VURAL
ESCAENContact
← All articles

Salon client records: what to include and how to keep them

20 October 2026

Hairdresser recording information on a client's record card

A good hair salon client record is short, tidy and helps you take bookings. It holds what you need to do the service (contact details, services, preferences, useful notes) and nothing more. Everything you add should have a clear reason. This guide tells you what to include, what not to ask for without good cause, how long to keep it and how to make it feed your diary instead of being a drawer full of notes.

Vural
Connect your bookings to WhatsApp
Vural handles bookings and basic enquiries on WhatsApp, even outside working hours, sticking to your business's terms and prices.
Discover Vural

TL;DR

  • A useful record separates three layers: booking data, service preferences and sensitive data (only if needed).
  • Allergies or reactions to a product can matter in a hair salon, but they are health data and call for a legal basis and extra care.
  • There is no single retention period: you set it according to the purpose and keep it as short as possible.
  • A record linked to your diary and to WhatsApp saves time, but responsibility for the data is still yours.
  • If the record doesn't feed your diary rules (duration, staff member, deposit), it's an archive, not a tool.

Contents

What the record is for (and what it isn't)

The record answers three questions when a client comes back or gets in touch:

  1. Who are they and how do I contact them?
  2. What was done last time and what do they prefer?
  3. How much time and what resources does their next appointment need?

If your record doesn't help answer one of the three, there's too much information or too little structure. A record isn't a diary about the client or a place to jot down opinions about their life. Nor is it somewhere to keep things “just in case”: data protection points in exactly the opposite direction.

The European Data Protection Board (EDPB) sums up the principles that apply to any small business: lawfulness and transparency, purpose limitation, data minimisation, accuracy and storage limitation. Translated to your salon: the question isn't “what else can I write down?”, but “what do I need for this purpose?”.

What the client record should include

The practical rule is to think in three layers.

Layer 1: booking data

This is the minimum for managing the appointment. A hair salon client record should include at least:

  • Name and phone number.
  • Preferred contact channel (WhatsApp, phone call).
  • Services done or requested.
  • Preferred staff member.
  • Appointment dates, past and next.

Notice what isn't there: postal address, ID number, full date of birth. If you don't use them to do the service, don't ask for them. An email address only makes sense if you actually use it for something.

Layer 2: service preferences

This is where you keep what makes the client feel you know them:

  • Colour formula and processing times from last time.
  • Products and brands used.
  • Usual length or cut, and what they don't want done.
  • Hair and scalp type, in service terms (oily, fine, curly).
  • Actual service time for that person.
  • How they like to be treated: whether they prefer quiet, are in a hurry, or like a coffee.

Actual duration is a badly underrated detail. If a client's colour always takes you 20 minutes longer than planned, the record should say so, so that your diary doesn't promise impossible slots.

Layer 3: sensitive data

Here you need to stop and think. If the record holds allergies, illnesses, medication or any data revealing someone's health, we're talking about special category data. The AEPD explains that health data is specially protected and that processing it is prohibited unless one of the circumstances in Article 9 of the GDPR applies, such as explicit consent. The Spanish agency also sets out the legal bases for special categories.

In a hair salon, this means:

  • Don't ask for medical history as a matter of routine.
  • It can be reasonable to record that a client had a reaction to a particular dye, because it affects the safety of the service. Ask for explicit consent and explain why you're keeping it.
  • Write down the minimum: “reaction to dye X, avoid” is enough. No need for a story.

Sample record, field by field

A light, structured record could look like this:

Block Field What you use it for Booking Name and phone number Contact and confirm Booking Preferred channel Choose how to get in touch Booking Usual staff member Offer the right slot Service Last service and date Suggest the next appointment Service Formula, products, technical notes Repeat the result Service Actual duration Block out the right time Rules Deposit or cancellation policy Protect the slot Sensitive Reaction to a product (only if relevant) Service safety Legal Date and form of consent Be able to prove it

Note that the last row matters as much as the others: if you ask for consent, you have to be able to prove it.

Paper or digital: what changes

Card records have worked for decades. Their problems are well known:

  • Only whoever is in the salon can look at them.
  • They're easy to lose or to be seen by the wrong person.
  • They don't connect to the diary, so durations and preferences don't help when giving appointments.
  • Deleting data on time is awkward, and hardly anyone does it.

A digital record solves access and access control, but it doesn't take away your responsibility. If you use software or an assistant, you're still the one who decides what the data is used for and for how long. Choose a tool where you can edit, export and delete a specific client's record without fighting the system.

How to design the record around your diary

The record works best when it follows the client's whole journey, rather than being a snapshot:

  1. Sign-up: name, phone number, channel and privacy notice.
  2. First booking: service, staff member, expected duration.
  3. Confirmation and reminder: as the client prefers.
  4. Attendance: note whether they came, arrived late or didn't turn up.
  5. Short note of the result: formula, times, useful observations.
  6. Next appointment: recommended interval for that service.
  7. Cancellation or waiting list: what happens to the slot.

The key is for the record to feed your diary rules: actual duration, preferred staff member, resources needed (backwash basin, treatment room), buffer between appointments, cancellation policy, deposit and opening hours. With clear rules, whoever takes the booking (a person or an assistant) only offers valid options.

If no-shows worry you, the record helps there too: a client with several no-shows may need to pay a deposit, while a loyal one can be given more leeway. We have a guide on how to cut no-shows with WhatsApp appointments and another on advance payment for appointments.

The same goes for slots that free up. When someone cancels, the system needs to know who to offer the slot to and on what terms. Some businesses in other sectors, such as golf clubs, already use booking hold timers and waiting rooms, which show how a slot can be held for one person for a few minutes before moving on to the next. The idea transfers well to a hair salon with a waiting list.

