Cloud storage for patient photos: what to require

A photo of a harmonization patient is an image of a face, tied to a health procedure. Brazil's data protection law treats this as sensitive data, and a shared folder with no controls or an open link can become a serious problem. The cloud is convenient, scalable and protects against losing the device, but it only serves those who choose the service with care.

This page lists the questions worth asking before you hire or keep using a service, without getting into brands or specific technical settings.

Why does the choice of cloud matter for clinical photos?

When the clinic stores the photo with a third-party service, it comes to depend on that third party's care. Under the LGPD (Brazil's General Data Protection Law), responsibility for processing the data stays with whoever decides how it is used, and the cloud provider acts as the processor. In practical terms: if the photo leaks, the clinic has to answer to the patient, to the oversight authority and, sometimes, to the professional council.

So the question is not "is this cloud good?" but "does this cloud let me fulfill my duty to protect the patient's image and to prove that I did?".

What should you require from a cloud service?

Use the table as a script for the conversation with the vendor or the person in charge of technology.

No single item guarantees security, but the absence of several indicates a service unsuitable for sensitive data.

What about the server location?

Location matters for two reasons: applicable law and access by a foreign authority. The LGPD allows international data transfer in specified cases, such as specific contractual clauses or the data subject's specific consent. That means storing on a server outside Brazil is not prohibited in itself, but it requires a legal basis and care.

What you can do: ask the vendor where the data is kept and whether copies exist in other regions; read the contract; and, if in doubt, consult a digital law professional. State in the informed consent form, when applicable, that the images are stored with a third-party service. Guidance on consent is in image consent for clinical documentation.

Access, team and passwords

Most incidents come from poorly controlled access, not from a sophisticated attack. An account used by the whole team, a password written on a sticky note, a former employee who still logs in. All of this is solved with discipline.

• Each person with their own login, and access removed the same day they leave the team.
• Permissions by role: someone who only sees patients does not need to delete or export everything.
• Two-step verification turned on for everyone.
• Password change when someone who left knew the password.
• No patient photos in the team's messaging group.

What if there is an incident?

Even when well configured, the cloud can fail. Define in advance: who notifies whom, within what time, and how the access log will be consulted. The LGPD provides for notifying the authority and the data subjects in case of an incident with relevant risk. Prepare a simple script, with the contacts of the vendor, the legal adviser and the clinic's data protection officer, if there is one.

Also keep an independent copy of the photos, preferably in a destination different from the main one, as described in backing up clinical photos. A cloud does not replace a backup: it can delete by mistake, lock the account or end the service.

Cloud, retention and deletion

Storing in the cloud does not change the retention period of the patient chart, only the place. If the patient requests deletion, you need to be able to delete the photo from the service, from backups and from copies, or explain when the law requires retention. See deleting a patient photo on request and retaining photos in the patient chart.

A service without verifiable deletion is a problem for the clinic. Before hiring, ask how a deletion request is made and how the vendor proves it.

What about Harmy?

In the app, the professional submits the frontal photo to generate the projection. The photo is sent to a third-party AI, with the professional's consent inside the app, and the session history stays in the clinic's account, with search by patient name. The facial contours computed on the device are not stored. The app is a tool to support the consultation and the simulation, and it does not replace your patient chart system or the storage of clinical photos.

So keep the chart and the clinical archive in your own system, chosen with the criteria above, and use Harmy for the projection and for sharing the simulated before and after, always with the illustrative simulation notice. The usage flow is in standardized frontal photo.

Summary for the routine

Choose the cloud by what it lets you prove: where the data is, who accesses it, what is logged and how to leave. Avoid personal accounts, review access, keep a separate backup and align everything with the patient's consent and your professional council's rules. The overview of the topic is in standardized clinical photography and in consent and LGPD for photos.