Before/After Photo Galleries: The Consent Framework Every Aesthetic Clinic Needs
Before/after photos are aesthetic marketing's most persuasive asset — and its highest legal risk. Under India's DPDPA and the DPDP Rules notified in November 2025, publishing an identifiable patient photo requires specific, written, revocable consent. This framework covers the consent form, retention policy, and takedown workflow that let clinics keep their galleries — lawfully.
No page on an aesthetic clinic's website converts like the results gallery.
It is also the only page that publishes identifiable, health-related images of real people to the open internet.
Those two facts have to be managed together — and most clinics manage neither, because "the patient said it was fine" once, verbally, three years ago.
Here is the framework we build into clinic platforms: four layers, each answering a question a regulator — or an unhappy patient — could one day ask.
Why is verbal consent not enough anymore?
Because the DPDPA makes the clinic a Data Fiduciary with a duty to prove consent — what was agreed, for which use, and when. A verbal OK leaves nothing to point to.
The DPDP Rules notified in November 2025 also require that withdrawing consent be as easy as giving it, which a verbal agreement structurally cannot support. When the core Rules obligations take full effect around May 2027, a gallery running on undocumented consent is a published liability with a regulator attached — patients can complain directly to the Data Protection Board.
The wider compliance picture is covered in our DPDPA clinic website checklist. This piece goes deep on the single highest-risk asset: the gallery.
Layer 1 — What should a photo consent form actually say?
One page, plain language, four specific permissions the patient ticks separately:
- Clinical record use — photos stored in the treatment file (standard care)
- Website gallery use — publication on the clinic's own site
- Social media use — Instagram and Facebook, named explicitly
- Advertising use — paid promotion, if ever intended
Each is a separate tick-box, not a bundle. Bundled consent is precisely what the Act is written to prevent.
Then add three sentences that do the legal heavy lifting: how long images stay published, how consent is withdrawn (a real email address), and the takedown window the clinic commits to. Date it, sign it, and store it where the front desk can retrieve it in under a minute. A consent you cannot find is a consent you do not have.
Layer 2 — How should photos be prepared before publishing?
The governing principle is minimum identifiability: show the result, not the person, wherever the treatment allows.
- Crop to the treated area — a jawline result rarely needs the whole face
- Strip photo metadata; EXIF data can carry device details and GPS location
- Never reuse clinical photos of minors in marketing — under-18 data requires verifiable parental consent under the Rules, and no gallery is worth that risk
- Keep framing and lighting consistent between before and after — trust collapses the moment a patient realises the "after" is just better photography
Layer 3 — What is a retention and takedown policy?
Two published sentences transform your legal position:
"Patient images appear with written consent and are reviewed every 24 months. To withdraw consent, email [address] — images are removed within 14 days."
That line, plus an inbox somebody actually monitors, satisfies the withdrawal-parity principle, gives patients a route that isn't the Data Protection Board, and demonstrates the accountability the Act expects. Put it in the gallery footer and in the privacy policy — both, not either.
Layer 4 — Who owns the workflow inside the clinic?
Name one person. Not a department, not "the marketing team" — one named individual, because shared ownership of a compliance task reliably becomes nobody's job.
The workflow itself is small: consent signed before photos are taken → permissions recorded when published → calendar review every 24 months → takedown requests actioned inside the window, publication list updated.
Fifteen minutes a month, and every photo on the site has a paper trail behind it.
Does all this reduce the marketing value of galleries?
It increases it.
A gallery captioned "published with written patient consent" reads as integrity in a market where patients are increasingly privacy-aware. Aesthetic medicine sells trust before it sells results; a consent-first gallery sells both at once.
And commercially, the compounding argument matters more than the compliance one: a compliant gallery never has to come down in a panic. The asset accumulates value instead of becoming a legal fire drill in year three.
The clinics that will struggle in 2027 are not the ones without galleries. They are the ones with galleries and no paperwork.
If you're rebuilding your site, get the consent architecture designed in from the start rather than retrofitted — it is far cheaper before launch than after. The same logic applies to the rest of the build, which we cover in how to build a clinic website that actually books patients.
Consent-first galleries are built into every clinic platform we ship — the form, the workflow, the takedown route, under one accountable roof. WhatsApp us if you want your existing gallery reviewed before it becomes someone else's evidence.
Sources: MeitY — Digital Personal Data Protection Act, 2023 · PIB — DPDP Rules, 2025 notification. This article is general information, not legal advice; consult a data-protection practitioner for your clinic's specific position.
Frequently asked questions
Do old photos with verbal consent have to come down?
Not immediately — but they should be regularized. Contact those patients for written consent using your new form, and remove images where you can't obtain it. An audit you run yourself now beats a takedown demand later, and the effort is finite: most clinics have fewer published patient images than they assume.
Is consent for social media covered by website consent?
No. Name each channel separately on the form. A patient comfortable appearing on a clinic webpage may not be comfortable on Instagram, where images are shareable, downloadable and searchable in ways a website gallery is not. Bundling the two into one tick-box is exactly the kind of blanket consent the DPDPA is designed to prevent.
Can we use photos if the face is fully cropped out?
Cropping reduces risk but does not eliminate it, because identifiability depends on context. Tattoos, jewellery, scars and distinctive features can identify someone to people who know them. Treat cropped images as lower-risk rather than consent-free, and keep the written consent anyway — the cost of holding a signed form is nothing next to the cost of not having one.
What happens when a patient withdraws consent?
Remove the image everywhere it was published within your stated window — 14 days is a defensible standard — confirm the removal to the patient in writing, and log it. Withdrawal applies to future use: it does not retrospectively make past publication unlawful if the consent was valid at the time. That is why dating the consent form matters.
Who is liable if our marketing agency publishes patient photos?
The clinic, as Data Fiduciary. Agencies act as Data Processors on your instruction, which means their mistake is still your liability. This is why the consent register should live with the clinic rather than the agency, and why agencies should only ever receive images already cleared for the specific channel they are publishing to.
