Aesthetic clinic website compliance checklist 2026

Aesthetic medicine is the most lightly-regulated corner of the UK healthcare market, and that is a problem. The market is large, the actors range from dual-registered medical and dental doctors at the top to beauty therapists with weekend training at the bottom, and the regulatory environment is fragmented across three statutory bodies, two voluntary registers, an Advertising Standards Authority code and one piece of primary legislation specifically about under-18s.

Your website is the most public artefact of your clinic, and the easiest place for any of those regulators to look. This is the checklist I run when I sign off an aesthetic-clinic page. It's not legal advice — please get that from someone qualified to give it — but it captures the patterns I see clinics fall into, and the patterns the ones who get into trouble fall into.

The three regulators that matter

MHRA — Medicines and Healthcare products Regulatory Agency

The MHRA regulates anything classified as a medicine. In aesthetic medicine, the load-bearing rule is: prescription-only medicines (POMs) cannot be advertised to the public. That has two practical implications for your website.

First, you cannot list or imply prices for prescription-only treatments. That means no "£199 for one area of anti-wrinkle". No "£500 for 1ml of dermal filler". Not in your menu, not in your special offers, not in your social-post-to-website embeds. Anti-wrinkle injections (botulinum toxin), most dermal fillers, skinboosters, polynucleotides, and prescription topical treatments are all POMs.

Second, you cannot name brands of POMs in advertising. The brand names that ride along with anti-wrinkle and filler treatments are POM brand names. Mentioning them on a page selling the treatment is a problem.

The practical pattern: your treatment menu lists categories ("Anti-wrinkle treatment", "Dermal filler treatment") and explicitly says the price and product is discussed in your consultation. Your site funnels every patient interested in a POM treatment into a consultation booking, where you can talk through what's appropriate and quote a fee privately.

ASA — Advertising Standards Authority

The ASA's CAP and BCAP codes apply to your website as advertising. The relevant clauses for aesthetic clinics:

• No misleading "natural", "no risks", "guaranteed" or "permanent" claims. Patients can't be told a result is guaranteed, that recovery is risk-free, or that there are no side effects.
• No targeting under-18s. Imagery, copy and any incentives (referral schemes, discount codes) cannot be designed to attract or influence under-18s. We come back to under-18s in the Children Act section below.
• Before-and-after photos must be representative and consented. See the gallery section below.
• No special offers tied to surgical or invasive procedures. "£100 off if you book this week" is fine on a HydraFacial; not fine on dermal filler.

CQC — Care Quality Commission

Whether your clinic falls under CQC registration depends on what you do, not what you call yourself. The trigger conditions are well-documented at cqc.org.uk; for aesthetics, the main one is whether you carry out surgery or treatment that requires the listed regulated activities.

If you are CQC-registered, your website needs to make that visible: registration number, the activities you're registered for, link to your latest inspection report on the CQC website. If you aren't CQC-registered, don't imply you are.

JCCP and Save Face — the voluntary registers

Two voluntary registers cover qualified, insured and regulated aesthetic practitioners: the Joint Council for Cosmetic Practitioners (JCCP), accredited by the Professional Standards Authority, and Save Face, the longer-established practitioner register also recognised by the PSA.

Patients searching for "JCCP-registered aesthetic clinic near me" are doing exactly the right thing. If you're on either or both registers, treat both as first-class footer or about-page elements. Use the official logos. Link to your verification page on the register itself, not just a static logo. That outbound link is also a credibility signal for search engines, which is why Practice Digital sites mark these as structured Organization links.

The 2021 Act — under-18s

The Botulinum Toxin and Cosmetic Fillers (Children) Act 2021 makes it a criminal offence to administer botulinum toxin or filler to anyone under 18 for cosmetic reasons. Your booking flow needs to enforce this. The patterns we see fail:

• Booking forms with no date of birth. Someone under 18 can book without flagging.
• Date of birth collected but no age-gate on submit. The under-18 booking gets through to your inbox and creates a safeguarding event.
• Age gate present but only on POM treatments. If your facials and chemical peels don't ask, your front desk is the safety net — not good enough.

The right pattern: every aesthetic booking captures date of birth, and submissions for under-18s are blocked at the form level with a clear, kind refusal message and a signpost to GP or safeguarding advice. Practice Digital sites bake this in.

Before-and-after photos

Three rules:

1. Written consent for every image. Verbal consent isn't enough. Get it in writing, attach it to the image record, store it alongside the patient's notes.

2. Consent has an expiry. Patients can withdraw consent. Photos older than 12–18 months may need re-consent. Build a process where consent expiry triggers an automatic unpublish.

3. The pair must be representative. The "before" can't be poorly lit, frowning, no make-up; the "after" can't be magazine-styled, glowing, full make-up. The ASA reads representative as photographically representative — same lighting, same angle, same expression, ideally same time of day.

The 10-point checklist

1. Treatment menu lists categories of POM treatments, not specific brands or prices.
2. Every POM treatment funnels into a consultation booking.
3. Booking form captures date of birth and blocks under-18 submissions at the form level.
4. JCCP / Save Face / CQC registration visible in footer with outbound verification links.
5. No "guaranteed", "permanent", "100% safe" or "no risks" language anywhere on the site.
6. Before-and-after gallery requires written consent metadata attached to each image.
7. Consent expiry tracked; images auto-unpublish on lapse.
8. No special offers, discounts or time-limited pricing on surgical or invasive procedures.
9. No imagery, copy or incentives that could target under-18s.
10. Cookie banner and privacy policy disclose any pixels (Meta, Google Ads, etc.) that could feed back into health-data-adjacent advertising audiences.

If a regulator visits your site tomorrow

The MHRA, ASA and CQC don't typically arrive without warning — complaints to the ASA in particular are the usual trigger. But a patient or a competitor complaint can land you in a process you didn't plan for. The defence isn't "no-one told me"; it's "we knew the rules, here's the policy, here's the trail of consents, here's the booking-flow logic".

If you want a site built around this checklist, that's what Practice Digital's aesthetic clinic offering is. A working demo lives at main.marylebone-aesthetics.pages.dev — a fictional Wimpole Street clinic that runs the patterns described above. Open the booking flow, look at the team page, read the news posts on MHRA pricing rules.

About the author. The Practice Digital clinical team includes practising NHS GPs and a BCUHB Cluster Lead. We's signed off clinical and compliance content for aesthetic, dental and primary care websites in the UK. This article isn't legal advice — if you have a specific regulatory question, talk to a healthcare law specialist or your indemnity provider's helpline.