Beauty and aesthetics clinics — laser hair removal, Botox, fillers, chemical peels — operate in a weird legal gap. You're not quite medical (AHPRA doesn't regulate cosmetic injectables across all states), but you're not retail either. You need digital consent forms signed per-treatment, before/after photo records that don't leak across staff, package redemption tracking (6-pack laser, 10-session course), and proof of compliance if things go sideways. Generic booking systems don't exist for this.
Velocity X is built for aesthetics clinics. Per-session digital consents with auto-reminders, encrypted before/after galleries keyed to individual clients, package purchase and redemption tracking, and audit trails that satisfy AHPRA questions. This is the story of why beauty bookings break in generic tools and how Velocity X fixes it.
Why Generic Booking Breaks in Beauty Clinics
Cosmetic treatment bookings are paperwork-heavy in ways most SaaS tools don't understand. Acuity, Calendly, even Mindbody treat appointments as slots and payments as line items. They don't think about consent forms, photo records, or multi-session packages.
Problem 1: Consent is per-treatment, not per-visit. A client books a 6-pack laser course. Each session needs a fresh consent form because skin condition, medications, or contraindications change between visits. Generic systems have "e-signature" features that sign once at purchase, then assume consent carries forward. That doesn't work. You need a reminder 48 hours before each appointment that prompts the client to re-consent (or flags if they've missed questions). If something goes wrong — allergic reaction, unexpected pigmentation — you need proof they consented to the specific risks of that day's treatment.
Problem 2: Photo records are sensitive. Before/after galleries are marketing gold but also privacy landmines. A client books laser. The therapist takes before photos. 3 months later they come back for session 2 and you take after photos. Those photos need to live in a database, but not every staff member should see every client's intimate images. A therapist shouldn't see another therapist's clients' photos. Receptionists shouldn't see clinical photos. Generic systems have "file attachments" or "image galleries" but not role-based encryption. Photos are stored in plain text alongside appointment records.
Problem 3: Package redemption is a manual nightmare. A client buys a 6-pack laser course for $1800. They come back 3 times. How many sessions are left? Did they add an extra session? Can you apply a loyalty credit? Generic booking systems can't track "5 of 6 completed" or "1 extra add-on used". You end up in spreadsheets.
Digital Consent — Per-Session, Per-Client
Velocity X treats consent as a first-class workflow. When a therapist checks in a client for appointment 2 of 6, the system triggers a consent form auto-populated with that client's history, current medications, and session-specific risks.
The consent form is a dynamic Radix component keyed to the treatment type (laser vs injectables vs chemical peels). It pulls the client's allergy history, medication list, and previous adverse reactions, highlights any red flags (e.g. "client reported hives post-filler in 2025"), and requires explicit checkbox consent to each risk. Once signed, the form is immutably stored with a signature hash, timestamp, therapist ID, and session ID. If the client disputes what they consented to, you can prove exactly what they signed and when. Velocity X also logs who viewed the form, when, and for how long — so if a therapist skipped reading it, that's auditable.
The system can trigger re-consent workflows: "Consent expired after 12 months" or "Medication list changed, re-consent required". Clients get SMS reminders 48 hours before appointments: "Hi Sarah, your laser session is tomorrow. Please review and sign your consent form: [link]." The form lives in their client portal — they can re-read their own history, add notes, or flag new allergies before coming in.
Before/After Photo Storage — RLS-Encrypted Galleries
Photos are the soul of a beauty clinic's marketing. They're also strictly confidential. Velocity X treats them like patient records in healthcare.
When a therapist uploads before photos, Velocity X encrypts them with a key tied to that client's record, stores them in Netlify Blobs (immutable, versioned, encrypted at rest), and assigns RLS rules: only the therapist who took them, the clinic owner, and the client themselves can view them. A junior therapist can't browse the whole photo library. A receptionist can't see them at all. The system generates a before/after carousel UI that sits behind these RLS gates — receptionists see a stub saying "Photo record exists", not the actual images.
