The Data Protection Act 2018 controls how your personal information is used by organisations, businesses or the government. ... Everyone responsible for using personal data has to follow strict rules called 'data protection principles'. They must make sure the information is: used fairly, lawfully and transparently
You are allowed to keep data on your customers if there is a legitimate business reason including keeping records for tax purposes, or customer safety for example. It could be argued that you should keep records because of the kind of treatments that are being carried out on your customers.
For the current business consent forms and facial planning forms will be kept for any future review. Photographs will be used on the website and advertising with your consent in the consultation - photos will be cropped so ID is minimised - bt at any time you can request for these photographs to not be used and if so please email me @ and on my facebook page