Your best marketing asset and your biggest legal exposure are, in the skincare and med spa world, often the exact same photo. A great before-and-after result is the single most persuasive thing on your website. It’s also, legally, treated with real weight, because it’s a client’s protected health information and a factual claim about what your treatments do, both at once. Get the compliance side wrong and a photo that was meant to build trust can turn into a warning letter, a complaint, or a client relationship you didn’t need to lose. Here’s how to use before-and-after content the right way.
This post is general information for skincare and aesthetics business owners, not legal advice. Talk to a healthcare or advertising attorney about your specific state’s requirements before publishing patient photos.
Why a Before-and-After Photo Is Different From Any Other Marketing Image
A regular marketing photo is just an image. A before-and-after photo of a client’s treatment result is, at the same time, two other things: an advertising claim about what your treatment does, which falls under truth-in-advertising rules, and a piece of that client’s protected health information, because the image itself reveals they received a specific cosmetic or medical procedure. That second point surprises a lot of business owners. The photo doesn’t need a diagnosis written next to it to count as protected health information. The image alone, showing that someone underwent a treatment, is enough. Both of those layers need to be handled correctly before a photo ever goes on your website.
Get Written, Specific Consent, Separate From Your Treatment Consent
The consent form your client signs to receive treatment is not the same as consent to use their photo in your marketing. These need to be two separate documents, and the marketing consent form needs to be specific, not blanket. It should clearly state what the photos will be used for (your website, Instagram, printed materials, wherever you actually intend to use them), include some form of expiration or renewal window rather than a permanent, indefinite grant, and explicitly tell the client they have the right to revoke that consent later, in writing, and that you’ll honor it going forward once they do.
Build a simple system for this now, before it becomes a problem: a signed consent form on file for every single photo you publish, stored securely, with a clear process for what happens if a former client asks you to take their photo down. That last part matters more than most business owners expect. Revocation requests do happen, and how quickly and gracefully you handle one says a lot about how trustworthy your practice actually is.
Store Photos Like the Sensitive Data They Are
Once you have consent, the photos themselves need to live somewhere secure, not in a general camera roll or an unprotected shared folder. Client photos with any identifying information attached should sit in a system with real access controls, ideally the same practice management or EMR platform you’re already using for client records, rather than scattered across personal devices and random cloud folders. If you’re emailing or messaging photos internally between staff, that communication needs to be encrypted, the same standard you’d apply to any other client health information, because that’s exactly what these images legally are.
Keep the Photos Honest
Separate from the consent and storage requirements, there’s a straightforward advertising rule underneath all of this: before-and-after photos have to represent what a typical client can realistically expect. That means no filters or lighting tricks that exaggerate the result beyond what the treatment actually delivered, no cropping or angles chosen specifically to manufacture a more dramatic before shot, and no stock photography presented as a real client result. If a particular result is unusually dramatic, better than what most clients see, say so directly near the photo, rather than letting a visitor assume it’s typical. A results claim that isn’t representative, or isn’t disclosed as atypical, is exactly the kind of thing that draws regulatory attention, and it’s also, frankly, the kind of thing that erodes trust the moment a prospective client’s own results don’t match the marketing.
Build the Habit, Then Let the Photos Work For You
None of this is a reason to avoid before-and-after content. It’s genuinely your most persuasive marketing asset, and the businesses that use it well, real results, honestly represented, properly consented, tend to convert far better than the ones that lean on stock photography and vague claims instead. The compliance work isn’t a barrier to using your best marketing tool. It’s what lets you use it without it becoming a liability later.
A practical starting checklist: a dedicated, specific marketing consent form for every client whose photo you want to use. Secure, access-controlled storage for the images. A clear, honest disclosure if any featured result is above average. And a simple, documented process for handling a revocation request the one time a former client asks for their photo to come down. Put those four things in place once, and your before-and-after gallery becomes an asset you can keep building on with confidence, instead of one you’re quietly worried about.
Building or auditing a skincare website and want a second pair of eyes on how your photo gallery and consent process are set up? MTB Digital works with skincare and med spa businesses on exactly this. Request a quote and we’ll walk through it with you.