Patient wants to revoke image authorization: how to proceed
Quick facts
- Right
- The data subject can withdraw consent, in general at any time
- First step
- Receive the request without questioning the reason or arguing
- Practice
- List where the image is, remove it, and reply in writing
- Attention
- Content already circulated by third parties may be beyond your control
Months after publishing, the patient sends a message: "I want you to take my photos off your Instagram." It may be a job change, the end of a relationship, embarrassment, or simple regret. The reason matters little. What matters is that the authorization was given by a person who has the right to withdraw it.
This page shows how to receive the request, remove the material methodically, and keep everything on record.
What does revocation mean in practice?
The LGPD treats the image of the face as personal data, and consent as something the data subject can withdraw. In practice, this means that from the moment of the request, the clinic must stop using the image for the purpose that depended on the authorization. A facial image may also qualify as sensitive personal data when it allows identification, which reinforces the need for care.
It helps to distinguish two uses that often get mixed up:
| Use | Depends on | Effect of revocation |
|---|---|---|
| Publicity (social media, website, ads) | Specific authorization | Must stop and be removed from what you control |
| Clinical record (patient record) | Care purpose and its own retention periods | Follows the record-keeping rules, not the publicity rules |
The subject has a full page in consent and LGPD in photos, and the separation between the two types is in separate consent for image publicity.
How to receive the request?
The first response sets the tone. Do not ask "why?" in a way that sounds like a demand, and do not try to talk the patient into keeping the authorization. The safest reply is short and welcoming.
If the patient makes the request in person, invite them to put it in writing or, at least, note the request in the patient record with the date. If it comes by message, the message itself is a record.
Step by step to honor the request
A practical point: many clinics outsource their social media. If an agency published it, the agency must remove it too, and the contract should provide for that. Use the opportunity to review the workflow, as in safety of patient images in the simulation.
What to say about what is outside your control?
If the image was shared by third parties, such as other profiles, the professional cannot guarantee its removal. Be transparent about it, without sounding defensive.
Avoid promising to "erase it from the internet." You can commit only to what you can actually do.
What about the patient record?
Revoking permission for publicity does not automatically mean deleting the clinical record. The record has a care purpose and retention periods set by regulation, and the image in it serves the patient's care. Explain this difference clearly, without giving the impression that you are refusing the request. If the patient wants the clinical record deleted, the matter should be handled with caution and legal advice. See also deleting a patient's photo on request and patient asks to delete the photos.
What if there was paid commercial use?
If there was compensation, a contract, or a specific assignment, the request should be read in light of what was agreed. Even so, treat the request with respect and look for a solution, with legal advice. In these cases, an open conflict costs more than a calm agreement.
How to prevent the problem?
The best prevention is to ask for the authorization the right way from the start: separate from the clinical document, with a clear purpose, with the option to refuse without penalty, and with a notice that it can be withdrawn. The script is in asking the patient for image authorization and in image authorization for publicity: how to talk about it.
What should you record?
Record the date of the request, how it was made, what was removed and when, the reply sent, and any limits communicated to the patient. Keep everything with the patient record or in the clinic's administrative file, according to your routine.
How long should it take to honor the request?
Respond quickly. The LGPD speaks of honoring the data subject's rights within reasonable periods, and a patient who asks for an image to be removed is usually uncomfortable with the exposure. Confirm receipt the same day and state, objectively, how long the removal will take. If any removal depends on third parties, such as an agency or a platform, say so from the start, so you do not promise a deadline you do not control.
Once finished, send written confirmation listing what was removed. This short message closes the matter respectfully and serves as proof that the request was honored.
Frequently asked questions
Can a patient revoke image authorization after signing?
As a rule, yes. Consent can be withdrawn, and the clinic must stop using the image from the moment of the request, under the LGPD (Brazil's data protection law) and the guidance of its professional council.
Do I have to delete everything that was already published?
You must remove what is under your control, such as social media and the clinic's website. Material already copied by third parties may be out of your reach, and that must be explained.
Can I keep the photo in the patient record after revocation?
Revoking permission for publicity does not necessarily erase the clinical record, which has its own purpose and retention period. Explain the difference and confirm with your council's guidance and the LGPD.
Does the revocation request have to be in writing?
You are not required to demand a specific form, but recording it in writing protects both sides. Note the date, the channel, what was removed, and the reply sent.
Harmy images are illustrative simulations generated by AI from the patient's photo to support the conversation between practitioner and patient. They are not a promise of results. Indication, technique, product and volume are solely the decision of the licensed practitioner. This content is for information only and does not replace a clinical assessment.