GDPR Consent Form Template UK: What Aesthetic Clinics Need

Searching for a GDPR consent form template in the UK usually means one of two different things, and the distinction matters more than any template will.

There is treatment consent — the client agreeing to the procedure and its risks. And there is data protection consent — the basis on which you hold and use their personal information. They are separate obligations, they are satisfied differently, and a template that blurs them tends to leave you worse off than having nothing.

This explains which you actually need, why "consent" is often the wrong lawful basis for holding client data, and what a compliant form contains.

Consent is usually the wrong lawful basis

The most common mistake is assuming that because you need consent for treatment, you also need consent to hold client data. Under UK GDPR you need a lawful basis for processing personal data, and consent is only one of six.

Consent has a specific weakness: it can be withdrawn at any time, and if it is, you must stop processing. That is unworkable for client records you are professionally obliged to keep for years. If a client withdraws consent to you holding their treatment record, you cannot simply delete a record your insurer and professional body require you to retain.

For most aesthetic practitioners, the sturdier position is:

• Contract for the information needed to deliver the treatment they booked
• Legal obligation or legitimate interests for records you must keep for defence and professional standards
• Consent for the genuinely optional things — marketing emails, using their photographs publicly

Health data is special category data, which needs an additional condition on top of your lawful basis. For practitioners providing treatment, that is usually the health or social care provision condition rather than explicit consent.

The practical upshot: use consent where it belongs — marketing and photography — and a firmer basis for the client record.

What your form actually needs to say

Rather than a consent tick-box, most practitioners need a privacy notice that tells the client, in plain language:

• Who you are and how to contact you
• What data you collect, including health information and photographs
• Why you collect each type, and your lawful basis for each
• Who else sees it — your prescriber, your software provider, your insurer
• How long you keep it and why
• Their rights, including access, rectification and complaint to the ICO
• Whether any of it leaves the UK

Alongside that, keep separate, specific opt-ins for marketing messages and for public use of images. Bundling those into a single form that also covers treatment is the failure most templates encourage. If a client agrees to treatment, that is not agreement for their before-and-after photograph to appear on Instagram.

Photography deserves its own consent

This is where practitioners most often come unstuck. Clinical photographs taken for the record sit under your clinical basis. Publishing an identifiable image is a separate decision requiring specific, informed, freely given consent — and it must be as easy to withdraw as to give.

Record what was agreed and when. "Consented to social media use" written in a notebook two years ago is not a strong position if the client later objects. A dated, specific record naming the platforms is.

Practical obligations most practitioners miss

ICO registration. If you process personal data electronically as a business, you very likely need to register with the Information Commissioner's Office and pay the annual data protection fee. It is inexpensive, and the omission is easy to spot.

Data subject access requests. A client can ask for everything you hold about them, and you generally have one month. If the answer lives across a notebook, a phone camera roll and two apps, that deadline is difficult.

Breach notification. Certain breaches must be reported to the ICO within 72 hours. A lost, unencrypted phone containing client photographs is a plausible example.

Retention. You need a defined retention period you can justify and actually apply, rather than keeping everything forever by default.

Why a template alone will not solve it

A downloadable template gives you a document. What UK GDPR asks about is your processing — where data lives, who can reach it, whether access is logged, whether you can produce it on request, and whether you can delete the parts you are entitled to delete.

A perfect privacy notice sitting above a camera roll of client photographs and a drawer of paper forms does not describe a compliant practice. It describes an inaccurate one, which is arguably worse, because you have now documented a standard you are not meeting.

The questions worth asking honestly: could you produce everything you hold on one client within a month? Could you show who accessed their record? Could you delete their marketing data while keeping the client record you are obliged to retain? If not, the gap is in the system, not the wording.

Where software helps and where it does not

Software cannot make a business compliant. It can make compliance achievable: storage encrypted at rest, access controlled by role and logged, consent recorded against the treatment it relates to with a timestamp, marketing preferences held separately from client records, and everything for one client retrievable in one place.

Your policies, retention periods and lawful bases remain yours to decide and defend.

Beautay keeps treatment consent, client records and marketing preferences separate but connected, encrypted at rest with access logging and per-appointment storage. From £24.95 a month with a 30-day free trial.

General information about data protection for aesthetic practices, not legal advice. For your specific obligations, consult the ICO's guidance or a data protection adviser.