Record what supports the service, protect who can access it, and treat permission to publish an image as a separate question. This is a workflow—not a universal consent form.

Give each field a reason to exist
A helpful client record allows the next practitioner to understand what happened and what needs attention without turning the salon into a repository for unnecessary private information. Start with the purpose of each field: booking, service continuity, payment administration, or a permission the client has actually given.
The FTC’s business guide to personal information emphasizes knowing what information you hold, limiting it, protecting it, disposing of it appropriately, and planning for incidents. Those are the source principles. The salon workflow below is our editorial application, not a legal retention schedule, medical-record system, or template that guarantees compliance.
Separate observation from interpretation
Use three small sections for service continuity. First, record the agreed goal and relevant history as reported by the client, making clear that it is reported information. Second, record what was actually done: identifiable products or formulas where appropriate, relevant timing, technique, and deviations from the planned service. Third, record the outcome discussed and the next agreed step.
An illustrative note might say that the client prefers a lower-maintenance shape, wore the cut air-dried at the consultation, and agreed to revisit the fringe length at the next appointment. It should not turn a preference into a personality judgment or a reported symptom into a diagnosis. Where manufacturer instructions require particular checks or documentation, follow the applicable product and professional requirements rather than relying on this generic structure.
Record enough context that another authorized team member can understand the note. Avoid unexplained abbreviations and emotionally loaded descriptions. A clear correction with its date is more informative than silently rewriting the service history.
Ask a separate question about photographs
A photograph used privately to remember a cut is not the same use as a photograph placed on a public website, advertisement, or social account. As an editorial practice, keep those purposes separate and make declining publicity easy. Do not treat agreeing to a haircut as agreeing to every future use of an image.
For a proposed public image, explain the intended channels, whether the face or other identifying details will appear, and how the person can raise a concern later. Record the agreed scope and date. Seek appropriate local advice for consent language, minors, revocation requests, retention, and any relevant privacy or publicity rights; these vary and are not resolved here.
Before publishing, check the background too. Another client, a booking screen, a name on a station, or a reflection can reveal more than the intended hairstyle. Use an image review step rather than assuming a close crop removes every issue.
Make access match the job
Give team members individual accounts where the system supports them, and restrict access to what their role needs. Follow the platform’s supported security settings, including multifactor authentication when available. Remove access promptly when someone leaves. Do not place account passwords in appointment notes.
Keep operational records in the chosen business system rather than scattered across personal message threads, notebooks, and shared downloads. If information must be exported, identify who requested it, why it is needed, where it will be stored, and when the temporary copy should be removed. Test these tasks with fictional records during the booking-platform evaluation.
Decide who responds to a misplaced device, misdirected message, or suspicious access. Preserve relevant evidence and follow the incident process; do not improvise a promise that no information was exposed before the facts are known.
Write a retention decision, not a forever rule
Create an inventory of record types: contacts, service histories, transaction records, images, marketing permissions, and temporary exports. For each, identify its purpose, responsible person, storage location, access, and proposed retention or review approach. Have legal, accounting, insurer, and applicable professional obligations considered before adopting deletion rules.
Review the inventory when changing systems or adding features such as automated call handling. A new tool may create transcripts or copies that were not part of the original plan. Our salon AI guide helps separate a useful administrative capability from unsupported claims.
The practical goal is simple: a record that is specific enough to support good work, restrained enough to respect the person, and organized enough that permissions and unresolved questions do not disappear.
Sources & context
Sources checked on 19 September 2026. The notes below identify their scope; linking a study is not an endorsement or a clinical review. Worked scenarios and editorial frameworks are our own.
- FTC: Protecting Personal Information — A Guide for Business ↗Business data-security guidance · checked 2026-09-19
Data minimization, access controls, retention and disposal principles. Salon-specific workflow is editorial guidance, not a jurisdiction-specific compliance policy.
Research drafts are preserved context, not proof for the guide above. Their claims have not all been reverified. Educational information, not medical, legal, or tax advice.