Consent Sequencing: Why Booking Flow Order Matters

Key takeaways

• AHPRA’s guidelines contain no single numbered booking sequence. Five separate obligations each fix a piece of the order
• Age and date of birth have to be collected before a treatment slot is offered, not after
• Informed consent, at least 18 items for non-surgical procedures, has to follow disclosure, not precede it
• The seven-day cooling off period for under-18s is measured from the consultation, and treatment cannot be confirmed until it has elapsed
• A deposit or payment has to sit after the clinical consultation, because the advertising guidelines name the conflict between financial gain and duty of care directly
• Photo and image consent is a separate, independently withdrawable process, never a condition of proceeding
• These obligations are in force since 2 September 2025

A cosmetic clinic booking flow has to satisfy five separate ordering constraints at once, not one master sequence. Under AHPRA’s guidelines for registered health practitioners who perform non-surgical cosmetic procedures, in effect since 2 September 2025, age and date of birth have to be collected before a treatment slot is offered, informed consent has to follow disclosure rather than precede it, and a deposit or payment has to come after the clinical consultation, not before it. Get any one of those out of order and the step that follows it stops doing what the guideline required it to do.

What the Guidelines Actually Say

None of AHPRA’s guidelines set out a single end-to-end booking sequence for a clinic website. What they contain are several separate obligations that each fix one piece of the order, and a compliant flow is the sum of all of them holding at the same time.

The core document is the National Boards’ Guidelines for registered health practitioners who perform non-surgical cosmetic procedures, in effect since 2 September 2025. They apply to every health practitioner registered under the National Law who performs a non-surgical cosmetic procedure, except medical practitioners, who are directed instead to the Medical Board of Australia’s separate guidelines for cosmetic surgery and procedures, in force since 1 July 2023. A clinic running both a nurse injector and a visiting doctor is building against two documents, not one, and a single booking sequence applied to every practitioner on the site can be correct for one and wrong for the other.

Within the performance guidelines, the informed consent standard requires disclosure before consent is documented, and the mandatory seven-day cooling off period for patients under 18 is measured from the consultation date. In the related guidelines for advertising higher risk non-surgical cosmetic procedures, practitioners must recognise that a duty of care to the patient is the paramount consideration in every interaction, including through advertising, and must recognise the potential for conflict between financial gain and that duty. None of the three provisions names a step number in a booking flow. Read together, they still constrain the order tightly.

What Has to Happen Before What

Photo and image consent sits outside this table on purpose. Both the surgical and non-surgical guidelines treat it as a separate process, independently given and independently withdrawable, and it cannot be made a condition of the procedure. Build it as a parallel opt-in, not a numbered step in the sequence above.

The typical build row is a build-experience estimate across the clinic sites RockingWeb has reviewed, not an audited sample or a regulator’s scale. Consult-before-pay and cooling off score lowest because they depend on separating appointment types, a change most booking widgets do not support out of the box.

What That Means for the Build

Publish the disclosure content before the consultation, not just at it. Nothing in the guidelines says informed consent information has to originate in the consult room. A treatment page that already covers recovery times, realistic outcomes and cost structure lets step one happen before the patient books anything.

Put date of birth at the top of the enquiry, before slot selection. The field exists to change what happens next. Asked on a confirmation screen, it cannot change anything, because the booking already exists. This is covered in full in age gating a booking flow.

Model the consultation as a separate appointment type from treatment. The cooling off interval is a gap between two clinical events, not a calendar rule. A single “Book Now” button that leads straight to a treatment slot cannot express step 3 or step 4. See building a booking flow for the seven-day cooling off for the full build pattern.

Timestamp the consent record separately from the treatment note. Consent documented at the same moment as the procedure, on the same form, is difficult to distinguish from consent recorded after the fact to justify what already happened. A separate, dated record in the patient system fixes that.

Move the deposit field to after consultation completion. A deposit or payment field on the first screen of an enquiry form puts money ahead of assessment. The build fix and the reasoning behind it are covered in deposits and inducement.

Make photo consent its own checkbox, unticked by default. Never bundle it with the procedure consent checkbox, and never make it required to submit a booking.

Moving the deposit from step one to step three does not remove it from the flow. It moves the financial commitment behind the consultation and the consent conversation, which is the position the advertising guidelines’ duty of care wording points to.

A Worked Example

A cosmetic clinic’s enquiry form asked for a fifty dollar deposit on the first screen, before any question about the procedure, the patient’s age, or their medical history. Consent was captured on a printed form handed over at the appointment itself, the same day treatment happened. Every individual field the guidelines require existed somewhere in the practice’s paperwork. None of them sat in an order that matched what the guidelines describe: payment came before assessment, and consent arrived at the same moment as the procedure rather than before it, with no real gap in which a patient could reconsider.

The rebuild moved deposit collection to after a confirmed consultation booking, added the required disclosure content to the treatment page so patients arrived at consultation already informed, and split the consent record into its own step in the practice management system, dated separately from the treatment note. The age question moved from a post-booking confirmation email to the first field on the enquiry form. No individual field changed. The order did, and the practice could finally point to a date on which each obligation was met rather than infer it from a single bundled document.