WhatsApp and the record: what to watch out for

Many clients book on WhatsApp, so it makes sense for part of the record to start there. But a chat isn't a record, nor is it consent.

These are the guidelines set by INCIBE (Spain's national cybersecurity institute) for using WhatsApp in a business:

  • Tell the client who processes their data, why and on what legal basis.
  • Use WhatsApp mainly for informational messages and assess the risks before rolling it out.
  • Don't add clients to groups automatically or use pre-ticked boxes.

There's a very common mix-up: treating any conversation as permission to send marketing. An appointment can rest on your relationship with the client, but advertising needs a valid basis. The AEPD points out that consent must be a clear affirmative action, not implied. According to INCIBE, for commercial communications Spain's LSSI requires prior authorisation or a prior contractual relationship under the legal conditions, plus a simple, free way to opt out.

In practice:

If you want to see the whole flow, we explain it in WhatsApp bookings: how to receive and automate them.

How long to keep the record

There's no single, automatic duration for all records. The European Commission says data should be kept for as short a time as possible, taking into account the reasons for processing and any legal retention obligations.

We suggest a simple method:

  • Set an internal period for each type of data (contact details, service history, sensitive notes, consents).
  • Set a review date, yearly for example, to clear out records of clients who don't come back.
  • Update whatever changes: new phone numbers, preferences, staff member.
  • When it's time to delete, remember that Spain's LOPDGDD provides for data to be blocked, only to deal with possible liabilities, before it is finally destroyed.

The specific period you choose is your decision, and you must be able to justify it. If you're unsure about a particular case, ask your accountant or a data protection officer or adviser.

If you work in physiotherapy or a dental clinic

The bar goes up. A physiotherapy or dental clinic record contains health data by definition, and that brings in healthcare obligations that can't be summed up in a paragraph. What's worth knowing:

  • Documenting healthcare and complying with privacy rules are related obligations, but they aren't the same document and don't always have the same legal basis. The AEPD explains this in its question on patient consent.
  • Keep the diary record (name, phone number, type of appointment, duration) separate from the clinical record. The assistant handling appointments doesn't need to read the medical history.
  • Decide when the assistant hands over to a person: clinical questions, emergencies or questions about a treatment.

For your specific case, talk to your clinic's data protection officer or a lawyer specialising in healthcare.

Common mistakes

  • Asking for too much on the first visit. A long form puts people off and hardly anyone uses it later.
  • Endless free-text notes. If nobody reads them, they're not needed. Short, fixed fields are better.
  • Mixing sensitive data with colour notes. Keep them apart so you can control who sees them.
  • Forgetting the privacy notice. Clients must know who processes their data and why.
  • Not keeping it up to date. An old phone number is a reminder that never arrives.
  • Before-and-after photos without permission. Ask for separate, specific consent for each use, and distinguish between the internal record and social media.
  • Thinking a small business doesn't count. European authorities fine service businesses too: the EDPB reports the case of a waxing salon fined 10,000 euros in Norway for CCTV without a legal basis or adequate information.

Our view

In businesses that work by appointment, a pattern repeats itself: the record has too much data and too few rules. A hairdresser knows that her Thursday client's colour takes an hour and a half, but the diary doesn't. The result: badly calculated slots, waiting around and WhatsApp messages at eleven at night that nobody answers.

Our view — overview diagram

That's why we argue for a short record that turns into rules: duration, staff member, deposit, cancellation policy. With that, an assistant can reply on WhatsApp at any hour, offer only valid slots and keep your business's tone. We also believe privacy isn't a brake: a minimal, well-organised record is easier to protect, maintain and use.

And a fair warning: no tool frees you from your responsibility. You decide what data is kept, for how long and who sees it. We make sure that approach is applied every day without you having to keep an eye on your phone.

How Vural handles it

Vural is an AI virtual assistant that manages your diary and your bookings on WhatsApp. It books, changes and cancels appointments, keeps each client's record (past appointments, notes and preferences) and sticks to your terms and prices. On the Pro and Premium plans it keeps a waiting list and offers cancelled slots to the people waiting, and on Premium it takes a booking deposit with Stripe. It connects to Google Calendar. We charge no commission per booking and there's no minimum term.

There are four plans: Inicial (€79 a month), Esencial (€199 a month), Pro (€399 a month) and Premium (€999 a month), excluding VAT. We set it up for you with your details: the setup is a one-off fixed-price payment (€480 on Inicial, €900 on Esencial, €1,200 on Pro and from €1,800 on Premium), and the monthly fee starts once it's working. See the details at vural.io or start with our article on the WhatsApp away message.

Frequently asked questions

What's the minimum data a hair salon client record should hold?

Name, phone number, contact channel, services done or requested, preferred staff member, appointment dates and the preferences or notes you need to do the service. Anything else, only if it has a specific purpose. The fewer unnecessary things you keep, the easier they are to protect.

Can I note allergies on the record?

You can, but they're health data and are specially protected. Record only what's needed for the safety of the service, such as a reaction to a particular product, and do it with explicit consent and clear information. Don't ask every client for them as a matter of course.

How long should I keep client history?

There's no single period. You should set internal periods for each type of data, keep it for as short a time as possible and review it regularly. When deleting it, the data may need to be blocked, only for possible liabilities, before it is destroyed.

If a client messages me on WhatsApp, can I send them promotions?

No. Messaging you to book isn't permission to send them advertising. You need active, informed consent you can prove, and an easy, free way to opt out. Reminders about an appointment that's already booked are a different matter, because they're informational.

Can an AI assistant keep my client records?

It can manage appointments, remember preferences and answer basic enquiries, always within the rules you set. The business remains responsible for the processing, so it's wise to limit what the assistant reads, decide when it hands the conversation to a person and keep confidential data out of the chat.

Sources

More articles