How long should I keep client consultation and patch test records? (UK)

There is no single legal number, which is why salon owners get conflicting answers. Two separate pressures set the period, and they pull in opposite directions.

The first is the claims window, which is a matter of law. In England and Wales, the Limitation Act 1980 sets the time limit for a personal injury claim; as a general rule it is three years, running from the injury or, if later, from the "date of knowledge" — when the person realised an injury was linked to a treatment. (Scotland and Northern Ireland have their own limitation regimes.) These are general rules with exceptions, not hard stops: the "date of knowledge" can start the clock much later, and a court has discretion under section 33 to allow a claim to proceed out of time where it considers it equitable. Treat the period as a planning guide, not a guaranteed expiry date.

For clients treated under 18, the clock generally does not start until their eighteenth birthday, so a personal injury claim can usually be brought until around 21. That is the general position, not an absolute cut-off — the same "date of knowledge" and section 33 discretion can extend it. Keep minors' records longer than adults', and check what your insurer requires for under-18s, as the period and its starting point may differ.

Separately from the law, your insurer will usually require you to keep treatment records for a set period after treatment. That requirement — not a rule of thumb — is a condition of your cover; it must be considered alongside applicable legal and data-protection requirements. Check your insurer's requirements, including the period and the starting point for minors, and write that figure down.

The second pressure is UK GDPR. Consultation cards carry health information — special category data under Article 9 — and the storage limitation principle says you cannot keep it indefinitely "just in case." You must set a defined retention period, be able to justify it, state it in your privacy notice, and delete or anonymise the records when they are no longer needed.

What that looks like in practice:

• Keep a documented retention schedule that sets a period for each type of record — consultation cards, patch test records, and so on — matched to your insurer's requirements and your data-protection obligations, with the start point defined for each and a longer period for under-18s.
• Keep patch test records at least as long as the treatment records they support — they provide supporting evidence of the patch test and its recorded outcome.
• When a record reaches the end of its period, review it before deleting: check there is no ongoing complaint, claim, or other justified reason to keep it. UK GDPR does not require automatic deletion while a legitimate need remains.
• When no need remains, securely delete or anonymise the record, and keep a note that the review happened.

Review older records against your documented retention schedule, and securely delete or anonymise information you no longer need.