Client consent forms in your salon: the three permissions you are mixing up

One form, three kinds of permission

Put three columns side by side and it becomes obvious. The first permission is informed consent: the client agrees to the treatment and its risks. This belongs to your duty of care and primarily protects you, because it is your evidence that you explained what could happen. The principle is known internationally as informed consent and comes from liability law, not from privacy law.

The second is GDPR consent to process health data. The moment you note that someone is pregnant or using isotretinoin, you are recording a special category of personal data. That permission protects the client and concerns storing information, not treating her.

The third is the commercial opt-in: newsletters, before-and-after photos, a review request. It is entirely voluntary and must never be a condition of being treated.

The distinction that matters most in practice: for the first two you may refuse the treatment if the client does not agree, because without them you cannot work safely or lawfully. For the third you cannot. A form with a single signature underneath all three blocks makes that distinction invisible, and in doing so it makes the first two contestable as well.

Informed consent is about liability, not privacy

Chemical peels, laser devices, permanent make-up and injectables carry risks you cannot fully rule out: an allergic reaction, prolonged redness, pigment shifts, a disappointing result. As the practitioner you have a duty to discuss those risks beforehand. If something goes wrong afterwards, the question is not whether you worked carefully, but whether you can demonstrate that the client knew what she was agreeing to.

Being able to demonstrate it is the entire point. A verbal explanation is legally valid but practically worthless the moment two people remember the conversation differently. What you record should therefore be specific rather than general. Not 'the risks were discussed', but which risks, what recovery time you quoted and which aftercare instructions you gave.

Three things make this block watertight. A description of the treatment as it is being performed today, including the strength or the device where that is relevant. The specific complications associated with this treatment, in plain language. And the aftercare rules, with confirmation that the client has understood them. That last part is no formality: a large share of complaints after a peel are not about the treatment but about what the client did or did not do afterwards.

Close with a date and a demonstrable agreement. A signature on paper works, and so does a digitally recorded agreement with a timestamp. More important than the form is that the version the client saw is preserved. If you revise your form later, you still want to be able to show what it said at the time.

GDPR consent for your health questions

If you ask about allergies, medication, pregnancy or skin conditions, you are processing health data. Article 9 of the GDPR prohibits this in principle and makes an exception where the client gives explicit consent. Explicit here means an active step, aimed at precisely this purpose.

Regulators set four requirements for that consent. As set out in the guidance on the legal basis of consent from the Dutch data protection authority, it must be freely given, specific, informed and unambiguous. Freely given means without pressure and without being tied to anything else. Specific means separately per purpose. Informed means the client knows what you store, why and for how long. Unambiguous rules out pre-ticked boxes: the client ticks it herself.

That requirement of specificity is where most forms come undone. A client who agrees to a peel has not thereby agreed to years of storage of her medication details. The block of health questions should therefore carry its own agreement line, with its own explanation of the retention period and its own tick box.

Ask only what the treatment touches. That is not merely good manners, it is a legal requirement: the fewer special categories you record, the less you have to secure and the smaller the damage in an incident. Which notes fall under article 9 and how to secure them afterwards is set out in the article on health data in the salon.

The structure: which blocks belong on the form

A workable consent form consists of four blocks, in this order. Each has its own function, and three of them close with their own agreement.

Block 1, identification. Full name, date of birth and contact details of the client, plus the date, the treatment and the name of the practitioner. This block needs no agreement of its own, but without it the rest cannot be tied to a person and a moment.

Block 2, health questions. Targeted and short. Do you use medication, and if so which, with attention to blood thinners and isotretinoin. Do you have known allergies or sensitivities. Are you pregnant or breastfeeding. Do you have an active skin condition in the treatment area. Have you had another cosmetic or medical procedure in recent weeks. Its own agreement line underneath, stating the retention period.

Block 3, informed consent. The treatment, the risks, the recovery time and the aftercare, followed by the declaration that the client has read this, was able to ask questions and understood the answers. Its own agreement, date and signature or digital equivalent.