The cooling off column sits at zero for adult and returning patients because the mandatory seven-day period applies only to patients under 18. That is the clearest illustration of why a single flow cannot treat every patient the same way: the rule that matters most for one patient type does not exist for another, and a flow built around one path will either over-block adults or under-protect minors.

What to Check on Your Own Site

1. Find your deposit or payment field. Does it appear before or after a consultation is booked?
2. Check where your required disclosure content lives. Is any of it spoken only at consultation, with nothing published beforehand?
3. Look at your consent record. Is it timestamped separately from the treatment note, or does one document cover both?
4. Check your photo or image consent checkbox. Is it required to proceed, or genuinely separate and unticked by default?
5. For an under-18 pathway, check whether treatment can be confirmed before seven days have passed since the consultation.
6. Ask whether any practitioner on your site is a medical practitioner. If so, check which guideline document your flow assumes for their patients.

This is a build-experience estimate, not a vendor survey. Most off-the-shelf booking widgets hold a date of birth field, sometimes. None of the other four rules, separate appointment types, a consult-before-pay sequence, an enforced cooling off interval, or an independent photo consent step, exist in a standard configuration without custom work.

The Enforcement Anchor

AHPRA’s September 2025 announcement of the new guidelines carried an explicit warning from Ahpra CEO Justin Untersteiner that practitioners had been given time to get their houses in order, and that the regulator would not hesitate to act where practitioners were found prioritising profits over patient care. The guidelines themselves note that National Boards and Ahpra can act through Board disciplinary processes for unsatisfactory conduct, and that prosecution of advertising breaches can proceed through the court system where prosecution guidelines are met.

There is no published Australian determination we can point to that turns specifically on the order of steps in a clinic’s online booking flow. The stated regulatory posture is on the record; a case built around sequencing itself is not. Reporting that honestly matters more than manufacturing a citation that does not exist.

Where This Gets Hard

The honest difficulty is that most booking platforms were not built with any of this in mind. They model a calendar and a payment gateway, not a clinical sequence with dependencies between steps. Getting the order right usually means a custom front end over the platform’s API, a manual check a staff member performs before confirming a booking, or, for a genuinely under-resourced practice, accepting that certain booking types cannot go fully online yet. None of those is free, and all three are more defensible than a flow that looks tidy while quietly skipping the order the guidelines assume.

The regulator says informed consent depends on disclosure given before the patient commits, and that duty of care is the paramount consideration in every practitioner-patient interaction; the build consequence is that consultation, disclosure and cooling off have to sit ahead of payment and treatment confirmation in your booking flow; whether your particular sequence satisfies the obligation in your circumstances is a question for your medical defence organisation or your lawyer.

Status

In force since 2 September 2025. The performance guidelines, the advertising guidelines and the informed consent standard within them are current obligations, not a proposal and not pending commencement. The Medical Board’s separate guidelines for medical practitioners have applied since 1 July 2023 and are not new.

Frequently Asked Questions

Does AHPRA specify an exact step-by-step order for a booking flow?

No single document lays out a numbered sequence. The performance guidelines set an informed consent standard, a mandatory cooling off period for under-18s, and the advertising guidelines set a duty of care standard that governs payment timing. Each fixes a piece of the order on its own terms, and a compliant flow has to satisfy all of them at the same time rather than following one master rule.

Can a clinic take a deposit before the first consultation?

Nothing in the guidelines names deposits directly, but the advertising guidelines state that a practitioner’s duty of care is the paramount consideration in every interaction and that practitioners must recognise the potential for conflict between financial gain and that duty. Taking payment before any clinical assessment puts the financial commitment ahead of the assessment that duty of care depends on, which is the exact conflict the wording describes.

Does informed consent have to happen before or after the cooling off period?

For a patient under 18, the seven-day cooling off period is measured from the consultation, and treatment cannot be confirmed until it has elapsed. Informed consent is a separate, ongoing requirement tied to disclosure rather than to the cooling off clock itself, so a clinic needs the consent conversation to happen at or after the consultation and the cooling off interval to be enforced before treatment is booked, not instead of it.

Is photo or image consent part of the same sequence as procedure consent?

No. Both the surgical and non-surgical guidelines describe consent for photos or videos as a separate process, with its own disclosure requirements, and it cannot be a condition of having the procedure. Build it as a distinct opt-in step rather than folding it into the same checkbox as procedure consent.

Get Your Booking Flow Reviewed

RockingWeb can walk through your booking flow in the order a patient actually experiences it and flag exactly where a step sits relative to the ones it depends on.

Sources

1. AHPRA - Guidelines for registered health practitioners who perform non-surgical cosmetic procedures, date of issue 2 September 2025. Checked 10 August 2026.
2. AHPRA - Putting patients first: New guidelines for cosmetic procedures, 2 September 2025. Checked 10 August 2026.
3. AHPRA - Guidelines for advertising higher risk non-surgical cosmetic procedures, date of issue 2 September 2025. Checked 10 August 2026.
4. Medical Board of Australia - Guidelines for registered medical practitioners who perform cosmetic surgery and procedures, in force since 1 July 2023. Checked 10 August 2026.

Last reviewed: 10 August 2026.