How to Keep Client Consent and Patch Test Records in a Salon

What are the steps to keep consent and patch test records in a salon?

A complete client file is the goal. For most beauty businesses that means a signed consent form on the current version, a screening update at each visit, a patch-test record where the treatment needs one, a treatment record with products and batch numbers, a note that aftercare was given and photography consent if you took photos. These eight steps get you there.

• 1. List every treatment you offer and group them into families (colour and chemical, lash and brow, nails, waxing, facials, massage, devices, semi-permanent make-up, tanning).
• 2. Set a patch-test flag for each treatment from the product manufacturer's instructions, your training and your insurer's conditions.
• 3. Build one consent form per family, filling the screening questions, risks and aftercare from your training, insurer and manufacturer. Give it a code, version and review date.
• 4. Send the form with the booking, run a structured consultation and have the client sign before the treatment starts.
• 5. Record every patch test with date, product, batch, area, practitioner, the recorded decision and the date the next test is due.
• 6. Write products and batch numbers on every treatment record and note the aftercare sheet given.
• 7. Store records securely, limit who can see them and keep them for the period your insurer and local law set.
• 8. Once a month, audit a fair sample of files and make one change.

Why do consent and patch test records matter so much?

Careful practitioners already ask questions, test products and explain aftercare. Records do not replace that care; they make it visible to the three audiences who may one day ask about it: the client, the insurer and, in some places, a regulator or court. When a client says 'nobody told me', the only answer that settles it calmly is a dated, signed form showing what was explained and an aftercare note on the treatment record.

Insurers matter most day to day. Treatment risk and professional indemnity policies for beauty, wellness and fitness businesses commonly include conditions about consultation forms, patch tests and record keeping, and a renewal letter can ask you to produce them. Read your own policy and highlight every sentence that mentions consultation, consent, testing or records: that list is the minimum your system has to deliver.

Finally, records protect practitioners as much as clients. A patch test with its batch number lets a manufacturer investigate a product problem quickly, and a logged refer-or-decline shows a practitioner stayed within their training when a client pushed.

What does informed consent mean for beauty and wellness treatments?

Informed consent is a voluntary decision, made by someone able to decide, after they understand what the treatment involves, the expected results, the risks, the alternatives including doing nothing, and the aftercare. It is specific to the treatment and ongoing: the client can stop at any time, and you check again when something changes.

The record is how that care becomes visible. A form signed after the treatment, or one that covers 'all services' in a paragraph, does not show informed consent for a particular treatment on a particular day. A form with a version number, a screening section updated at the visit and a note of what was explained does.

Some professional content does not belong to the salon owner at all. The screening questions for a lash lift, the risks of a chemical service or the aftercare for microblading come from the practitioner's training, the product manufacturer and the insurer. A good template leaves clearly marked boxes for that content rather than inventing it.

How do you record a patch test properly?

Many hair colours, lash adhesives, tints and lamination products come with manufacturer instructions about patch or skin testing: whether to test, how to apply it, when and how to read it, and how often to repeat it. Follow those instructions and your training. The record then needs seven things.

• Write the batch number from the product in your hand, at the time.
• Start a new test when the product or brand changes.
• Check the 'due soon' list every week and message clients before they book.

How long should salon client records be kept?

There is no single answer that applies everywhere, and quoting a number heard on a course is risky. The period should come from two sources: your insurer's policy conditions and your local law, including limitation periods for claims, which can run longer for children. Write the period and its source in your records procedure, then destroy records securely when it ends and log that you did.

Health information deserves extra care while you hold it. In the UK, the Information Commissioner's Office treats data concerning health as special category data under UK GDPR, which brings extra conditions and stronger security. In the US, HIPAA applies to covered entities such as health plans, clearinghouses and health care providers that transmit health information electronically in standard transactions; most salons are not covered entities, but some states have their own consumer health data laws. Check the law where you trade.

How do you audit salon records? A worked example

A monthly audit turns good intentions into a number you can track. Pick ten files fairly (by formula or by every nth client, not by hand), check each against the same ten questions, and record Yes, No or not applicable. The score is Yes divided by Yes plus No.

Here is an illustrative example from a small lash and brow studio's October audit of ten files. Two files had no patch-test treatment and six files had no photos taken, so those checks were not applicable.

• Pooled score: 78 Yes out of 90 applicable checks = 86.7%.
• The weakest check is photo consent at 2 of 4, so that is next month's one change.
• Three files signed on an old version: ask those clients to re-sign at their next visit.

What should you do when a client reports a reaction?

Three things, in order. First, point the client to medical advice: their doctor, a pharmacist, a local health advice service, or emergency services if they describe an emergency. A practitioner should not diagnose or reassure about symptoms. Second, record the facts in the client's own words, with the treatment date, practitioner, products and batch numbers. Third, tell the people who need to know in the time their terms set: the owner the same day, the insurer as the policy requires, the product manufacturer as its instructions require and any authority your local rules name.

Most complaints are not reactions but communication: 'nobody told me' or 'it wasn't what I expected'. The treatment record and aftercare note answer those, and the learning from each one is worth writing down.

Are licensing and age rules for beauty treatments changing?

In several places, yes. In England, the Health and Care Act 2022 gave the government power to license non-surgical cosmetic procedures; the House of Commons Library summarises the 2025 government response, which proposed green, amber and red risk tiers and an intention to restrict procedures for under-18s except with medical oversight, with no start date set. In Scotland, the Non-surgical Procedures and Functions of Medical Reviewers (Scotland) Act 2026 prohibits non-surgical procedures for under-18s and outside specified premises. Elsewhere, local councils, states and provinces license skin piercing, salons and devices.

Whatever applies to you, the practical response is the same: record date of birth, write an age policy per treatment family, and keep the records a licensing officer or insurer would ask to see.

Can you use digital consent forms and AI?

Digital consent apps and e-signatures can send form links with bookings, version forms, time-stamp signatures and remind clients about patch tests. Before choosing one, ask where data is stored, whether each team member has their own login, whether you can export everything if you leave, and whether your insurer accepts its signatures.

AI assistants are useful for words: turning a dense manufacturer leaflet into plain sentences, checking a form for missing admin fields or drafting a complaint reply. They should never write screening questions, contraindications, patch-test timings or aftercare from their own knowledge, and never decide whether to treat. A practitioner checks every word, the insurer approves consent and aftercare wording, and the new version is dated before use. No client names or health answers go into unapproved tools.

What are the most common record-keeping mistakes?

A useful test: pick any file from last month and try to show, within five minutes, the signed form on the current version, the screening update, the patch test with batch and decision, the treatment record and the aftercare given. If you cannot, the Treatment Consent and Aftercare System from Bodhih Training has the templates and logs to close the gap, and AssessAll's Client Consultation and Contraindication Screening Assessment for Beauty, Salon and Spa Therapists can show where a team's consultation skills stand.

• Downloading a screening list and using it as is, instead of filling it from your training, insurer and manufacturer.
• One generic form for every service, with no version or date.
• Signing after the treatment, or never updating screening for regulars.
• Patch tests with no batch number and no next-due date.
• Aftercare given only verbally, with nothing on the record.
• Client photos on personal phones, with one consent covering 'social media and everything else'.
• Retention periods guessed rather than checked.
• Changing five things after a bad audit instead of one.