Every salon that does patch tests, lash work, waxing or skin treatments takes a consultation form, and most do it responsibly. What is less understood is that once that form records an allergy, a medication, a pregnancy or a skin condition, it is no longer ordinary customer data. It is health information, which data protection law treats as a special category with stricter handling than a name and phone number.

This is not a reason for alarm, and it certainly is not a reason to stop taking the forms. Recording an allergy before you apply a product is exactly the right thing to do. The point is simply that the same care you take with the treatment should extend to the paperwork, because a shoebox of consultation cards under the till is a small pile of health records that anyone in the room could read.

The practical questions are all answerable. Where do the forms live, and who can get at them? If they are on paper, are they in a locked drawer rather than on the desk? If they are in a booking app, is the account protected by a proper password and a code on the phone, and does the salon know what the app provider does with the data? Most salons pass with one or two small fixes, not a rebuild.

There is also the matter of how long you keep them. A consultation form from a client who last visited four years ago is a liability with no upside. A simple rule - keep them while the client is active plus a sensible period, then shred or delete - reduces what you are holding and what you would ever have to explain if something went wrong.