Photographs of a client are personal data, and a phone camera roll shared with a family tablet is not where they should live. Keep them attached to the client's record, where access is yours and the picture is next to the formula it belongs to.
Frame for the work rather than for the person. A photograph of hair, nails or skin without a recognisable face does everything a reference photograph needs to do and carries a fraction of the risk. Where a face is unavoidable, that is exactly the photograph you should be asking about explicitly.
Publishing is a separate decision from keeping. Consent to a record photograph is not consent to post, and 'they did not object' is not consent either. Ask, note the answer, and honour a no without making it a negotiation.
Delete on request, promptly and everywhere — the record, your phone, and anywhere you posted it. A client asking for a photograph to be taken down is entitled to that, and arguing about it turns a small request into a complaint.
Photographs of minors need the consent of whoever is responsible for them, and posting them publicly is a decision to think about twice. If in doubt, keep the record photograph and publish nothing.