Before-and-after patient photos: consent and use on social media

A before-and-after photo taken in the consulting room serves to document treatment; publishing it on social media or on the clinic's website is a different purpose, which needs the patient's specific consent for that use. The fact that the patient accepted the clinical photo does not authorise using it in advertising, and they can withdraw their marketing consent whenever they like. The practical approach is to ask for the two consents separately, keep them signed and never mix clinical photos with marketing ones.

Two uses, two purposes

In aesthetic medicine, advanced aesthetics or physiotherapy, the photo is part of follow-up: it lets you compare the treated area between sessions and explain the patient's progress to them. That is the clinical use. Marketing use is another: showing results on Instagram, on the website or in a leaflet to attract other patients.

These are two different purposes and it is best to treat them as such from the start: a photo can be cleared for the first use and not for the second, and most of a clinic's photos never need to leave the patient's record.

Why a photo taken in the consulting room is sensitive data

Under the GDPR, an identifiable person is anyone whose identity can be determined, directly or indirectly, by means including features specific to their physical identity. A photo in which the patient can be recognised is therefore personal data.

In addition, the GDPR defines data concerning health as data relating to the physical or mental health of a person, including the provision of healthcare services, which reveal information about their state of health. A photo taken to document a treatment can reveal exactly that, and Article 9 of the GDPR places data concerning health among the special categories, whose processing it prohibits except in certain cases. For clinical use, one of those exceptions is the provision of healthcare or treatment. For advertising use, a different one fits: that the patient has given explicit consent to the processing of that data for one or more specified purposes, under Article 9.2.a) of the GDPR.

The right to one's own image

On top of data protection there is a separate right. Organic Law 1/1982, on the civil protection of the right to honour, personal and family privacy and one's own image, treats as unlawful interference “the use of a person's name, voice or image for advertising, commercial or similar purposes” (translated from the Spanish).

There is no interference when the holder of the right has given express consent for that purpose. And that consent can be revoked at any time, although the law provides for compensation, where applicable, for the damage caused, including justified expectations. That is why a spoken “yes” on the treatment couch is not enough: you need to be able to show what the patient authorised and for what.

One consent for each thing

The LOPDGDD (Spain's data protection and digital rights law) provides that, when processing is to be based on consent for several purposes, it must be recorded specifically and unequivocally that consent is given for all of them. The GDPR adds that, if consent is given in a written declaration that also concerns other matters, the request must be clearly distinguishable from the other matters. And the controller must be able to demonstrate that the data subject consented.

The simplest way to organise this is to have two documents: a clinical photography authorisation and a marketing use authorisation. The second should make clear, as a minimum:

• which photos will be used (area, sessions, whether the face will be visible or not);
• where they will be published: website, social media, leaflets, presentations;
• whether they will be accompanied by the patient's name or any other detail about them;
• how the patient can withdraw their consent, and what the clinic will do then.

Two more rules. The first: the patient has the right to withdraw consent at any time, and under the GDPR it must be as easy to withdraw consent as to give it. The second: under the LOPDGDD, performance of a contract cannot be made conditional on the patient consenting to the processing of their data for purposes unrelated to the contractual relationship; making treatment conditional on appearing on social media is exactly what must be avoided. The exact wording of the document is for the clinic to decide, ideally with its adviser; how to sign it without paper is covered in signing consents on a tablet.

If the patient is a minor

With minors, take extra care. The LOPDGDD only allows the processing of a minor's data to be based on their own consent when they are over fourteen. And for the image, Organic Law 1/1982 requires the minor to consent personally if their maturity allows it; in all other cases, consent is given in writing by their legal representative, who must notify the Public Prosecutor's Office beforehand. Before publishing a minor's photo, seek advice.

How to organise it day to day

1. Photos taken with a clinic device, not the personal mobile of whoever is treating the patient, and stored on the patient's record.
2. Every photo starts out clinical. It only becomes a marketing photo when there is a signed marketing authorisation.
3. Keep a record of who authorised each photo for marketing and when.
4. If the patient withdraws consent, the photo goes back to being clinical only, and the clinic stops using it and removes it from wherever it has been published.
5. Review what is published from time to time against the authorisations in force.

If you are choosing software to organise this, first go over what clinic management software should have.

How Mi Clínica handles it

Mi Clínica separates clinical photos from marketing ones. Every photo uploaded is private by default, and the record shows with a label whether a photo is private to the clinic or authorised for marketing. To use a patient's photo in marketing, their signed marketing consent is required: it is never inferred from the clinical photo. From each photo's card, the team authorises it for marketing or removes that mark, and to authorise it the program requires the signed marketing consent; if the patient revokes that consent, their marketing photos become private again.

The standard templates include a clinical photography authorisation and a marketing use authorisation, which are signed on the tablet or remotely; they come with generic wording, so the clinic writes their content. The standard consent text already warns that use for educational or marketing purposes requires a specific, separate authorisation. The final legal text of each document is set by the clinic with its own templates. Clinical photos and files are stored in the patient's record, up to 25 MB per file, and there is a comparison tool to see progress.

What Mi Clínica does not do: it does not publish photos on social media or on your website. It stores, separates and documents; publishing, and removing what has been published if the patient changes their mind, is done by the clinic.

Sources consulted

Checked on 12 October 2026. We link to the original source so that you can consult the current text.

• Reglamento (UE) 2016/679, Reglamento general de protección de datos. BOE (DOUE).
• Ley Orgánica 1/1982, de protección civil del derecho al honor, a la intimidad personal y familiar y a la propia imagen (texto consolidado). BOE.
• Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (texto consolidado). BOE.