Dental Social Media Consent Form: Patient Photo Wording With AI

A dental social media consent form should be separate and optional, and should say exactly what is used (photos, video, testimonial), where, for how long, that saying no changes nothing about treatment, and how to withdraw. Add rules for minors and a signature line. Have AI draft the plain wording, then have a local lawyer check it.

Two rules shape everything else. Consent has to be specific, so "marketing" is too vague and "our Instagram and website for up to three years" is better. And permission has to be real, which means a patient can say no without it affecting their care and can change their mind later. A form that fails either test protects nobody, however well it is worded.

Follow me on Instagram@sagnikteaches

Why this form is not part of the treatment consent

Treatment consent is about care. Social media permission is about marketing, and the two have different rules and different consequences. Putting them on one page invites the patient who is nervous about the dentist to tick everything. Under Article 7 of the GDPR (the UK GDPR keeps the same wording), a consent request inside a document that covers other matters must be clearly distinguishable from them and written in clear, plain language, and whether a service is made conditional on agreeing to something it does not need is taken into account when judging whether consent was freely given. The HIPAA Privacy Rule works through a written authorisation that may not be combined with other documents such as treatment paperwork, and treatment may not be made conditional on signing it. Confirm the details for your own situation with a qualified adviser, because I have described the principle, not your legal duty.

Connect on LinkedInSagnik Bhattacharya

So: one page, handed over after the clinical consent is done, with no pressure and no staff member standing over the patient. Put it in the new patient pack as an optional extra, and offer it again before any photo is taken for use online.

Subscribe on YouTube@sagnikteaches

Decide what you actually use images for

Before drafting a word, write down the uses. Each one needs its own tick box, because a patient might be happy to appear in a team photo but not in a before-and-after.

• Clinical photos for the record. Not marketing. These belong in the patient's notes and are covered by treatment consent and your records policy.
• Before-and-after photos of treatment. The most sensitive marketing use. Your dental regulator or professional body may have rules about how results can be shown, so check them before you post. A before-and-after also reveals something about the patient's health, and under the GDPR health data is a special category where consent has to be explicit (Article 9), which is one more reason for a separate, signed tick box.
• Photos of the patient in the practice. Smiles at reception, a patient with the team. Faces make these identifiable.
• Video. Short clips or a recorded testimonial. A voice and a face together are more identifying than a still.
• Written testimonials and review quotes. Words, with or without a first name. Even a first name and a town can identify someone in a small community.
• Channels. Website, Instagram, Facebook, TikTok, a printed leaflet, email newsletter, paid adverts. Paid adverts deserve their own tick, because the image may be shown to people outside your followers and kept in an advertising platform's systems.

Sample wording, clause by clause

The wording below is illustrative and written in plain English. It is a starting point for your adviser to mark up, not legal text to publish. Placeholders are in square brackets.

Opening statement

[Practice name] would like to share some patient photos, videos and comments on our website and social media to show what we do. This is entirely optional. Whether you say yes or no makes no difference to your care or how we treat you.

What we would use

Please tick each one you are happy with:
[ ] Photos of me during or after treatment, without my face (teeth and smile only)
[ ] Photos of me during or after treatment, including my face
[ ] Photos of me with the team or in the practice
[ ] Video of me
[ ] A written comment from me, with my first name only
[ ] A written comment from me, with no name
[ ] Use in paid adverts as well as on our own pages

Offering "without my face" as its own option matters, because it is often the version patients agree to. An example from a before-and-after workflow: a patient who will not allow a full-face image often agrees to a close-up of the teeth, taken with no identifying marks, jewellery or distinctive clothing in frame.

Where and how long

We may use these on our website, our Instagram, Facebook and [other channels], and in printed material. We will keep using them for up to [three] years from today unless you ask us to stop sooner. After that we will ask you again or remove them.

A time limit is friendlier and easier to defend than "forever". Three years is an example; choose a period your adviser is comfortable with and put a diary reminder in to review old posts.

Who might see them

Once something is posted online, other people can see it, share it or save a copy. We cannot control copies made by other people or by the social media platforms.

It is honest, and it prevents the later complaint that the practice promised removal it could not deliver.

Names and identifying details

We will not include your surname, address, date of birth or treatment details beyond what you have agreed to here. [We will not tag you or use your social media handle unless you ask us to.]

