Botox and Injectables Clinics
Patient Consent and Documentation in Injectables Clinics: A Practical Overview
An operational overview of consent and record-keeping for injectables clinics in Ontario: why documentation matters, what to record, privacy, and staff access.

Key takeaways
- Consent is a conversation led by the treating professional; the signed form records it.
- Your legal and professional obligations depend on your province, your college, and the treatment.
- Record consent, treatment details, and follow-up consistently, and keep records secure.
- Limit access to clinical records to the people who need it, and keep an audit trail.
Consent and documentation sit at the centre of every injectables clinic. They protect clients, support safe care, and protect practitioners if questions arise later. Yet in busy clinics they can drift into a box-ticking exercise: a form handed over at reception and signed without discussion.
This article is an operational overview for clinic owners and managers. It explains why consent and documentation matter, what a well-organised process looks like, and how to handle privacy and staff access.
What consent means in practice
In Ontario, the Health Care Consent Act, 1996 (opens in a new tab) sets out rules for consent to treatment. Among other things, it describes consent that is informed, given voluntarily, and not obtained through misrepresentation or fraud. Regulatory colleges publish their own expectations for members; for physicians, for example, the College of Physicians and Surgeons of Ontario has a Consent to Treatment policy (opens in a new tab), and the College of Nurses of Ontario has published a practice guideline on aesthetic services (opens in a new tab) for nurses.
Operationally, three points matter for any clinic:
- Consent is obtained by the appropriate professional, through a discussion of the proposed treatment, its expected benefits, material risks and side effects, alternatives, and what happens if the client does nothing. Reception staff can't obtain consent on a clinician's behalf.
- The form documents the conversation. A signature is evidence that consent was discussed; it doesn't replace the discussion.
- Consent is ongoing. Clients can ask questions or withdraw consent at any time, and consent may need to be revisited when the treatment, the client's health, or the product changes.
Design a consent workflow
A typical sequence
- Send medical history and intake forms when the consultation is booked, so they're complete before the visit.
- The clinician reviews the history before the appointment and notes anything to discuss.
- At the consultation, the clinician discusses the treatment and answers questions.
- The client signs a consent form specific to the treatment, with the date and the form version recorded.
- The clinician documents the discussion in the client's record, as their college requires.
- Consent is reviewed at later visits according to your clinical policy, and whenever something material changes.
Keep a version history for consent forms. If you update a form, earlier clients' records should still show the version they actually signed.
What to document
Each regulated professional must meet their own college's documentation standards — these vary, and they take priority over any general checklist. Operationally, most injectables clinics keep the following in the client's record:
- Identification and contact details, and an emergency contact if your policy requires one.
- Medical history and relevant updates at each visit.
- The signed consent form and a note of the consent discussion.
- The assessment and treatment plan.
- Treatment details: date, practitioner, product, lot number and expiry where your policy requires it, and treatment areas, in line with college standards.
- Photographs, only with specific consent and stored securely within the client record.
- Aftercare information provided, and any follow-up booked.
- Any adverse events, concerns raised, and how they were handled.
Write notes at the time of the visit or as soon as possible afterwards. Corrections should be made in a way that keeps the original entry visible, with the date and the person making the change.
Privacy: who can see what
Injectables records contain personal health information, and clients often consider aesthetic treatments especially private. In Ontario, health information custodians are subject to the Personal Health Information Protection Act, 2004 (PHIPA) (opens in a new tab); other organisations may fall under federal privacy law. The Information and Privacy Commissioner of Ontario (opens in a new tab) publishes guidance for health care providers.
Privacy practices to put in place
- Identify who is responsible for privacy in your clinic, and write a short privacy policy.
- Give each team member access only to the information their role requires.
- Use individual accounts — never shared logins — so access can be traced.
- Turn on two-step verification for systems that hold client records.
- Keep records out of personal email, personal phones, and consumer messaging apps.
- Have a plan for responding to a privacy breach, including who to notify.
- Train staff on privacy when they join, and refresh it regularly.
Retention and access requests
Records must be kept for a period set by law and by each professional's college, and clients generally have a right to access their own records. Retention periods differ between professions, so document a retention policy for your clinic based on the strictest requirement that applies to your team, and confirm it with each practitioner's college.
Common gaps to check
- Consent forms signed at reception without a documented conversation with the clinician.
- Generic consent forms that don't match the treatment provided.
- Treatment photographs on practitioners' personal phones.
- Shared logins, so no one can tell who viewed or edited a record.
- Notes written days later from memory.
- No record of which version of a consent form a client signed.
How software supports the process
Good software doesn't obtain consent for you, but it makes a sound process easier to follow every time. MedClinora lets clinics send intake and consent forms before the visit, keep signed forms and treatment notes on the client's record, maintain consent records and a before-and-after photo timeline, and control access by team role. See the features page for availability.
A strong consent and documentation process is one your whole team understands and follows consistently. Write it down, confirm it against your practitioners' college requirements, and review it at least once a year. For related reading, see how to manage appointments and follow-ups at a Botox clinic and managing client records at a laser or skin clinic.
Sources and further reading
- Ontario — Health Care Consent Act, 1996 (opens in a new tab)
- Ontario — Personal Health Information Protection Act, 2004 (opens in a new tab)
- College of Physicians and Surgeons of Ontario — Consent to Treatment policy (opens in a new tab)
- College of Nurses of Ontario — New guideline for nurses supports safe aesthetic services (opens in a new tab)
- Information and Privacy Commissioner of Ontario — Health privacy (opens in a new tab)
General information only. This article is educational and isn’t legal, tax, financial, or clinical advice. Requirements depend on your province, your professional college, your role, and the treatments you offer — confirm them with the relevant regulator or a qualified adviser.


