Client file at a beauty studio: skin type, allergies and the FADP

A beautician in Winterthur has worked with index cards for years. Each one has the name and phone number at the top and, below, her handwriting: “combination skin, rather sensitive”, “allergy to fragrances?”, “medication, see conversation in March”, plus the date and kind of every treatment. The cards sit in a box in the treatment room. Since a second beautician started working two days a week, she reads the cards too.

The file is useful. It saves asking which product was tolerated well last time, and it reminds the beautician of what matters before a peel or hair removal. At the same time, one card holds information of very different kinds: a phone number, an observation about skin care, a note about an allergy and a detail about a medication. The data protection act does not treat all of these alike.

Which entries on the card are health data

The Federal Act on Data Protection (FADP) distinguishes between ordinary personal data and sensitive personal data. Art. 5 let. c FADP lists what belongs to the second group; number 2 expressly names “data on health”.

On a beauty client card, the entries fall roughly into three groups:

Entry	What it describes
Name, phone, email, appointments	the person and their visits
Skin type, care preferences, products	the skin and the treatment
Allergies, medication, skin conditions	the person’s state of health

The third group is the core of what the law means by health data: a known allergy, a medication or a diagnosed skin condition such as atopic dermatitis says something about the health of a specific person, even when it is noted in a beauty studio and not in a medical practice. The middle group is less clear-cut. A note such as “combination skin” mainly describes care; the more a note sounds like a finding, the closer it moves to health. The law does not draw this line field by field. For the client file, the more useful question is therefore what a field is for, not what it is called.

Here the subject is the file that grows over the years.

What the category changes in daily practice

That an entry is sensitive does not forbid noting it. But it changes a few points where the law looks more closely:

• Consent, where one is needed, must be explicit. Art. 6 para. 7 let. a FADP requires explicit consent for sensitive personal data, where consent is required at all.
• Data security in line with the risk. Art. 8 FADP requires data security appropriate to the risk. The Data Protection Ordinance (DPO) names access control in Art. 3 as one of the measures: authorised persons should only be able to access the personal data they need for their tasks.
• Silence about what was learned. Art. 62 FADP makes it a criminal offence, on complaint, to intentionally disclose secret personal data learned in the course of a profession that requires knowledge of such data. The article names no individual professions; it attaches to the activity.

There is also a duty that applies to all personal data: under Art. 19 FADP, the studio informs its clients when collecting data, at least about its identity and contact details, the purpose and any recipients. If data is disclosed abroad, for instance because the file sits with a service abroad, the country belongs in that information too.

Data minimisation: what the file really needs

Art. 6 paras. 2 and 3 FADP require processing to be proportionate and to serve a specific purpose that is recognisable to the client. For a beauty client file, that means: every field has a reason, or it has none.

A studio in Lugano offering facials, waxing and manicures might check its fields along these lines:

Field	What it is needed for	When it can be dropped
Skin type	choosing products for facials	for clients who only come for manicures
Known allergies	choosing products and wax	never entirely, as long as treatment continues
Medication	checking whether anything speaks against a treatment	as a complete list, almost always
Treatment history	picking up from the last treatment	when the client has not come for years
Date of birth	age limits for certain treatments, if the studio has any	when it only serves for birthday greetings

Medication shows the difference most clearly. A list of all medication contains far more than the beautician needs for her decision. A question about whether the client regularly takes medication that could matter for the planned treatment, plus a short note on the consequence for the treatment, serves the same purpose with less content. The same goes for free-text fields: a heading such as “Other” fills up with everything said in conversation, including what will never be needed again.

Art. 7 FADP also requires privacy-friendly default settings: processing should by default be limited to the minimum the purpose requires. On paper that is a question of the form; in software, it is a question of the fields that appear when a client is created and the fields that may stay empty.

Who sees the card

In a studio with one person, the question is simple. As soon as several people work there, it arises for every field:

• Treating and reception. The person who books appointments needs name, phone and the booked treatment. Allergies and medication are needed by the person who treats.
• Permanent and rotating staff. A beautician who works two days a week needs the cards of her clients, not necessarily the whole box.
• Where the file lives. A box in the treatment room, a lockable cabinet, a spreadsheet on a private laptop or specialist software each give different access. Anyone using software passes the data to a processor; under Art. 9 para. 2 FADP, the studio makes sure the processor can guarantee data security.

For the client, the right of access under Art. 25 FADP applies in return. A private person who wants to know what her studio has noted about her skin and allergies can find out which data is processed, for what purpose and for how long it is kept. With a file of few, clear fields, that answer is quickly given.

How long the file stays

Two different rules apply to retention in a beauty studio, and they affect different parts of the records.

The accounts. Receipts and invoices are accounting vouchers. Art. 958f of the Code of Obligations (CO) provides for ten years of retention for business records and vouchers, counted from the end of the financial year. That concerns what was sold and paid, not the notes on the skin.

The client file. There is no such period for care notes. Here Art. 6 para. 4 FADP applies: personal data is destroyed or anonymised as soon as it is no longer needed for the purpose of processing. The purpose of a beauty file is treatment; when a client has not come for years, part of that purpose is fulfilled. Some studios therefore set after how many years without an appointment a card is reviewed. In case of a complaint after a treatment, what was known before it can play a role. How long a card is kept is therefore a question each studio settles for itself, if need be with its fiduciary.

A period has a second benefit: under Art. 25 para. 2 let. d FADP, the retention period, or the criteria for it, is part of the information given on request. A fixed period can be stated. And it can be separated: the receipt for a facial stays in the accounts for ten years, even if the note on the allergy was deleted long ago.

A file that suits the studio

Seen this way, a good beauty client file is less a question of quantity than of order: few fields with a clear purpose, health information only where it affects the treatment, access for the people who treat, and a period for cards of clients who no longer come. The FADP provides the framework; which fields a studio needs depends on its treatments.

The idea for beauty studios that we are working on takes up this order: the app will deliberately have no fields of its own for health information and no health questionnaires. A treatment card per visit records what was used, such as products and device settings, and a simple notes field is visible to the team only. Photos are taken only with the client’s consent. The app will store the data on infrastructure in Switzerland.