Search for how tattoo artists should handle client allergies and you'll find two useless answers: expert posts insisting it's "essential" without saying what to actually do, and nothing else. Meanwhile the practical question keeps landing in shops daily: a client mentions a latex allergy, a nickel sensitivity, a bad reaction to a red at another shop — where does that information go?
Here's a grounded answer, including the part most software companies won't say out loud: the goal is to record less than you think, not more.
The distinction that makes this simple
There are two different things people mash together as "allergy tracking":
Operational facts you need at the chair. Latex allergy → nitrile gloves. Adhesive sensitivity → different wrap. Reacted to a specific red pigment once → avoid it, patch-test conversation before color work. These are one-line, practical, and directly change what you do with your hands. Record them.
A medical history. Conditions, medications, immune status, the story behind the reaction. This is health information. You are not a clinic, your CRM is not a medical record system, and warehousing this data creates obligations — privacy, security, retention — that a tattoo shop is not set up to meet. In the UK and EU, health data is legally a special category with explicit handling rules; elsewhere it's still the data most likely to hurt someone if it leaks. Don't collect it.
The test for any note: does this change what I physically do in a session? "Latex allergy — nitrile only" passes. "Has an autoimmune condition, takes [medication]" fails — if that matters, it's a conversation between the client and their doctor about whether to get tattooed, not a database field for you.
How to write the note
Short, factual, in the client's words where possible:
- "Latex allergy (client-reported) — nitrile gloves."
- "Reacted to red ink at a previous shop, unknown brand — discussed; avoiding red, patch-test if she wants color later."
- "Sensitive to adhesive bandages — use [alternative]."
Date it if it's a report of something that happened ("7/2026: reported mild swelling after session 2, settled in a week — see ink log for that session"). Pair it with your ink and needle log — the combination of "what went in" and "what was reported" is exactly what a client's doctor will ask for, and it's the full extent of what you can responsibly provide.
Consent forms are the other half
Your consent form is where clients disclose what they decide to disclose, sign it, and take legal responsibility for its accuracy. Keep signed forms wherever signed documents live for you — organized PDFs or paper by year — and note the location on the client record. Don't transcribe the medical answers into your CRM afterward; the form holds them, signed, which is worth more than a retyped copy anyway.
What we built, and what we refused to
Stencil's client records have a plain notes field, and this guide is our official advice for using it: operational facts, minimal wording, dated reports. We deliberately did not build "allergy tracking" as a marketed feature with structured medical fields, even though the search demand for one is real and it would make a nice comparison-table checkmark. A structured medical database inside a shop CRM invites shops to collect exactly the data they shouldn't hold. Some feature gaps are the product working correctly.
If a tool you're evaluating brags about medical tracking, ask them two questions: how is that data encrypted, and what happens to it when a client asks for deletion? The pause before the answer tells you everything.
Related: Ink and needle logs · Tracking a multi-session sleeve