Privacy Policies for Tattoo Studios and Body Art Shops
Guide for tattoo/body art studios on privacy: health forms, photo consent, age checks, and portfolio use. References CPRA, GDPR, and WA MHMDA.
Your health intake forms collect sensitive data - medications, allergies, bleeding disorders - that trigger privacy duties even if you're not a HIPAA "covered entity." In Washington, the My Health My Data Act requires consent and clear notices for consumer health data; Colorado's CPA and California's CPRA treat health info as sensitive and may require opt-in and limited use. If you serve EU/UK residents, document GDPR/UK GDPR legal bases and retention. Publish truthful disclosures (FTC Act §5), encrypt records, restrict access, and use LegalDocs.ai to generate tailored notices, consents, and retention schedules.
Portfolio photos market your artistry, but you need written consent. Use a separate, granular model release covering studio displays, website, and social media, with options to withhold face, name, or identifiable marks. Right of publicity laws like California Civil Code §3344 and New York Civil Rights Law §50-f require consent and protect minors (parent/guardian must sign). If any tool measures facial geometry, consider Illinois BIPA and obtain biometric consent. Under GDPR, rely on freely given consent and honor withdrawals. LegalDocs.ai can standardize releases and consent logs.
Most states restrict tattooing minors; for example, New York bans tattoos under 18 (Penal Law §260.21) and California prohibits tattooing minors (Penal Code §653). Verify age with government ID, record only what law requires, and set short retention. Some states limit ID scanning and storage (e.g., Cal. Civ. Code §1798.90.1), so avoid swiping or storing full numbers without a clear need. Train staff on data minimization, access, and deletion timelines. Maintain processor agreements with booking/photo hosts and a breach plan. LegalDocs.ai offers templates and checklists to operationalize this.