Informed Consent for Marketing

Informed consent for marketing is the specific written sign-off you need before a real patient's identity, words, photos, or story can appear in your promotion. It is narrower and more practical than HIPAA in the abstract: it is the document and the conversation that turn a glowing testimonial or a dramatic before-and-after photo from a liability into a usable asset. Without it, even a five-star review you reposted or a smiling patient in a waiting-room photo can become a privacy violation, because you have disclosed that a specific person received care.

The "informed" part is what gives this teeth and what marketers most often shortchange. A patient cannot meaningfully consent if they do not understand where their face or story will appear, for how long, and that they can change their mind. Before-and-after imagery in aesthetics and dermatology is especially sensitive, because it reveals both identity and medical history at once. Getting consent right protects the patient's autonomy and the practice's reputation simultaneously, and a sloppy consent process is one of the easiest compliance failures to avoid.

A valid marketing consent is a written, specific, and revocable authorization, not a vague checkbox.

Spell out exactly what will be used: the testimonial text, specific photos or video, the patient's name or first name only.
Name the channels and duration: website, social media, paid ads, printed brochures, and whether it is ongoing or time-limited.
State that consent is voluntary and that care will not be affected by refusing.
Explain the right to revoke, how to do it, and the practical limit that already-printed or already-distributed material may be hard to recall.
Keep the signed form on file, and re-consent if the use materially changes (for example, moving a testimonial from the website into a paid TV ad).

A worked example

Imagine a cosmetic dentistry practice that wants to feature a patient's smile-makeover photos on Instagram and in Google Ads. The coordinator walks the patient through a consent form that lists the exact images, names Instagram and Google Ads specifically, sets a two-year term, and explains how to withdraw consent by emailing the office. The patient signs, and the practice files the form. A year later the patient asks to remove the images, the practice pulls them from active channels and notes the revocation, honoring the agreement.

Frequently asked questions

Reposting a public review onto your own marketing is riskier than it looks, because you are amplifying the disclosure that a named person was your patient. The safest practice is to get explicit permission before featuring a named review in ads or on your site, and to avoid adding any clinical detail the patient did not already share publicly.

Verbal agreement is weak evidence and generally not sufficient for marketing use of patient information. Regulators and good practice both expect written, signed authorization that documents exactly what the patient agreed to, which also protects you if a dispute arises later.

You must stop using their information going forward and remove it from channels you control, such as your website and social profiles. Material already printed or distributed may be impractical to recall, which is precisely why the consent form should disclose that limitation upfront.

Keep reading: HIPAA, PHI (Protected Health Information). Each connects to Informed Consent for Marketing in a real workflow, not just by category.

The Patient Acquisition Blueprint (2026 Edition)

The exact 90-day patient-acquisition system, step by step.