That was my mindset in August, when I arrived for a repeat Brazilian appointment at a Ponsonby laser clinic. Being led, as I had been multiple times before, into a small clinical room for the procedure, I was eager to work through the motions quick smart. I all but had my trousers around my ankles, and was reaching for the wet wipes when a smiling staff member suited in scrubs asked, “You’ve filled out a new consent form right?”
I hadn’t – but this was my fifth treatment, and nothing had changed so that should all be covered right? Wrong. The clinic had recently re-branded, being subsumed by The Cosmetics Clinic, a chain originating in Australia with approximately 200 clinics across Australia and New Zealand. I was required to fill out a new consent form.
No big deal – I went through a stock-standard consent form, confirming details of my medical history, suitability for the procedure and that I understood the aftercare requirements. As I do with all beauty treatments, boxes consenting to photos were left unticked – my face is not close-up ready, and neither are my nethers. “Okay great,” the scrubs-clad technician said, taking back ownership of the iPad and aiming it at me. “We’ll just do the photos first.”
“Oh, no,” I began, assuming they’d not read my form correctly. “I didn’t consent to the photos”. Turns out I was the confused party. The photos I’d declined were for promotional and training purposes, as the technician told me; “We still have to do before pictures.”
“Oh, sorry no,” I stammered, feeling my cheeks flush. “I’m getting a Brazilian laser… I’m not letting you take pictures of my vagina.”
Pushing aside the strange irony in the fact I would willingly let them aim a laser at my cooch but not a tablet with a camera, I focused in on my gut reaction. In an age of increasingly malicious cyber activity, why would I have confidence the device my mother uses to watch crime procedurals and do crosswords can securely store pictures of my half-zapped privates.
At an impasse, I was led out to the reception area where the store manager confirmed “It’s a shame you can’t continue, but it is our protocol. ”
I asked if I was the first person who wasn’t okay with their privates being papped? Was I the lone prude?
“Everyone has been okay with those,” the manager replied, adding that they weren’t requesting vagina snaps. “It’s literally your bikini line, it’s at the top.”
Walking home, I started to wonder how common practice the request was, and whether it was warranted.
Contacting the clinic with questions for this story, Selina Hornibrook, director of The Cosmetic Clinic, explained their in-house policy. She said their network of clinics “was founded in Queensland, which currently has the highest level of regulation of any state in Australia or NZ for laser hair removal. TCC uses the same operating protocols that are required for laser hair removal by the Queensland Department of Health. The regulations are far in excess of what is required by Auckland Council.”
It may be common practice for laser technicians to take photographs before a laser treatment, but it’s not mandated, Hornibrook conceded. In the additional recommendations section of their “Pulsed light and laser treatment code of practice”, Auckland Council suggests practitioners “photograph clean skin close-up”.
In a follow-up email, Hornibrook clarified that “The Queensland Department of Health does not specifically recommend or require that photos be taken during laser hair removal treatments. However, they do acknowledge that photographs may be useful for clinical documentation purposes, such as tracking the progress of treatments or for pre- and post-treatment comparison.”
This aligns with the justification provided for The Cosmetic Clinic’s request. “Before and after photos serve as a record in case of any disputes or complaints. They provide proof of the client’s original condition and the treatment outcomes.”
Hornibrook added staff are instructed to only photograph the exposed area of the lower abdomen region and nothing underneath, pointing to the company’s Laser Hair Protocol book which states “When photos are taken of the intimate areas, ensure to cover the unexposed areas (labia) with bluey [disposable plastic bed pads] for client modesty.”
Policies differ at other clinics in New Zealand. Taryn Johnstone, clinical support lead at Caci Clinics said generally, it is their policy to take photos before commencing any treatment, as a way to track progress and record results. “With more than 30,000 Laser Hair Removal treatments carried out at Caci per year, it is not a common occurrence for customers to decline, however, we respect their decision to do so, and it does not impact the treatment being performed.”
It’s a similar situation at Off and On, a New Zealand “beauty maintenance” business with six stores nationwide. General manager Claire Weathers explains, “A small percentage of clients may choose not to have their treatment progress photographed. In such cases, this preference is clearly noted in their records, and we fully respect and honour their decision. Treatment will proceed as scheduled without any photographic documentation.”
President of the NZ Association of Registered Beauty Professionals, Emma Fraser, says although there is no lawful requirement for businesses to take such imagery, they can request it at their discretion. “There’s no hard and fast rule… every business can set their own policy and procedure relating to that.”
