Consent and LGPD for HOF patient photos

Every patient photo in orofacial harmonization (HOF) is, at the same time, a clinical tool and personal data. Brazil's General Data Protection Law (LGPD, Law 13,709/2018) sets rules for collecting, using, storing, and sharing this kind of information, and the practitioner who takes the photo is the one who answers for them.

This article explains the concepts in practical terms, proposes a consent flow for photos, and includes a sample clause. It is not legal advice: use it as a starting point and review it with your lawyer or data protection officer. The full text of the law is on the Planalto website.

Why does a patient photo require special care?

The LGPD calls personal data any information that identifies or can identify a person. A face identifies on its own. In addition, the law gives reinforced protection to sensitive personal data, including health data and biometric data.

A photo taken to assess and plan a procedure records the patient's condition and the treatment they are seeking. That is why, in a clinical setting, the prudent approach is to treat it as sensitive data, with the requirements that come with it: an appropriate legal basis, a clear purpose, security, and transparency.

Who is responsible for the data: you or the app?

The LGPD separates two roles:

• Controller: whoever decides why and how the data is processed.
• Processor: whoever processes the data on behalf of the controller, following the controller's instructions.

When you photograph a patient and use that photo in software, you are the controller of the patient's data. The software vendor generally acts as the processor. In practice, this means that obtaining consent, informing the patient, and handling their requests is your responsibility, even if the photo is stored on a third-party service.

Which legal bases allow processing patient photos?

The LGPD only allows data processing when there is a legal basis. For sensitive data, the options are narrower than for ordinary data. At a general level, the ones that come up most often in clinics are:

Even when another legal basis applies to the clinical record, written consent is the clearest way to document that the patient knows what will be done with the image. For any use outside the care itself, especially publication, specific consent is the way to go.

What should the photo consent form contain?

The image-use form can be part of the procedure's informed consent or a separate document. What matters is that each purpose is presented prominently, with the option to accept or decline them one by one.

Recommended items:

• Identification of the patient and of the responsible practitioner or clinic.
• Purposes, listed separately: recording in the patient record; assessment and planning; use in simulation software; use in educational material; publication on social media and the website.
• Use of third-party tools, where applicable: for example, sending the photo to an artificial intelligence service to generate an illustrative simulation.
• Nature of the simulation: the generated image is illustrative and is not a promise of results.
• Storage method and period, or the criterion for setting it.
• Sharing: who the image may be shared with and who it will not be shared with.
• Data subject rights: access, correction, withdrawal of consent, deletion, and the channel to request them.
• Revocation: what happens if the patient revokes (for example, the image stops being used in new publications, and the mandatory clinical record is kept).
• Date and signature, physical or electronic.

Sample clause in plain language

Reference model, review it with your legal counsel.

Use of my photographs

I authorize [name of practitioner or clinic] to photograph my face for the purposes I have checked below. I understand that my photos are sensitive personal data and will be processed in accordance with Brazil's General Data Protection Law (Law 13,709/2018).

( ) Recording in my patient record, to follow my treatment.

( ) Assessment and planning of the procedure, including the use of an app that sends my photo to an artificial intelligence service to generate an illustrative simulation. I understand that the simulation is not a promise of results.

( ) Use in classes, conferences, or educational materials, without my name.

( ) Publication on social media, a website, or clinic material.

My photos will be kept with restricted access for as long as needed for my care and for the practitioner's legal obligations. They will not be sold or transferred to third parties for other purposes.

I may, at any time, request access to my photos, correct my data, or revoke any of the authorizations above through [email or phone]. Revocation takes effect from the request and does not reach records that the practitioner is required by law to keep.

Place, date, name, and signature.

Adapt the language to your situation, include your professional board's rules, and keep a copy with the patient.

How long should photos be kept?

The LGPD says data must be kept for as long as needed for the purpose, and allows keeping it longer when there is a legal or regulatory obligation. Photos that are part of the patient record follow your profession's record retention rules, which vary by professional board. Check your board's current rule to set the period.

Photos used only for publication should stop circulating when the patient revokes the authorization, as far as possible.

How do you store photos securely?

The law requires appropriate technical and administrative security measures. In the clinic, this usually means:

• Dedicated location: a patient record system, a professional app, or a dedicated folder, never the phone's personal camera roll.
• Restricted access: a password or biometrics on the device, individual accounts for each team member, no shared passwords.
• Controlled backup: know where the copy is and who can access it. Automatic backups of personal photos can carry patient images into private accounts.
• Messaging apps: avoid circulating patient photos in message groups. If you need to send them to the patient, use the one-to-one conversation and do not forward to third parties.
• Disposal: when changing devices, delete the photos and check the trash and the cloud.
• Record keeping: note what was collected, for what purpose, and where it is stored. This makes it easier to respond to a data subject request.

When is it allowed to share the photo?

Sharing means any transfer to another person or company. The most common cases:

• With the patient: allowed, and part of transparency.
• With another healthcare professional involved in the care: within the clinical purpose, with the minimum necessary.
• With software vendors (patient record, storage, simulation): as processors, under contract and following your instructions. Inform the patient of this.
• In publication: only with specific authorization, and respecting your professional board's advertising rules. See what may be published according to the CFO, professional boards, and CONAR.
• With authorities: when the law or a court order requires it.

How does Harmy handle the patient's photo?

Under Harmy's privacy policy, the practitioner is the controller of patient data and Harmy acts as the processor, handling it under the practitioner's instructions. In short, what the policy describes:

• On-device marking: to place the area points, the app detects the face contours on the phone itself. These contours are used only to draw the markers and are neither stored nor sent.
• Generating the projection: the frontal photo is sent over a secure connection (HTTPS/TLS) to Harmy's server and processed by a third-party generative AI service, solely to produce the requested image. Images are not used to train models. The app asks for your acceptance before this transfer.
• No biometrics: Harmy does not create biometric identifiers and does not use facial recognition to identify people.
• History: the before photo and the projection are stored in your account, on restricted-access servers.
• Actual result: when you attach the result photo, it is aligned to the before photo on the device itself, using only the eye position. That photo does not go to a third-party AI service and stays in the account history.
• No advertising: facial data is not used for advertising, profiling, or tracking, and is not sold.
• Deletion: you can delete your account from the app itself, and data is deleted or anonymized within the legal time limits.

As the policy states expressly, the patient's consent to use the photo must be obtained by you before using the app. That is why the form should mention sending to an AI service to generate the simulation, as in the sample above.

What rights does the patient have?

Under the LGPD, the data subject can request, among other things:

• confirmation that processing exists and access to the data;
• correction of incomplete or outdated data;
• anonymization, blocking, or deletion of unnecessary data;
• information about who the data was shared with;
• withdrawal of consent.

Have a simple channel for these requests (clinic email or phone) and respond in writing. When part of the photos must be kept because of a legal obligation, explain this to the patient.

LGPD checklist for photos in the clinic

1. Form with separate, checkable purposes, signed before the first photo.
2. Mention of the use of third-party software and AI, where applicable.
3. Specific authorization for publication, separate from the clinical record.
4. Photos in a dedicated location, with a password, outside the personal camera roll.
5. Team with individual access and instructed not to circulate images.
6. Retention period defined according to your professional board's rule.
7. Channel for patient requests and a written response.
8. Revocation procedure: take out of circulation what was published.

Good photography starts with good consent. For the technical side of the photo, see the guide to standardized clinical photography.