LGPD in facial harmonization: patient photos and data

LGPD is Brazil's General Personal Data Protection Law, Law No. 13,709/2018. It sets rules for the collection, use, storage, sharing and deletion of personal data by companies and professionals, including offices and clinics. Enforcement is the responsibility of the National Data Protection Authority (ANPD).

Why does the LGPD matter in HOF?

In day-to-day orofacial harmonization, you handle several kinds of personal data: name, contact details, health history, photographs of the face. A photo of the face identifies the person and is therefore personal data. The law classifies as sensitive personal data, among others, data relating to health and biometric data tied to a natural person. Clinical photos can fall into those categories depending on context and use, for example when they are used for biometric identification or form part of the patient's health record. Sensitive data has stricter rules.

Which general precautions apply to the clinic?

• Know why each piece of data is collected and use it only for that purpose.
• Have a legal basis for each processing activity, and specific consent when consent is the basis, as with using an image in promotion.
• Inform the patient clearly, including when data is shared with third parties.
• Protect access to photos and patient records and keep them only as long as necessary.
• Honor data subjects' requests, such as access, correction and deletion, as the law provides.

The procedure's informed consent and the image-use authorization are different documents and should be handled that way. More in consent and the LGPD for photos.

In Harmy

The photo is sent to a third-party AI to generate the projection, with the professional's consent in the app. The face contours used for marking are calculated on the device itself and are not stored. Account deletion can be done inside the app.

This content is informational and does not constitute legal advice.

Also called: General Data Protection Law, Law 13,709.