Patient photos on personal WhatsApp: risks

WhatsApp is where the team already is, where the patient answers quickly, and where a photo arrives in seconds. That is exactly why it is the most used and least controlled channel for patient photos. The convenience hides risks that only show up when something goes wrong: a lost phone, the wrong group, a backup nobody knew existed.

This page lists the practical risks of using a personal messaging app for clinical photos and proposes workable alternatives for small clinics. The topic is privacy and good practice, not legal advice.

Why is a patient photo sensitive data?

An image of a face in a health context identifies the person and reveals information about their treatment. Under the LGPD (Brazil's General Data Protection Law), it is sensitive personal data, which requires a clear purpose, a legal basis, security, and care when sharing. The topic is covered in detail in consent and LGPD in photos.

What are the risks of personal WhatsApp?

Each item is small on its own, but together they make it unlikely that the promise of confidentiality made to the patient can be kept. See the deletion workflow in deleting a patient photo on request.

What is the camera roll and why is it a problem?

When the photo lands in the camera roll, it follows the phone's rules: it syncs to the personal cloud, shows up in memory suggestions, shared albums, and editing apps. The professional can, without meaning to, show a patient's photo while opening the album for an acquaintance. The page camera roll and patient photos explains how to adjust the settings, and cloud storage for patient photos covers storage alternatives.

How can you reduce the risk without giving up WhatsApp?

If the clinic cannot give up the channel, the damage can still be reduced:

1. Use a clinic phone number and device, not personal ones.
2. Turn off auto-download of media and cloud backup of media.
3. Turn on two-step verification and a biometric screen lock.
4. Set a written policy: who can send, what, and to whom.
5. Avoid large groups with patient photos.
6. Move the photo to the medical record and delete it from the chat after use.
7. If possible, minimize the data: send without a name, location, or full face when the purpose allows.
8. Ask for the patient's consent for this channel.

And when the patient is the one sending the photo?

In remote follow-up, it is common for the patient to send a photo of a bruise, swelling, or a concern. That is legitimate and often necessary. Tell the patient to use the clinic's official channel, receive it, move it to the medical record, and delete it from the chat. For this case, see bruise and swelling photos for follow-up. Explain that the patient should not send intimate photos or photos of other people.

What if a photo went to the wrong place?

Act quickly and calmly:

• delete the message for everyone, if the app allows it, and ask the recipient to delete it;
• record what happened (what, when, to whom);
• tell the clinic's manager and, if applicable, whoever handles data protection;
• assess whether the patient should be notified, according to internal policy and specialist guidance;
• review the routine to prevent it from happening again.

What alternatives exist?

• A medical record system with an image module and per-user permissions.
• Clinic storage with login, controlled backup, and an access log (storing patient photos and backing up clinical photos).
• A dedicated clinic device, with no personal accounts.
• A secure channel for a second opinion, when needed (sharing a photo with another professional).

And in Harmy?

Harmy stores projections in the per-patient history inside the app, and the photo goes to the third-party AI only with the professional's acceptance. It keeps the photo from circulating in messaging apps, but an image the professional shares (for example, the before and after with a simulation notice) then depends on the rules of the channel chosen. Use sharing carefully and with the patient's consent.

Summary

Separate the device and number, turn off automatic backups and downloads, keep a written policy, and move photos to the medical record. Personal WhatsApp is convenient, but it was not built to hold sensitive health data.