Before-and-after photos are among the most viewed content on any aesthetic clinic's website or Instagram account. They are also health data. A poorly anonymized image can let a colleague, a neighbour or an employer recognise a patient. That has human consequences, and it can have professional and legal ones too.
This guide walks through what to check before you publish a case. It covers consent, the general GDPR framework, the details that actually identify a person (far beyond the face) and the invisible data hidden inside the file.
This article gives a general framework. Rules on medical advertising and patient images differ between countries and sometimes between specialties. Always check with your regulator, medical council or professional body.
1. Consent first, anonymization second
Anonymization does not replace consent. Even if you believe an image cannot identify the person, good practice is to obtain written, specific and informed consent from the patient before publishing anything.
A good photo consent form covers at least:
- Purposes: medical record only, teaching or conferences, clinic website, social media. These are different uses, and the patient should be able to accept some and decline others.
- Which areas will be photographed and how they will be anonymized (face hidden, tight crop, and so on).
- How long the images may be used.
- The right to withdraw at any time, and what you will do then (remove the posts you control). Be honest that an image shared publicly may already have been copied by others.
- No link to care: declining publication must not affect treatment in any way.
Keep the signed form with the record, and refer to the case with an internal number rather than the patient's name in your file names.
2. What GDPR means here, in short
If you practise in the European Union, or handle data about people who are there, GDPR applies. A few principles are worth keeping in mind:
- A photo is personal data as soon as it can identify someone, directly or indirectly. A photo taken in a medical context is, in practice, data concerning health. That is a "special category" whose processing is prohibited by default, unless an exception applies, such as explicit consent.
- Truly anonymized data falls outside GDPR, but the bar is high. The person must no longer be identifiable by any means reasonably likely to be used, including by combining the image with other information. A photo with only the eyes covered is often considered pseudonymized, not anonymous.
- Data minimisation: publish only what is needed to show the result. If you treated the chin, the rest of the face does not need to be in the frame.
- Security: protected storage, limited access, and no patient photos sitting in a personal phone gallery that syncs to a consumer cloud.
Outside the EU, other rules apply. In the US, HIPAA explicitly lists full-face photographs and comparable images among the identifiers. The UK has UK GDPR and professional guidance, and health authorities in the UAE and elsewhere regulate medical advertising. The core principles are similar everywhere: consent, minimisation and security.
3. What actually identifies a patient
The face is only the beginning. Before posting, go through the image with this checklist:
| Element | Risk | What to do |
|---|---|---|
| Face, eyes, eyebrows | Direct recognition | Crop to the treated area; otherwise mask generously, not with a thin bar |
| Tattoos | Highly identifying, even small ones | Blur or pixelate heavily, or crop out |
| Moles, scars, birthmarks outside the treated area | Recognisable to people who know the patient | Crop or mask |
| Piercings, jewellery, wedding ring, watch | Distinctive | Ask the patient to remove them before the photo |
| Hair, hairstyle, nail polish | Indirect clues | Neutral headband or cap, tight framing |
| Background, mirror, reflections, window | May show the location, other people or a screen | Plain neutral backdrop; check reflections |
| Patterned clothing or underwear | Recognisable | Neutral drape or garment |
| Date, name in the file name, metadata | Hidden data | Rename and export without EXIF (see below) |
Eyes: why a thin black bar is often not enough
The black bar across the eyes is a habit inherited from print media. It hides part of the gaze, but the shape of the face, nose, mouth and ears, plus the hairstyle, stay visible. For someone who knows the patient, that is often enough. In order of preference:
- Crop so that only the treated area remains. This is the safest method.
- Mask generously with a thick band, strong blur or large-block pixelation, when the whole face is needed to understand the result (for example, a profile rhinoplasty).
- If the result can only be understood with an identifiable face, then the consent must explicitly cover an identifiable image. Also check that your local rules allow that kind of publication.
Blur or pixels: do it properly
A light blur can sometimes be partly reversed or still reveal features. Use a strong blur or coarse pixelation, and bake it into the final export. A removable sticker added in a social app is not enough.
4. Hidden data: EXIF, GPS and file names
A smartphone photo often contains EXIF metadata: the device model, the exact date and time, and sometimes GPS coordinates. Some platforms strip it when you post and others do not. A file sent by email or uploaded to a website usually keeps it.
Three habits help:
- Export a new image, not the original file, without metadata.
- Rename the file with a neutral, descriptive name such as
rhinoplasty-profile-before-after-6-months.jpgrather thanIMG_2045_Mrs_Smith.jpg. It is also better for your website's SEO. - Check it. On a Mac, the Inspector in Preview shows EXIF data. On Windows, right-click the file, then choose Properties, then Details.
5. The caption matters too
A caption can re-identify a patient as surely as a face, for example "our patient, a 34-year-old yoga teacher from Leeds…". Keep it factual and restrained:
- state the procedure or treatment, the area and the interval between the two photos ("3 months after");
- leave out personal-life details;
- make no promise of results. A line such as "individual results vary" is a good habit, and some medical advertising rules require it;
- do not retouch the result. If you adjust exposure, apply exactly the same correction to the before and the after.
6. A six-step publishing routine
- Check the signed consent and the uses it allows for this case.
- Pick photos taken under the same conditions (see our guide to consistent before-and-after photos).
- Crop to the treated area, then mask anything identifying that remains: eyes, tattoos, distinctive marks.
- Check the background and reflections.
- Export a new image without metadata, with a neutral file name.
- Write a factual caption with no personal details and no promises, in line with the rules in your country.
How Lumipair helps you apply this routine
We built Lumipair for exactly this workflow. Your photos are opened in your browser only and are never uploaded to a server. You place the before and after side by side or stacked, in Instagram formats. You crop, then mask the eyes, the face or a tattoo with a bar, a blur or pixelation. Every export is a fresh JPG with no EXIF or GPS data. The tool also suggests a neutral file name, alt text and caption, which you review and adapt to your local rules.
The tool does not replace patient consent or your own judgement. It simply makes the right method faster than the wrong one.
Key takeaways
- Written, specific consent comes first.
- Cropping beats masking, and generous masking beats a thin bar.
- Tattoos, distinctive marks, backgrounds, captions and metadata can identify a patient as much as a face.
- Always export a clean new image with a neutral file name.
- Check your country's medical advertising rules before publishing.