Block 4, voluntary opt-ins. Newsletter, imagery, review request. Separate from one another, each with its own tick box, and with a line stating that declining has no effect on the treatment.

State at the bottom how long you retain the record and how someone can access, correct or erase their data. Retention periods differ by country and by type of data: in the Netherlands many beauty salons follow the industry line of two years after the last visit for the cosmetic file, while paramedical care falls under a far longer statutory period and financial records carry their own tax retention duty. Check what applies in your country, choose your period deliberately and write it down.

Keep marketing and imagery strictly out of it

A client who signs for an intensive peel has not thereby agreed to a newsletter, and certainly not to a close-up of her skin on Instagram. Yet that is exactly what happens when every agreement sits under a single signature.

The problem is not only tidiness. Consent must be freely given, and freely given means among other things that there is no detriment attached to saying no. Tie the treatment to the photo tick box and the consent for that photo is invalid. Worse, the blending also makes your informed consent arguable, because it is no longer visible what the client actually agreed to.

Imagery deserves a line of its own, because it reaches further than most salons assume. Record where the photo may be used, whether the face appears recognisably, and whether the client can withdraw it later. That last point is not a favour but a right, and it is far easier to honour when you know which permission each photo rests on.

In practice: the tick boxes sit at the bottom, they are empty, they stand apart from one another, and above the set is a line saying this block is optional. A client who declines everything receives exactly the same treatment as one who ticks everything.

From paper to a record that holds the intake

A paper form does its job at the moment of signing and becomes a storage problem immediately afterwards. It has to be retrievable if a client raises something two years from now, shielded from staff who have no business reading it, and it has to be capable of being destroyed when your retention period expires. A ring binder does none of those three by itself. The GDPR roadmap from the Dutch chamber of commerce stresses that you must be able to demonstrate protection against loss and unauthorised access; demonstrate is the word paper stumbles over.

Going digital moves the moment of completion to before the appointment. The client receives the questionnaire with her confirmation email, fills it in at home, and you can see on arrival whether there is anything to take into account. That saves treatment time, but more importantly it stops you starting with an incomplete picture because someone filled something in hastily at the desk.

In Salonnare you link such a questionnaire to the treatments it applies to. Fields you mark as a special category do not go into the ordinary notes field but into a separately encrypted vault, with a permission per staff member and a record of who viewed the data. Per form you also set a retention period after which the answers are cleared automatically, so the clean-up does not depend on a manual task nobody puts in the calendar. You can see how that works on the page about intake forms; the client profile everything hangs from sits under client CRM.

One honest note on the plans: digital intake forms belong to Starter and Pro, not to the free plan. The encrypted vault for health notes and the per-staff permissions are in every plan, including the free one. So if you are still on paper, you can start using that vault straight away for whatever you transcribe from your forms.

Withdrawal, retention and asking again

Consent is not a one-off act. A client may withdraw it at any moment, and doing so must be as easy as giving it. What that means in practice differs per block, which is exactly why separating them from the outset is so useful.

If someone withdraws her marketing opt-in, you take her off the list and nothing else changes. If she withdraws consent for her health data, you delete that data, but the informed consent for the treatment already carried out remains. That is not a trick: that document is no longer a permission but a record of what happened, and you have a legitimate interest in being able to defend yourself against a later claim. Explain that difference and it rarely becomes a dispute.

Refresh the intake periodically as well. Medication changes, allergies appear, someone becomes pregnant. A form from three years ago gives you a false sense of certainty that is more dangerous than no form at all. A common approach is to resend the questionnaire before every higher-risk treatment, and otherwise ask annually for confirmation that nothing has changed.

Start small. Split your current form into the four blocks from this article, give blocks 2, 3 and 4 an agreement each, and add a retention period underneath. If you then want to record it digitally with the health fields in an encrypted vault, you can start with Salonnare for free and set up your client profiles first; the digital questionnaires themselves come with Starter at 29 euro per month. The free plan is 0 euro per month for one staff member and fifty bookings, and Pro is 59 euro per month with no team limit.

Frequently asked questions about salon consent forms