Withdrawing consent

You can change your mind at any time. Tell any member of the team, or email or message us, and we will remove the item from our own pages within [seven] days. This will not affect your care. It will not undo use that has already happened, and we cannot delete copies made by others.

Under the GDPR, withdrawing has to be as easy as giving consent, and the person must be told about the right to withdraw before they consent; both points are covered here. If your patients agreed in person at the desk, make withdrawal possible at the desk too, not only through a form on a website.

No pressure and no reward

You do not have to sign this form. If you do not, we will treat you in exactly the same way. [We do not offer discounts or gifts in return for photos or comments.]

If you do give something in return, such as a discount or a free whitening kit, advertising and consumer-protection guidance in many places expects that connection to be disclosed alongside the testimonial, and an incentive must never depend on the comment being positive. Check with your adviser before offering one.

Signature

Name, date, signature. For a patient under 18: name of the child, name and relationship of the parent or guardian, signature and date. A line for the person who took consent, and the date.

Give the patient a copy, and keep the signed original with a note of the version. The GDPR requires you to be able to demonstrate that a patient consented, and the HIPAA rule requires a covered practice to keep signed authorisations and hand the patient a copy.

HIPAA authorisation: what the regulation text requires

If your practice is a covered entity under HIPAA, the Privacy Rule's section on authorisations (45 CFR 164.508) says protected health information may not be used or disclosed without a valid written authorisation unless the rule permits it, and it names marketing as a use that needs one, with narrow exceptions for face-to-face communication and promotional gifts of nominal value. An identifiable patient photo or testimonial on social media does not fit the routine uses the rule allows without permission, so plan on a signed authorisation and ask your lawyer to confirm.

Read from the regulation text, a valid authorisation must contain at least:

• A specific description of the information, such as "photos of my teeth taken before and after treatment, and my written comment".
• Who is making the disclosure (the practice) and who may receive it, which for a public post means anyone who views the named channels.
• The purpose of each use, for example "to show examples of our work on our website and social media".
• An expiry date or event, such as three years from signing.
• The patient's signature and date; when a parent or other personal representative signs, a description of their authority to act.
• Three statements: the right to revoke in writing, with how to do it and the exceptions (or a reference to your notice of privacy practices); that treatment does not depend on signing; and that information disclosed may be shared again by the recipient and no longer be protected by the rule.

The same section requires plain language, a copy of the signed form for the patient and a retained copy on file. It also bars combining an authorisation with other documents, outside a few narrow exceptions, which is a second reason to keep this page apart from treatment consent. If a third party pays the practice in connection with the marketing, the form must say that payment is involved.

Set against the sample clauses above, a version for a HIPAA-covered practice needs three additions: a redisclosure sentence saying the information may no longer be protected (the "Who might see them" clause comes close but does not say it), a line in the guardian signature block describing the signer's authority, and a written revocation route. Under the rule a revocation has to be in writing, so when a patient asks at the desk, write the request down there and then and have them sign it or confirm by message. The withdrawal clause can stay friendly; the record behind it must be written. This is a reading of the regulation, not legal advice, so have your lawyer compare your form with what applies to you.

Minors, carers and people who may not be able to consent

Treat children's images with extra care. The parent or guardian with legal authority gives permission, and a child old enough to understand should be asked as well, with a clear way to say no. Reduce identifying detail: no school uniform or name, no first name and age together, no location. Many practices simply decide never to show children's faces online, and a policy line is clearer than a case-by-case argument.

For adults who may lack capacity, do not rely on a family member's signature unless your adviser confirms they have the legal authority. The simplest rule is not to use images of patients who cannot give their own consent.

Drafting with AI, step by step

AI is useful in three places: simplifying wording, producing variants for different audiences, and checking a draft for gaps. It is not useful for deciding what the law requires.

1. Write your decisions. The uses, channels, time limit, withdrawal route and who may consent for a minor.
2. Ask the AI for plain wording from those facts. Include a rule that it may not add rights, promises or legal claims.
3. Compare the draft with the sample clauses above. Mark every sentence that is not backed by your decisions.
4. Send the original and the draft to your lawyer. Ask what must change for your situation.
5. Test it on three patients. Ask them to explain in their own words what they have agreed to.

