Metadata and location in patient photos

A patient photo carries more than the face. Inside the file there is an invisible layer of information: when it was taken, with which device, with which settings and, depending on the phone, where on the map. This data is called metadata, and the best-known format is EXIF.

For the orofacial harmonization (HOF) professional, the topic comes up at two moments: when the photo goes into the patient chart and when it leaves the clinic, whether to another professional, to the manufacturer, to a lecture or to social media. Knowing what is stored helps you decide what to send.

What does a photo's metadata reveal?

Each phone stores a set of fields. Some are useful to the clinic, others expose too much.

The biggest concern is GPS. Whoever receives a photo with coordinates can see where it was taken, and that exposes the clinic's location or, for care outside the office, a residence.

When does location become a privacy problem?

A clinical photo taken inside the clinic exposes, at most, the clinic's own address, which is usually public. The risk grows in three situations:

• Home visits or care at another location: the coordinates end up pointing to the patient's home or a private address.
• Photo taken with the professional's personal phone: the metadata mixes in the location habits of the person taking the photo.
• Sending to third parties: the photo leaves the controlled environment and reaches people who do not need to know where or when it was taken.

Health data and facial images are considered sensitive data under the LGPD (Brazil's General Data Protection Law). Leaking metadata along with the photo increases what the third party knows about the patient and about the clinic's routine. The general recommendation is to minimize: send only what the recipient needs.

How do you turn off location in the camera?

Most phones let you turn off location recording for the camera only, without disabling the device's GPS. On Android, it is usually in the camera settings, under "location tags" or "save location". On iPhone, it is in the privacy settings, under the Camera app's location permission.

Do this on the phones used at the clinic and confirm the option stays off after updates. Changing devices or switching camera apps may turn the feature back on. For using the camera inside the Harmy app, see the section below.

How do you strip metadata before sharing?

There are three paths, from the simplest to the most controlled:

1. The phone's own option: many galleries and sharing apps have an option to send without location. When sharing, look for "remove location" or something similar.
2. Screenshot: produces a new image without the original metadata, but lowers the resolution and adds screen information. It works for showing a colleague, not for documentation.
3. EXIF-cleaning tool: apps and programs that remove the fields and save a copy. Prefer tools that run on the device, without uploading the photo to an outside server, so you do not create another leak.

Avoid free websites that ask you to upload the photo to "clean" it. You would be handing the patient's image to an unknown third party to prevent a metadata leak, which only trades one risk for another.

Does metadata also help?

Yes, and it is not worth deleting everything by reflex. The date and time of the photo support the chart's chronology, prove the interval between sessions and help confirm that the "after" was taken within the agreed window. Camera settings help repeat the photo the same way, the topic of standardizing photos between visits.

In any later dispute over a record, the date embedded in the file reinforces the document's integrity. That is why the rule is: preserve it in the original, remove it from the copy that leaves. According to your professional council's rules and Brazilian medical-record legislation, also check how to store the original, the subject of retaining photos in the patient chart.

What about when the photo goes to the manufacturer, a colleague or a lecture?

Each destination calls for a different level of care.

• Another professional treating the same patient: may need the date and context. Send through a secure channel and agree on what remains stored. More at sharing a photo with another professional.
• Manufacturer, in case of a complication: see sending a patient photo to the manufacturer, paying attention to what must be disclosed.
• Lecture or congress: requires specific consent and a photo without metadata. The case is covered in patient photo at a congress or lecture.
• Social media: requires its own consent and the rules for publication, covered in patient photo on social media.

What does Harmy do with the photo?

In the app, the professional picks the photo from the camera or the gallery and submits it to generate the projection. The photo is sent to a third-party AI, with the professional's consent in the app, and the facial contours computed on the device are not stored. The sharing image generated by the app shows before and after with the clinic's header and the simulation notice, and it is a new image, not the original camera file.

Even so, the device's photo folder remains your responsibility. If you use your personal phone, patient photos end up mixed with your gallery, which calls for care, the subject of phone gallery and patient photos. The projection is an illustrative simulation and should never be treated as a record of results.

Summary for the routine

Turn off camera location, keep the original with its date in the patient chart and send a copy without metadata outside the clinic. Treat the photo file as a layered document, not just an image. When in doubt about retention periods and sharing, check your professional council's rules and the clinic's privacy policy.