Before and after photo rules for med spas

Three separate bodies of rules land on one Instagram post, and most clinics only ever think about one of them. Here is the shape of all three, and the operational parts you can fix this week without calling anyone.

Who makes the rules on before-and-after photos?

Three rulebooks apply to the same post at the same time. They ask different questions and they fail in different ways.

A “results may vary” line under a misleading photo does not cure the photo. If the result you are showing is unusual, the fix is to show a typical one instead — not to add smaller type.

Behind all three sit the ad platforms, which are a contract rather than a law. Before-and-after imagery in health and body-related categories has been a restricted area on the major platforms, what is permitted in an organic post is not the same as what is permitted in a paid one, and platform policy moves far faster than statute. Do not infer the current rule from what a competitor appears to be getting away with. Read the policy for the platform and the ad account you are actually using, on the day you build the campaign.

Brand names are their own small trap. The manufacturers own those trademarks and set conditions on how a clinic may use them, and the major ad platforms gate parts of healthcare advertising behind certification. Both change. Check the manufacturer’s terms and the platform’s current policy for the specific product you want to name.

None of this is legal advice, and none of it is a substitute for an attorney licensed in your state.

What counts as an identifiable patient?

More than a face, and it depends on context. The working definition that survives contact with reality: identity is whatever lets one person in her own circle recognise her.

• A tattoo, a scar, a birthmark, a mole pattern, a distinctive ring or piercing she wears every day
• Hands, in a photo of hands. They identify people far more than owners expect
• A caption naming the treatment and the week, next to a patient who posted about her week
• Your own treatment room, if the same corner appears in a photo she is tagged in
• The comment section, where one reply confirming she is a patient does the identifying for you

Patient status is itself protected. You cannot publicly confirm that a named person is or was a patient — not in a review reply, not in a comment, not by thanking someone by name.

So cropping is a reduction in risk, not a removal of it. Authorize the exact final image, for the exact places it will run.

What does a usable photo consent form have to cover?

Have an attorney licensed in your state draft it. What follows is what should appear in that draft, so you can tell whether the form you are being handed is doing its job or is a liability with a signature on it.

Keep the signed authorization at least as long as you keep the images, and probably longer than feels necessary. Retention periods for medical documentation are set federally and again by your state, the two are not the same length, and the longer one is the one that binds you. Ask your attorney which applies where you practise rather than taking a number off a page like this one.

How do you shoot a pair that is actually honest?

By changing nothing between the two shots except the patient. A “before” under overhead clinic light and an “after” by the window is not a result. It is a lighting change, and a sceptical patient sees it in half a second.

Visit one

Twelve weeks later

Lock the variables and the pair defends itself:

• Same camera, same lens, same distance. Tape the floor. Fix the camera height. A phone on a tripod at a taped mark beats a better camera held freehand.
• Same light, from the same direction, at the same time of day. One controlled source is easier to repeat than daylight.
• Same background, same angle, same posture, same expression. Neutral face in both. A smile in the after shot is doing work the treatment did not do.
• Same face state. No makeup in either, or the same makeup in both. Hair off the face in both.
• Filters and beautification off. Turn off automatic skin smoothing on the phone camera. It is on by default on many devices and it will quietly retouch the before shot too, which is worse.
• A written shot sheet per treatment type, taped inside the cabinet, so the result does not depend on which team member is holding the camera.
• Consistent timing after treatment, and state it. “Twelve weeks after the second session” is a claim you can stand behind. “After” is not.

If the honest pair turns out undramatic, that is information. Publish the undramatic pair and say what it took. Patients have been shown enough impossible grids to find a modest, dated, sourced one more convincing than another miracle.

Where should the original photos live?

In one clinic-controlled place, on clinic-controlled accounts, indexed against the signed form. The failure mode here is almost never a data breach. It is a phone.

Photos taken on a staff member’s personal device, texted to the owner, forwarded to a designer, sitting in three personal cloud backups by Friday. That is patient information on hardware you do not control, held by people who will eventually leave.

