angle.
• Same pose and facial expression.
• No makeup in either photo, or the same makeup in both.
• Mark the floor and camera position so any team member can repeat the setup.

Edit honestly:

• Cropping, straightening and consistent sizing are fine.
• Covering eyes or identifying marks for privacy is fine.
• Smoothing skin, changing brightness on one photo only, reshaping, or filters are not.

Advertising regulators take this seriously. The US Federal Trade Commission's health products compliance guidance (opens in a new tab) explains that before-and-after images can convey a claim even without words, and that testimonials reporting results more dramatic than people can generally expect are likely to be deceptive, even with a "results not typical" disclaimer. The same thinking is a sensible test for your photos.

Label photos and add clear disclaimers

A photo without context invites patients to assume they will get the same result. Labels set expectations.

For each photo set, show:

• The treatment and, if relevant, the product or technique in general terms.
• Number of sessions.
• Time between the before and after photos.
• A clear note that results vary between individuals and that suitability is assessed at consultation.

Put this text next to the photo, in a readable size, not in a footer. The FTC's endorsement guides FAQ (opens in a new tab) says that if an advertiser can't show an endorser's experience represents what people will generally achieve, the ad must make clear what the generally expected results are.

Choose photos that represent what your patients usually see, not only your single best case. And never use photos from another clinic, a supplier's brochure or stock libraries as if they were your own patients.

Store and control access to photos

Clinical photos should not live on a receptionist's personal phone or in a shared WhatsApp group.

Practical steps:

• Use clinic-owned devices for photography, with a screen lock.
• Move photos off devices to secure clinic storage soon after the appointment, then delete them from the camera roll.
• Limit who can access the originals. Not every team member needs to.
• Keep published versions separate from clinical originals.
• Remove access when a team member leaves.
• Decide how long you keep photos and consent records, and follow that policy.

Rules in Pakistan and elsewhere

Requirements differ by country, and within a country by regulator and profession.

In the USA, relevant sources include the FTC on advertising and endorsements, HHS on HIPAA for covered entities, and state medical boards and state privacy laws, which vary.

In Pakistan, doctors and dentists are regulated by the Pakistan Medical and Dental Council (PM&DC) (opens in a new tab). We could not find a PM&DC document specific to patient photos in advertising, and a national personal data protection law has been under discussion for some time. Rules may also come from provincial bodies. Check with your regulator and a local lawyer on the current position before publishing patient images.

If you practice elsewhere, or treat patients who live abroad, ask your adviser which rules apply.

How Velvet Lead handles galleries

Velvet Lead's clinic website includes a before-and-after gallery that you manage from the admin panel, with a record that the patient consented to their photos being used. It doesn't replace your consent form or legal review, and the website's legal page templates are a starting point, not legal advice.

If galleries matter to your clinic, see how it works for cosmetic surgery practices and hair transplant clinics, or read our guide to med spa website design for how galleries fit on a page that converts.