You are drafting a patient consent form for a dental practice's use of
patient photos, video and testimonials on social media. Use plain
English at a reading age of about 12, short sentences, no legal jargon.

Use ONLY these decisions:
- Uses: teeth-only photos, face photos, team photos, video, written comments
  (first name or anonymous), paid adverts
- Channels: website, Instagram, Facebook, printed leaflets
- Duration: up to three years, then renewed or removed
- Withdrawal: tell any team member or message us; we remove items from our
  own pages within seven days; earlier use and copies by others cannot be undone
- No effect on treatment; no rewards offered
- Minors: a parent or guardian signs; no faces of children

Write the form with a short opening, tick boxes, the withdrawal paragraph,
a no-pressure paragraph and a signature block. Do NOT add legal claims,
rights, laws or promises not listed above. After the form, list any
assumptions you made and any points a lawyer should check.

A realistic first draft will usually add a sentence such as "your images will be stored securely in accordance with applicable law" or "we will never share your images with third parties". Both are promises you may not be able to keep. Delete them unless they are true and your adviser agrees, and keep the list of assumptions the AI produced, because it often points straight at the questions the lawyer needs to answer.

Testimonials: words need consent too

A patient's review is their own words, and quoting it on your website or in a social post is a separate act from the review sitting on a review platform. Ask before you copy a review into marketing, and record the permission. A short message does it: "Hi [first name], thank you for your kind review. May we use it on our website with your first name only? Reply YES, or NO if you would rather we did not." Keep the reply. Never edit a testimonial in a way that changes its meaning, and never invent or "improve" one with AI.

When replying to reviews publicly, do not confirm that someone is a patient or mention treatment, even to thank them, as that can itself disclose health information. The review replies tutorial shows safe wording. An AI can write the reply from the review text, but a person should check it for any detail that confirms a visit.

A walk-through: one patient, one form, one post

An illustration with an invented practice. A patient finishes a course of orthodontic work and says she is delighted. The treatment coordinator offers the optional social media form on a tablet, away from the chair. The patient ticks "teeth-only photos" and "written comment with first name only", leaves video and paid adverts blank, and signs. The coordinator stores the signed form in the record, with the version number and the date, and sets a review date three years ahead.

The marketing lead then prepares a post with the teeth-only before-and-after image, uses the patient's first name and one sentence from her own message after checking she agreed to it, and runs the caption past the clinical lead, who confirms it makes no promise about results. A year later the patient asks the receptionist to take it down. The receptionist records the request on the same form, the marketing lead removes the post within the seven days promised, and a note is made of where the image was used. Every step relies on the form being specific, optional and easy to reverse.

Mistakes that turn a consent form into a complaint

• Photographing first, asking later. Ask before the camera comes out, and delete images from a phone once they are in the patient's record or the approved folder.
• Personal phones. Staff photos taken on private devices end up in personal cloud backups. Use a practice device or an approved app and a clear rule about it.
• Posting before the form is checked. Make a signed form a required step in the content workflow, with a tick for "consent confirmed" before anything is scheduled.
• Forgetting old posts. A time limit means nothing without a diary check. Review old posts at least yearly and remove any whose permission has lapsed.
• Letting an AI tool see patient images. Do not upload identifiable photos to a general chat tool. If you use an image editing or captioning tool, check its terms for patient data, as the staff AI tools tutorial explains. Captions can be drafted from a description that contains no patient details.
• Leaving details in the picture. A name badge, a screen showing a record or a visible appointment book can identify someone. Check the whole frame.

How the front desk asks, in words that stay neutral

How the form is offered decides how many patients feel free to say no. A good script: "We sometimes share photos and comments on our website and social pages. It is completely optional and makes no difference to your treatment. Would you like to look at the form, or skip it?" A poor one: "Just sign here so we can use your photos." The first treats the form as a choice, which it must be. Practise both with staff and make the neutral version the standard. An AI can play the hesitant patient in a role play, using no real patient details, and you can ask it to point out any sentence that pushes.

Record a decline as carefully as a yes. A short note in the register, "declined, no images", prevents a well-meaning colleague from posting a group photo a month later. For team photos, ask everyone in the frame before posting, since one person's refusal applies to the whole picture.

