Patch Test and Consultation Records: What to Keep and How Long

Beauty therapists should keep a signed consultation form for every client, a dated record of every patch test and its result, and a short note of each treatment. There’s no single legal retention period for these records: UK GDPR says you must decide one, write it down and be able to justify it, and your insurer’s policy wording is the most important thing to check when you choose.

This guide covers what to record, how long to keep it, and the data protection basics from the ICO that apply to every therapist, including sole traders working from home.

Why these records matter

If a client has a reaction or makes a complaint, your records are your evidence. A completed consultation form shows you asked about allergies and medical conditions. A dated patch test record shows you tested and what the result was. Without them it’s your word against theirs, and your insurer may struggle to defend you. The NHF and NBF advise therapists to check that their insurer will cover the patch testing systems they have in place.

What to record on a client consultation form

• Contact details: name, phone, email, and an emergency contact.
• Date of birth or age confirmation: important because some treatments have minimum ages (see below).
• Medical history and contraindications: skin conditions, diabetes, epilepsy, recent surgery, eye conditions for lash and brow work, and anything relevant to the treatment.
• Medication: for example, some acne medicines and blood thinners affect waxing and skin treatments.
• Allergies and previous reactions: to products, latex, adhesives or hair dye.
• Pregnancy where it’s relevant to the treatment.
• Client declaration and signature: confirming the information is accurate and that they’ll tell you about changes.
• Date of review: ask returning clients whether anything has changed at each visit and note it.

What to record for each patch test

A patch test record is only useful if it shows exactly what was tested and when. Keep:

• Date and time the test was applied.
• Product name and shade, and the batch number if the product has one.
• Where on the body it was applied.
• Who carried it out.
• The result at the check, and the date of the treatment it relates to.
• Aftercare and reaction advice given, and the client’s signature.

Timing: follow the manufacturer’s instructions for each product, as they set the minimum time between test and treatment. The NHF/NBF says sensitivity tests for new clients should be done at least 24 hours before lash perming or lash extensions; many tint manufacturers specify longer. If you change brand or the formula changes, test again.

Under-16s: NHF/NBF guidance is that tint shouldn’t be applied to eyebrows or eyelashes for clients under 16, and allergy alert tests should never be carried out on under-16s. Insurance usually won’t cover treatments outside your qualifications or below age limits.

What to record for each treatment

• Date, treatment and who carried it out.
• Products used, and settings or strengths where relevant (for example lash lift processing time).
• Any reaction, problem or complaint, and what you did about it.
• Aftercare advice given.

How long should beauty therapists keep client records?

The ICO is clear that UK GDPR doesn’t set specific time limits. You decide, based on why you hold the data, and you shouldn’t keep it indefinitely “just in case”. Three things should shape your decision:

1. Possible claims. The ICO says you can consider whether you need records to defend future legal claims. Under the Limitation Act 1980, personal injury claims can generally be brought within three years of the injury or of the date the person became aware of it, and the clock usually doesn’t start for children until they turn 18. That’s why therapists keep consultation and patch test records for a period after the client’s last visit, not just after each treatment.
2. Your insurer. Read your policy or ask. Some insurers and trade bodies give a recommended period (the NHF/NBF has suggested four years for health questionnaires), and following your insurer’s expectation is the safest choice.
3. Tax records. Your financial records (bookings, payments, receipts) are separate. HMRC says sole traders must keep them for at least 5 years after the 31 January deadline for that tax year.

A simple policy might read: “Consultation forms, patch test and treatment records are kept for X years after the client’s last appointment, then securely deleted or shredded.” Choose X with your insurer’s guidance, write it down, and actually review your files once a year.

GDPR basics for beauty therapists

Health information is special category data

Allergies, medical conditions and medication count as special category data. As well as a lawful basis, you need an additional condition for processing it. For most therapists that’s the client’s explicit consent, so the consultation form should say what you collect, why, and ask the client to agree.

Tell clients what you do with their data

A short privacy notice on your website or the back of the form should explain what you collect, why, how long you keep it, and how clients can ask for a copy or ask you to delete it.

Keep it secure

• Paper forms in a locked cabinet, not a drawer at reception.
• Digital records password-protected; turn on two-step sign-in for cloud accounts.
• Don’t share spreadsheets of client details by link, and don’t keep health details in your phone’s notes app.

Check whether you need to pay the data protection fee

Most organisations that use personal information, including sole traders, must pay the ICO a data protection fee unless they’re exempt. The ICO says most will pay £52 or £78 a year. Use the ICO’s fee self-assessment to check if it applies to you.

An easy way to keep on top of it

The Beautician Studio Command Centre keeps your bookings, client list and patch test reminders together in one spreadsheet. It doesn’t replace a signed consultation form, but it makes sure nobody gets treated before their patch test is done.

• Bookings log each treatment with client name, service and patch-test/allergy notes.
• Workflow board moves each job from Booked through Patch Test Due, Confirmed, In Treatment and Completed.
• Clients tab holds phone, email, notes, total bookings and lifetime revenue per client.
• Works in Excel or Google Sheets, so you can keep the file in a password-protected account.

See the Beautician Studio Command Centre →

Once your records are sorted, make sure your prices cover your time and products: see how to price beauty treatments.

Client records FAQs

Do I need a new consultation form every visit?

Not a full form, but ask at each visit whether anything has changed (new medication, pregnancy, a reaction elsewhere) and note the answer and date. Many therapists ask clients to complete a fresh form once a year.

How long is a patch test valid for?

Follow the product manufacturer’s instructions. Many specify retesting if a set period has passed since the last treatment, and you should always retest if the client has had a reaction elsewhere or you change product.

Can a client ask me to delete their records?

Yes, clients can ask, but the right to erasure isn’t absolute. You can keep information you need to defend a possible legal claim. Explain this in your privacy notice so clients know in advance.

Can I store consultation forms digitally?

Yes, as long as they’re secure and you can show what the client agreed to. A photo or scan of a signed paper form, stored in a protected account, works for many solo therapists.

This guide is general information, not legal or insurance advice. Check your insurer’s requirements, product manufacturers’ instructions and the ICO’s guidance for your own business.