Before and after photos: how to take, store and publish them

Tripod, distance, settings

Use the same camera, lens, settings, magnification, lighting and positions at every visit. The camera goes on a tripod, with a mark on the floor for the distance: a plastic surgery review gives about 1.5 meters from the patient, level with the area photographed. Photograph after treatment only when edema, sutures and hematomas have resolved, and if possible with the same photographer, who first looks at the photos from the previous visit. A phone held by hand, without a support, changes from one shot to the next.

Light, background and patient preparation

The light must be soft and even: direct flash bleaches skin detail and flattens color. A 2016 review proposes at least two softboxes at 45 degrees to the subject; at 90 degrees the shadows accentuate, for example, the nasojugal groove. The background is neutral, non-reflective and single-colored (white, gray or blue), and the patient stands at least one foot, about 30 centimeters, in front of it. No makeup, hair tucked behind the ears, no jewelry. A room without windows keeps the light constant through the day.

The views to take at every visit

For the face the review lists five basic shots: frontal, right and left oblique, right and left lateral, with the patient seated, hands on the knees, in anatomical position and with the Frankfurt plane horizontal. For the oblique view the whole body turns 45 degrees, turning the face alone is not enough. For the lateral view the body turns 90 degrees and the expression is neutral. For dynamic wrinkles you add the expression; for the lips, also with pursed lips.

Storing them: they are health data

A clinical photo in the record is health data: article 9 of the GDPR forbids processing it, except in the cases provided, and article 32 requires security measures appropriate to the risk. A breach is notified to the Garante within 72 hours, where possible (art. 33). In the decisions we read, the Garante reminds that consent from the patient is not needed for processing necessary for the health service requested; for care it is enough to hand over the privacy notice, stating that the photos are part of the record.

The privacy notice must say how long you keep the photos, and the patient may ask for them: in 2024 the Garante fined a surgeon 4,000 euros for not answering in time a patient who wanted her pre-operative photos, with a notice that gave no retention period. A 2024 review lists end-to-end encryption, two-factor authentication, remote wipe and periodic audits as measures, and advises not framing face and body together and leaving out recognizable tattoos.

Publishing them: a separate consent

The Garante fined a surgeon 20,000 euros for publishing on Instagram the before and after photos of a patient: the signed consents did not include publication and the photos had been taken for internal use, so outside the purposes of care (12 December 2024). An aesthetic center was fined 8,000 euros for a video showing a patient's face: tacit consent during filming is not enough, explicit consent is required (11 January 2024). Another surgeon was fined 5,000 euros because the form promised use of the images with a guarantee of anonymity, but the face remained recognizable (29 January 2026): a consent given for an anonymous release that did not happen is not valid. A before and after on social media is also a healthcare communication: Law 145 of 2018 excludes offers, discounts and promotions (art. 1, paragraph 525). The comparison must be made under equal conditions: in a study cited by the 2024 review, 70.8% of social media images favored the after photo, usually with a more flattering background.

In Fibonacci

Each photo is encrypted in the browser before it is sent and, before saving, the EXIF metadata is removed, location included. A shot can declare its view (frontal, lateral, 45-degree oblique, dynamic) and the camera shows the previous shot of the same view as an overlay, to repeat the framing. On upload you declare the purpose: clinical, teaching or promotional; the last two depend on a separate, revocable consent. Every time a photo is opened it enters the access log.