Keeping a register so that withdrawal actually works

Withdrawal only works if you can find the post. Keep a simple register, a spreadsheet will do, with one row per use: form reference (not the patient's name if the sheet is widely shared), what was used, where it was posted, the date, the expiry date and the status. When someone withdraws, you search by form reference and remove each row's item. Ask an AI to design the columns or to write the formulas that highlight rows nearing expiry; do not give it the patient names or images. A quick sum shows why the register matters: a practice that posts three patient items a week has about 156 rows after a year, and roughly 470 by the time the first three-year permissions expire. Nobody tracks that from memory, but a filter on the expiry column showing the next 60 days takes seconds. A reminder for the register's monthly check can live in your task list, alongside other routines described in the policies and procedures manual.

If you plan your content around the people who have agreed, you will find that many posts need no patients at all. A monthly plan that mixes team introductions, education and practice news, such as the one in the 30-day content plan, keeps the pressure off patient photos.

Checking the routine works

Once a quarter, pick five live posts that show people and trace each back to a signed form, within the expiry date, covering that use and that channel. If any fails, take the post down first and fix the process second. Count how many withdrawal requests arrive and how quickly they were completed; a request that took three weeks means the register or the owner needs attention. And ask the lawyer for a quick look at the form each year, since rules and platform practices change faster than most practices review them.

Questions about dental social media consent

Is a general treatment consent enough for social media photos?

No. Permission to use images in marketing should be separate, specific and optional, with a clear no that does not affect treatment. Bundling it into a general consent weakens it, and under rules such as the GDPR consent must be distinguishable from other matters.

Can a patient withdraw consent after a photo is posted?

Yes, and the form should say how. Under the GDPR withdrawing must be as easy as giving consent, though it does not undo earlier use. Decide in advance how quickly you will remove posts you control and be honest that copies shared by others may remain.

Do I need a different form for children?

Yes. A parent or legal guardian must give permission, and a child old enough to understand should be asked as well. Avoid showing faces, names or school details, and apply the same withdrawal rights. Ask your adviser what age and rules apply to you.

Can AI write the consent form?

It can draft plain-language wording from your decisions for a lawyer to check. It cannot know which health-privacy or data-protection rules apply to you, so never publish an AI draft without a local legal review.

Further reads

• AI SEO for Dentists: Getting Found When Patients Ask ChatGPT — Get found without relying on patient photographs.
• Dental Practice AI Mistakes: Consent, Data, and Over-Automation — Check consent, data and over-automation slips.
• Can Dentists Use ChatGPT? Seven Admin Jobs With No Patient Data — Use ChatGPT for admin jobs that need no patient data.
• Telling Patients You Use AI Note-Taking: Consent Wording That Works — Word a separate consent for AI note-taking.
• Patient Data and AI: A Confidentiality Checklist for Small Practices — Check how patient data and images are handled.
• AI Video for Salons: Turn Before-and-After Photos Into Short Reels — A salon workflow for before-and-after reels: consent, matched photos, a free-to-cheap editing app, checked captions and licensed music, with nothing faked.
• Hair Salon Consultation Form: Colour History and Consent With AI — A grouped consultation form checklist: colour history, reactions, patch-test status, scalp checks and separate photo consent, plus storage rules and AI prompts.
• Personal Trainer Social Media Posts: A Month of Content With AI — A four-week plan of 20 posts for a personal trainer, caption prompts that stay inside your facts, and the no-false-claims check for results posts.
• Can a Personal Trainer Edit Testimonials With AI? What Is Allowed — What AI may and may not do to a client's testimonial: consent, result claims, light edits and a four-minute check before you post.
• AI for Psych Providers: Telehealth Consent Forms and Reminders — Draft a telehealth consent form with AI as a first draft, then run it through named clinician and legal review steps before use.
• Care Home Newsletter Ideas: AI-Drafted Family Updates With Consent — Care home newsletter sections, a consent check for photos and names, and a full sample edition drafted with AI and reviewed before sending.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: GDPR Articles 7 and 9 (gdpr-info.eu) and UK GDPR Article 7 (legislation.gov.uk, archived copy); 45 CFR 164.508, the HIPAA Privacy Rule section on authorisations (Cornell Legal Information Institute); a consumer-protection regulator's endorsement guidance FAQ. All read 4 November 2026. Legal wording must be reviewed by a qualified local adviser.