A photo consent form app built for med spas
Updated July 27, 2026. Statistics sourced at the end.
The short version: most med spas handle photo consent with a paper form, a checkbox inside the general treatment consent, or a generic form builder. That holds up until someone posts a before and after the patient never agreed to share.
A photo consent form app worth paying for does three things: captures consent per patient with specific permissions, stores the signed record with the photos it covers, and blocks any export the consent does not allow. Medspa Photos does all three for $99 a month, with a 14-day trial you can start today, no demo call.
The consent gap is the norm, not the exception
Per data cited from AmSpa's 2025 legal compliance guidance, about 62% of med spas have a gap in photo consent: no photo-specific form at all, verbal-only consent, or a clause buried in the general treatment paperwork [1]. And a 2025 survey cited in industry reporting found roughly 64% of aesthetic practices still manage before and after photos manually, on staff phones and camera rolls [2]. The two gaps compound: the photos with the least custody are the ones with the weakest consent trail.
Why the general treatment consent is not enough
Consent to be treated is not consent to be published. A patient who signed for a filler appointment did not agree to appear on your Instagram, and a form that lumps the two together protects neither of you. Photo consent needs its own scope: clinical record only, or marketing too; identifiable, or de-identified; for how long; revocable how.
Why a form builder is not a consent system
Jotform, IntakeQ, and paper all share the same failure: the signature lives in one place and the photos live in another. When a staff member is about to post, nothing checks the form. Enforcement is somebody's memory of a document they may never have read. The consent exists; it just does not do anything.
Completion is also worse when consent is separated from the moment of capture. Per AmSpa-cited figures, digital consent captured at the right moment reaches about 94% completion, against 61% for paper [1].
What a photo consent app should actually do
Whether you choose our product or not, hold any option to this list:
- Photo-specific consent, separate from the treatment consent.
- Scoped permissions: clinical record only or social media too, identifiable or not, recorded as separate choices.
- Signed at capture, on the same device, while the patient is in the room.
- Stored with the photos it covers, versioned and time-stamped, not in a separate filing system.
- Enforced at export: the software, not staff memory, blocks any use the consent does not cover.
- Revocable with effect: a revocation should change what can leave the system, immediately, and tell you what it affects.
How Medspa Photos does it
The patient reads your consent form on the clinic iPad, signs with a finger, and chooses exactly what they allow. The signed record is stored with their photos, versioned and time-stamped. From then on, the export button checks the consent, not the other way around:
The check runs on the server. There is no staff override, no "just this once." If a patient revokes, future exports are blocked immediately and existing exports are pulled the same minute. The consent gate is attached to guided photo capture with a ghost overlay, so the photos being protected are also the ones that line up visit to visit.
A note on HIPAA
If your practice is a HIPAA covered entity, using identifiable patient photos for marketing requires the patient's written authorization, and a general consent does not substitute for it. Many med spas are not covered entities, but state privacy law and basic defensibility point the same direction: photo-specific, signed, scoped consent, kept where you can produce it. We built for the strict case: encrypted storage, audit logs, and a signed BAA where one is required. This page is general information, not legal advice.
Close the consent gap this week. 14 days free, set up the same day, no demo call.
Start your 14-day free trial$99 per month per location after the trial. Card required, cancel anytime. Or see how capture works on the product page.
Common questions
Does HIPAA require a separate photo consent form?
For covered entities, marketing use of identifiable photos requires written authorization; a treatment consent does not cover it. Non-covered med spas still face state privacy laws and the plain reality that posting a patient's face without documented permission is indefensible. Either way: photo-specific, signed, scoped. General information, not legal advice.
What should the form include?
What is photographed and why, where the photos may be used, whether the patient may be identifiable, how long consent lasts, and how to revoke. Each choice recorded separately, signed, and time-stamped.
Can a patient revoke consent later?
Yes, and the system should make it real. In Medspa Photos, revocation blocks future exports immediately and pulls existing exports the same minute. Posts already on your social accounts must be taken down by your team; the app tells you which ones the revocation affects.
Can I bring my own consent form?
Yes. You use your own form language, reviewed by your counsel. The app supplies the signature capture, the scoped choices, the versioned storage, and the enforcement.
What does it cost?
$99 per month per location, flat, with a 14-day free trial you can start today. No demo call, no contract, no onboarding fee, no export fees if you leave.
Sources
- Photo-consent gap (~62%) and digital vs. paper completion rates (94% vs. 61%) as cited from AmSpa 2025 legal compliance guidance in industry coverage, accessed July 27, 2026.
- Manual photo management (~64% of aesthetic practices), 2025 Dermatology Times survey as cited in industry reporting, accessed July 27, 2026.
If any of this is out of date, tell us at hello@consentshot.com and we will correct it.