Practical guide
Instagram and social media for the aesthetic doctor: what you may publish
Inform yes, promote no
The rule is in Law 145 of 2018, article 1, paragraph 525. Informative communications by registered professionals and private health facilities may contain only the information listed in article 2 of Decree-Law 223 of 2006: titles and specializations, features of the service, price and overall costs of the services, with transparency and truthfulness. What is excluded is “any attractive and suggestive element, including communications containing offers, discounts and promotions”. The code of medical ethics adds that the rule applies “by whatever means disseminated”, so to posts, stories and videos as well. The Ordine is the one who checks: it opens disciplinary proceedings and reports the violation to the communications authority (paragraph 536).
What you may publish
Article 56 of the code of medical ethics allows “exclusively” four things: professional titles and specializations, the professional activity, the features of the service offered and the fee for the services. In practice: your degree and specialization, the treatments you perform and how a session runs, the fee. The advertising must be “truthful, correct and functional to the subject of the information, never equivocal, misleading or disparaging”. Article 55 asks for health information that is “accessible, transparent, rigorous and prudent” and does not feed “unfounded expectations or fears”. You may state the fee but not a discount: the code allows the former, the 2018 law excludes the latter.
What you may not publish
No offers, discounts or promotions: paragraph 525 names them one by one. No messages that promise a result. Article 76 bis of the code asks, for aesthetic medicine, not to raise or feed illusory expectations in the information that precedes consent, and a post with a promise sits badly with article 56, which forbids equivocal or misleading advertising. No news about research advances not yet scientifically validated, and no comparisons between services unless there are measurable clinical indicators shared by the scientific community (article 56). Photos count too: an audit published in a plastic surgery journal (2022), covering 510 Instagram posts by 102 practitioners, judged 179 posts potentially misleading, mostly because of photos taken right after the treatment (82%) and selfies (16%).
Patient photos: the rule
The Garante treats the image of a patient filmed or photographed during an aesthetic medicine treatment as health data. Dissemination of such data is in general forbidden, except in the cases of article 9 GDPR (Legislative Decree 196 of 2003, article 2 septies, paragraph 8). For images used for teaching or scientific publication there is a code of conduct approved by the Garante on 14 January 2021: genuinely anonymous images are published and, where that is not possible, a specific, free and informed consent is needed, with the images pseudonymized. The code of medical ethics, article 11, asks to ensure that patients cannot be identified in scientific publications and disclosures. For promotion on social media, among the decisions we read there is no case in which the Garante says that consent makes a “before and after” with a recognizable face lawful.
Patient photos: three decisions by the Garante
On 12 December 2024 a surgeon was fined 20,000 euros for the “before and after” photos of a facelift posted on Instagram: they had been taken for internal use, the signed consent forms did not cover publication, and the doctor said someone else ran the profiles. On 11 January 2024 an aesthetic centre was fined 8,000 euros for a 34-second video showing a patient's face, which stayed online for 45 days: the tacit consent of someone who lets themselves be filmed is not valid, an explicit consent is needed, and the privacy notice spoke only generically of “articles on social media and magazines”. On 29 January 2026 a surgeon was fined 5,000 euros for photos of a rhinoseptoplasty captioned “Images with the patient's consent”: the form promised anonymity, the face was still recognizable and the consent was not valid. In that last case the Garante took good faith into account, because the form came from a scientific society, and fined anyway.
How to keep the profile in order
The profile is yours even if a collaborator runs it: in the 2024 case the fine went to the doctor, who said he did not know the consent was missing. Keep an archive of what you publish (text, date, channel) and, for each photo, know which consent it corresponds to. Consent to publication is a separate act from the one for care and can be withdrawn at any time (GDPR, article 7, paragraph 3). In Fibonacci every photo declares a purpose, clinical, teaching or promotional: the first stays in the record, the other two depend on a separate, revocable consent, and the shot's metadata, location included, is removed before saving.
To print
The checklist
- Reread every post before publishing it: titles, services, features of the service, fee, nothing else.
- Remove offers, discounts, promotions and any sentence that promises a result.
- Do not spread news about scientific advances that are not yet validated.
- For every patient photo, check which consent it has and that it is separate from the consent to care.
- If you say the photo is anonymous, check that it really is: removing the name or blurring one facial detail is not enough.
- Do not rely on the tacit consent of someone who let herself be filmed: an explicit consent is needed.
- Avoid photos taken right after the treatment and selfies: those are what the audit judged misleading.
- If a collaborator runs the profile, write down for them what they may publish and what not.
- Keep the text, date and channel of what you publish.
Further reading
- Legal protection: Healthcare advertising
- Legal protection: Photographs and data
- In the software: Photos
Sources
- Law 145 of 2018, article 1, paragraphs 525 and 536 (Normattiva)
- Decree-Law 223 of 2006, article 2 (Normattiva)
- Code of Medical Ethics, articles 11, 55, 56 and 76 bis (FNOMCeO)
- Regulation (EU) 2016/679, articles 7 and 9 (EUR-Lex)
- Garante per la protezione dei dati personali, decision of 12 December 2024
- Garante per la protezione dei dati personali, decision of 11 January 2024
- Garante per la protezione dei dati personali, decision of 29 January 2026
- Plastic and Reconstructive Surgery Global Open, 2022: audit of “before and after” photographs on Instagram
This guide explains what the cited laws and literature say. It is not legal advice or a clinical opinion on a case: for those you need your lawyer or a colleague.
Other guides
- The first visit in aesthetic medicine: what to record
- What to write in the record after a filler or botulinum toxin
- Before and after photos: how to take, store and publish them
- The patient asks for a copy of her record: deadlines, method, retention
- After a complication: what to document and whom to notify