Beautay

GDPR and data consent consent form

Add your clinic details and print a data protection consent form. It covers what you hold, why you hold it, how long you keep it, and the separate consent you need for clinical photography and marketing.

Your clinic details

These appear at the top of the form. Nothing is sent anywhere, it all stays in your browser.

Your professional registration number if you have one.

Choose Save as PDF in the print dialog if you want a file rather than paper.

Your clinic name

Consent to treatment

Data Protection and Marketing Consent

Client details

Full name
Date of birth
Email address
Contact number

Who controls your data

The clinic named at the top of this form is the data controller for the information you provide. That means the clinic decides what is collected and why, and is responsible for keeping it safe.

What we collect

  • Your name, date of birth and contact details
  • Your medical history, medicines and allergies
  • Records of the treatments you have received, including products and batch numbers
  • Clinical photographs, where you have consented to them
  • Payment records and appointment history
  • Any correspondence between you and the clinic

Why we hold it and our lawful basis

Health information is special category data under UK GDPR and needs a lawful basis under both Article 6 and Article 9.

  • Providing your treatment safely, on the basis of contract and of the provision of health care under Article 9(2)(h)
  • Meeting our legal and regulatory obligations, including record keeping required by our insurer and any regulator
  • Managing appointments, payments and clinic administration on the basis of legitimate interests
  • Sending you marketing, only where you have given consent, which you can withdraw at any time

Clinical photography

Clinical photographs are part of your treatment record. They help your practitioner assess change over time and they matter if a complication develops. Consent to clinical photography for your record is separate from consent to use images publicly.

How long we keep it

Clinical records are retained for the period required by our indemnity provider and applicable guidance, which is normally at least eight years after your last appointment. Records for anyone treated under the age of eighteen are kept until their twenty fifth birthday. Marketing preferences are kept until you withdraw consent.

Who we share it with

  • Our secure clinic software provider, acting as a data processor on our instructions
  • Your prescriber, where a prescription only medicine is involved
  • Our insurer or indemnity provider, if a complaint or claim is made
  • Healthcare professionals involved in your care, where sharing is necessary for your safety
  • Regulators or law enforcement, where we are legally required to disclose

Your rights

  • Ask for a copy of the information we hold about you
  • Ask us to correct anything that is inaccurate
  • Ask us to delete information, where we are not legally required to keep it
  • Object to processing based on legitimate interests
  • Withdraw consent for marketing or photography at any time
  • Ask for your data in a portable format
  • Complain to the Information Commissioner's Office at ico.org.uk

Declaration

Please initial each statement.

  • I have read and understood how my information will be used and how long it will be kept.
  • I consent to clinical photographs being taken and stored as part of my treatment record.
  • I would like to receive marketing by email. (Optional)
  • I would like to receive marketing by SMS. (Optional)
  • I consent to my before and after images being used on the clinic's website and social media. (Optional, and can be withdrawn at any time)

Client

Signature
Print name
Date

Practitioner

Signature
Print name
Date

Good practice

Getting consent right

  • Keep marketing consent separate from treatment consent. Bundling them together is not valid consent under UK GDPR.
  • Consent to use images publicly is a different decision from consent to store clinical photographs. Ask for them separately.
  • Record the date and method of every consent, and keep a record when someone withdraws it.
  • If you use clinic software, check whether your provider has a data processing agreement in place. You need one.

Important

This template is a starting point, not legal or clinical advice. Review the wording with your insurer or indemnity provider and adapt it to your own practice, products and protocols before you use it with clients.

Other templates

Stop printing consent forms

Beautay sends the right form when the appointment is booked, stores the signed copy against the client record, and prompts you to re-consent at the next visit.

Get Started Free

No card required • 30-day free trial • Free data migration

Online bookingClient recordsNo transaction feesCustom websiteFree migration