The system also auto-detects if a photo is being re-used without the client's new consent (e.g. you try to copy a before photo from session 1 to session 2's record). It flags it: "Use existing photo? New consent required." You can't silently reuse images across sessions. And if a client revokes consent to use photos for marketing, a toggle flips and the photos vanish from your marketing gallery — but are retained in clinical records (legal hold).
Package Redemption — 6-Packs, Add-Ons, Loyalty Credits
A client buys a 6-pack laser course. They complete 3 sessions. They want to add 2 extra sessions and also apply a $200 referral credit. Velocity X tracks this as package ledger.
Each package is a line item with a balance: "6 laser sessions, 3 completed, 3 remaining." Sessions can be marked as "used", "cancelled", "no-show" (with automatic fee), or "credited" (if you comp it for a referral). Add-ons appear as separate line items ("Extra 2 sessions added 2025-03-15 for $600"). Loyalty or referral credits are tracked as negative debits. Velocity X calculates the remaining balance in real-time. When a therapist checks in a client, they see: "5 of 6 sessions remaining" in big text. When the last session is used, the system flags: "Final session booked — suggest upsell: new laser course or skin check."
The system also enforces expiry: packages expire 12 months from purchase (configurable per clinic). If a client has 2 sessions left and expiry is in 7 days, they get an SMS: "Your 6-pack laser expires in a week. Book your final sessions now or lose them." Clinics can extend expiry on a case-by-case basis (e.g. "client was overseas") — the extension is logged and auditable.
Frequently Asked Questions
Is Velocity X compliant with AHPRA regulations?
AHPRA regulates registered health practitioners (nurses, doctors, allied health). Cosmetic injectables and laser aren't regulated federally, but state regulations vary. NSW and Victoria have specific guidelines for injectable practitioners (training, insurance, consent). Velocity X is built for compliance with state-level consent and record-keeping requirements. We ship with templates for NSW/VIC injectables and generic laser protocols. If your clinic is in a regulated profession (e.g. nurses doing cosmetics), we build AHPRA-compliant role and audit trails. Talk to us about your specific state and practitioner mix.
Can clients self-serve book and consent from their portal?
Yes. Clients log into their portal, see available times, book an appointment, and a consent form populates 48 hours before. They review, check a box for "I understand the risks," and sign. The signature is captured with timestamp and device fingerprint. Therapists can also trigger manual consent workflows if someone calls to book (therapist records the consent, it's logged as "verbally consented").
What if a client refuses to consent?
The appointment blocks. They can't check in, the therapist can't log treatment notes. You send them a follow-up: "Your appointment is in 2 hours but consent is unsigned. Review and sign your form, or reschedule." This prevents accidental non-consensual treatment and gives you a paper trail if someone claims they didn't agree.
Can I use my own consent form template?
Absolutely. Velocity X ships with AHPRA/state-compliant templates for injectables, laser, peels, and radiofrequency. You can clone them and customize language, add clinic-specific warnings, or upload your lawyer-approved PDF. The system auto-populates client history and handles signature/timestamp capture. Custom forms are version-controlled — if you change your template mid-year, old appointments still link to the version they signed.
How do I export client photos for marketing?
Velocity X generates a "Marketing Approval" report: all clients with before/after photos + explicit consent for public use. You bulk-export approved photos (with metadata stripped) to use in ads, Instagram, or your website. Photos without consent are excluded automatically. If a client revokes consent later, the export is re-generated and they're removed from future batches.
What happens if a client books a package, completes 1 session, then stops?
Velocity X sends automated nurture emails at 30/60/90 days: "Your laser course is waiting — book your next session." At 6 months, a final reminder. At 12 months, expiry notice. If they don't return before expiry, you can offer a "recover" deal (e.g. "$400 to extend and complete your remaining 5 sessions"). All touchpoints are logged — you see exactly when and what you reminded them.
The Bottom Line — Cosmetics Deserve Purpose-Built Software
Beauty clinics are running on booking software designed for spas and consultants. Velocity X is built for the reality: multi-session packages, complex consent, encrypted photo records, and regulatory compliance. See pricing and features. For a detailed look at how medical and aesthetics practices have streamlined bookings and compliance, read the Esteem Clinics case study. If your clinic is still managing consent on paper or photos in a shared Google Drive, it's time to upgrade.