“Before and after photos come down to an individual company and what they’re wanting the information for,” Fraser says. “For any photo evidence you would need to get your client to consent to that and let the client know what the intended use is.”
However, Fraser says it is also “absolutely” a client prerogative to decline to have photos taken and still have the service performed.
Many beauty therapists and cosmetic clinics aren’t generally regulated in the same way medical practitioners who get licensed by appropriate boards might be, but Stephen Drysdale, a practice leader at commercial law firm LegalVision, says beauty consumers can be assured that The Privacy Act 2020 applies to all businesses of any size and scale, and all industries, and ensures they only collect personal information where it is necessary for a lawful function or activity of the business.
“The act governs how organisations and businesses collect, store, use and disclose your information,” Drysdale says.
“A major obligation around collection is around data minimisation. So only collecting what’s actually reasonably necessary to carry out your organisation’s functions.
“It’s quite important that your cosmetic beauty clinic know your name, they might need to know how to contact you to remind you about appointments, things like that. But really it has to be kind of reasonable.
“Talking about things like before and after photos, for example. What is the purpose for that? Is it for marketing? Is it for their own risk of getting sued? Realistically, if the information being asked for isn’t necessary to achieve something that’s closely linked, then you shouldn’t ask for it.”
Privacy Commissioner Michael Webster says businesses are also required under the act to “be fair and transparent when collecting personal information”. In this context, fairness will require the business to think about whether a separate consent clause around collection and use of images is required.
“A separate clause is far clearer than it being included within a long list of terms and conditions, which people are unlikely to read or fully understand,” Webster says. “Ideally this clause should be an opt-in or opt-out, with people who decide to opt-out still being entitled to receive treatment.”
Webster also emphasised that agencies that collect and handle sensitive data need to take extra care to ensure the information is handled properly.
“Sensitive personal information is information about the individual that has some real significance to them, is revealing of them, or generally relates to matters that an individual might wish to keep private. Some people may regard images of their appearance used in beauty treatments to be sensitive, or even highly sensitive.”
Another of the principles set out in the act guides taking reasonable steps to safeguard personal information and safeguarding that from loss, misuse or unauthorised disclosure. In terms of beauty clinics and imagery of clients, Drysdale says, “this includes limits on things like employee browsing of information, having access controls”.
Hornibrook advises The Cosmetic Clinic “takes a very strict and highly controlled and managed approach to client data and access privileges for our staff”.
“We have a zero-trust approach to all our digital records meaning only users that have a need to access client’s profiles have access.”
She advises The Cosmetic Clinic’s client photos and records are “digitally and securely stored” using a client management system that has “stringent security policies”.
Speaking directly to my hesitancy towards iPads – Hornibrook advises “The capability to Airdrop, email, or share files from clinical devices to any other device, except our Point-of-Sale system, has been disabled.”
For any customer, or potential customer with queries about the type of private information a business is gathering, and how that information is being retained, Drysdale recommends seeking out that organisation’s privacy policy as a first port of call.
“That’s usually set out in a privacy statement on the website or privacy policy and cover things like, Why do we collect information and what are we collecting? Who is going to have access to that information? It should have all that information because it’s required by law.”
The Privacy Commissioner suggests people take the time to read privacy terms and conditions and understand what they’re agreeing to. “If uncertain about what a clause means, ask the business to clarify, don’t agree, or opt out of that provision,”
“If people are concerned their privacy has been breached, they should contact the relevant agency in the first instance. And then if they’re not satisfied, they can complain to us.”
Acknowledging a lack of standardisation in beauty therapy training and regulation and the “minefield” that creates for consumers, Fraser encourages beauty clients to ask questions of the people performing their services.
“As the general public, you are absolutely within your rights to ask what qualification or certifications someone completing your treatment has. It’s okay to ask, and you need to do it, to make sure the professional carrying out the service is doing it in a professional manner and abiding by health and hygiene regulations and understanding the consequences of their procedures.”
These words run through my mind a few weeks later when I’m checking into a different clinic for my next laser appointment. “I just have a question about the photos…” I venture as I hand over the iPad with the consent form filled in, bar one box.
“OMG no don’t worry, we don’t do photos for this treatment,” the technician laughs before I can finish my sentence. “Can you imagine? If I came at you with the iPad?”
