How to Explain Privacy to Facial Harmonization Patients
The facial harmonization patient hands the office something they rarely hand to any other service: their face. Photos from the front, in profile, close-ups, sometimes with and without expression, taken by you and kept for years. Many patients have never thought about it, and some ask, directly or indirectly, "what do you do with my photos?". Someone who cannot answer conveys insecurity.
Explaining privacy does not have to be a legal speech. It needs to be a short, honest and verifiable conversation: what is collected, what for, where it is kept, for how long and what the patient's rights are. This page offers a plain-language summary, a table, ready phrases and a template to adapt. For the legal side, see LGPD and consent and the LGPD in photos.
Why explain privacy during the consultation?
Because the LGPD requires transparency, and because the patient's trust depends on it. A facial photo associated with health is sensitive personal data, which calls for a clear purpose, minimum necessary use and security. An informed patient agrees more comfortably, and a patient taken by surprise may feel betrayed, even if nothing illegal occurred.
What should you say, in plain language?
The five points below cover most questions. Adapt them to your clinic's reality and to what your privacy policy actually says.
| Patient's question | Plain-language answer |
|---|---|
| What do you collect? | Identification data, health history and facial photos needed for the care |
| What do you use it for? | To assess, plan, carry out and follow the treatment |
| Where is it stored? | In the patient record with restricted access, in a secure place |
| For how long? | The time required by the rules that apply to patient records |
| Who can see it? | The team that needs it for the care; third parties only with authorization or by legal obligation |
What is the difference between authorization for the record and for publication?
This is the point that causes the most problems. Consent for treatment and for entry in the patient record does not cover publication on social media, a website or marketing material. That requires its own consent, free and informed, which the patient can revoke. The pages image authorization for the patient record only and asking the patient for image authorization detail the conversation.
Which rights can the patient exercise?
In general terms, the data subject has the right to know what is processed, to access their data, to correct wrong information, to request deletion when applicable and to revoke consent. In health care, part of the data has a retention period set by rule, and not everything can be deleted immediately. The honest answer is: "you can ask, and I will assess what the law allows me to delete and what I must keep". See patient asks to delete the photos and patient wants to revoke the image authorization.
How do you talk about AI simulation?
If you use a simulation app that sends the photo to a third-party service, the patient must know. This is part of transparency: say that the image is processed to generate the projection, that the professional accepted the service's terms and what the service does. Avoid stating anything you have not confirmed in the service's terms. For the logic of care with images, see security of the patient's images in the simulation.
Is there a text template to hand out?
Yes, a one-page summary in plain language that you can adapt with the help of your lawyer or the person responsible for privacy at the clinic.
How do you fit this into the consultation flow?
What should you record?
Record that the summary was presented, the authorizations given and refused (separated by purpose), any requests from the patient and the responses. The procedure's informed consent should be handled separately from the image authorizations. Retention of the patient record follows the applicable rules.
A short conversation about privacy, at the start, avoids many long conversations later. And it tells the patient something important: that their face is treated as something that deserves care.
Frequently asked questions
What should the professional explain about privacy to a facial harmonization patient?
Which data and photos are collected, for what purpose, where they are stored, for how long, with whom they may be shared and what the patient's rights are, in plain language.
Is a photo of the patient's face sensitive data?
When associated with health, the patient's image is treated as sensitive personal data under the LGPD (Brazil's data protection law), which calls for more care, a clear purpose and a legal basis.
Can the patient ask for their photos to be deleted?
They can ask, and the request must be assessed according to the law. Patient record data has retention periods set by applicable rules, so not everything can be deleted right away. Explain this clearly.
Do I need a separate authorization to publish photos?
Yes. Authorization for the patient record is different from authorization for publication, and each purpose requires its own consent, in addition to complying with your professional council's rules.
Harmy images are illustrative simulations generated by AI from the patient's photo to support the conversation between practitioner and patient. They are not a promise of results. Indication, technique, product and volume are solely the decision of the licensed practitioner. This content is for information only and does not replace a clinical assessment.