• Originals go to one clinic-controlled location with named access. Personal camera rolls get cleared deliberately, as a step in the process rather than a favour someone remembers.
• Name files so a stranger cannot read them: an internal case reference, the treatment, the date. Never the patient’s name in the filename, and never in the alt text either.
• Keep one index linking each image to its signed authorization, the channels it was approved for, and its expiry date. A spreadsheet is fine. Not having one is what turns a withdrawal request into a three-day scramble.
• Anyone outside the clinic who touches these files — agency, cloud storage, CRM, chat tool, scheduler — is a vendor holding protected health information, and a business associate agreement is the mechanism that covers that. Signed before the files move, not after.
• Do not paste patient photos into general-purpose AI tools. Most consumer tiers make no commitment about what happens to what you upload. Where an AI tool genuinely has to touch clinical data it needs to be scoped for it, which is what we mean on the AI automation page.

Oris builds to documented practice and is not a law firm. We do not review clinics for compliance, and nobody should sell you that as a deliverable.

What are the rules for testimonials and review replies?

A written testimonial is an endorsement. A review reply can confirm patient status. Those are two different exposures sitting in the same paragraph of your marketing, and the photo rules only half cover them.

If anything was given in exchange for a testimonial, the connection gets disclosed wherever the content runs. If the outcome described is not typical, presenting it as if it were is the problem, and a disclaimer under it does not repair the impression it created. Do not treat fake reviews or undisclosed incentives as a grey area to plan around — whatever the exposure works out to in your particular case, no owner wants to be the one who finds out.

Two habits get clinics into trouble, and both feel harmless at the time.

Replying to a review by name. A warm “so glad you loved your results, Jenna!” is a public confirmation that Jenna is a patient. Reply without confirming, or reply privately.

Filtering reviews before they are posted. Routing happy patients to a public review page and unhappy ones to a private form is a pattern regulators have taken a specific interest in. Ask your attorney about your exact setup before you build one.

What do we do when a patient asks us to take her photos down?

Treat it as a written instruction, acknowledge it the same day, and work a list rather than a memory. Build the runbook before you need it — ten quiet minutes now instead of a scramble later.

1. Acknowledge in writing the same day. Confirm what you received and what happens next. Do not negotiate, and do not ask her why.
2. Tell every vendor in writing and ask for written confirmation back. A verbal “sure, done” is not a record.
3. Deal with caches honestly. Search caches and archive sites can be asked, not commanded. Requests can be filed; guarantees cannot be made. Say so plainly rather than promising.
4. Set an internal target and hold to it. Same day for anything you control directly, a stated window for everything else. Write the target down, because “promptly” is not something you can demonstrate a year from now.

And the part that matters more than any of it: withdrawing consent must have no effect whatsoever on her care, or on how she is spoken to at the front desk.

What should we check before we hit publish?

Seven questions. If any answer is no, the post waits.

Most of this work is not legal work. It is a form that says the right things, a taped mark on the floor, a folder nobody keeps on a personal phone, and a list you can work the day someone changes her mind.

What does it cost to have this built into the site?

You can do everything above with a form from your attorney, two dollars of tape and a spreadsheet. None of it needs an agency, and we would rather you did it this month than waited for a proposal.

What usually does need building is the website side: whether your CMS can record which images are cleared for which channel, whether the disclosure lives in the template instead of in whoever is writing the caption that day, and whether a take-down is a checkbox or a developer ticket. That is part of what med spa websites covers — from $3,500, project-based, with most single-location clinics landing between $3,500 and $6,000. It excludes photography and licensing for any stock or model imagery. The full breakdown, including what moves the number, is on pricing.

Since this page asks you to trust a name you have not heard: Oris is a team in Wroclaw, Poland, building patient acquisition systems for US clinics. We have no US clients yet, which is why there is no case study here, no logo row and no percentage next to our name. We are HIPAA-aware and we build to documented practice. We are not lawyers.

The honest next step is smaller than a website. Ask for the free clinic audit and we will look at your published gallery, your alt text and your review replies against the operational checklist above — storage, disclosures, take-down path — and write down what we find, in writing, within two business days. That is an operations review, not a legal opinion, and the document says so on its face.

One more time, because on this topic it matters: this is educational, it is not legal advice, and a specific decision about a specific patient belongs with an attorney licensed in the state you practise in.