Patient photos on social media: legal risks

The temptation is understandable: the result looks good, the patient is happy, and the before and after photo would be the best promotional material. But social media turns a health image into public content, which can be copied, reposted and hardly ever taken back. Between good intentions and legal risk, there is a series of checks that many clinics skip.

This page gives an overview, in plain language, of the risks of publicizing patient photos. It is written for the Brazilian context (the LGPD, Brazil's data protection law; CFO and CFM, the federal councils of dentistry and medicine; CONAR, the advertising self-regulation council) and does not replace legal advice or your professional council's rules, which should be checked in their current version.

What are the main risks?

Each item can lead to a complaint to the council, a civil lawsuit or an administrative sanction, and each depends on the case and the applicable rule. That is why the check comes before posting, not after.

Consent for publicity is different

The consent the patient signs for clinical documentation authorizes the photo in the chart. To publicize, a separate authorization is needed, one that states clearly:

• which image will be used and where (profile, website, ad);
• for how long;
• that participation is voluntary and does not affect care;
• that the patient can revoke consent;
• whether there is any compensation.

The topic has dedicated pages: separate consent for publicizing images, image authorization for publicity: how to raise it and image use agreement.

What do the CFO, CFM, CONAR and LGPD say, in general terms?

Without going into details that change with each version of the rules, the general picture is this:

• Professional councils have rules on advertising and publicizing patient images, which vary among them. Check the current rules of your council, and do not assume what "everyone does".
• CONAR deals with advertising in general and requires truthfulness, without misleading the consumer.
• The LGPD classifies health data as sensitive and requires a legal basis and a specific purpose for processing, including use in publicity. See LGPD and LGPD legal basis.

For a practical map of what is usually allowed and what is usually prohibited, read what you can publicize (CFO and CONAR) and consent and LGPD in photos. Anyone in doubt should consult their council or a specialized lawyer.

Which mistakes happen most?

1. Posting before asking for authorization, and asking afterward "if there is no problem".
2. Using the photo of a patient who did not formally agree.
3. Covering only the eyes, while keeping a tattoo, scar or setting that identifies (covering the eyes in the patient photo).
4. Editing the image to improve the result (to edit or not to edit the clinical photo).
5. Writing a caption with a promise ("transformation", "guaranteed").
6. Tagging the patient or mentioning their name without authorization.
7. Using a photo of another professional's procedure.
8. Publicizing a photo of a minor without the guardian (photo of a minor patient).

What if the patient changes their mind?

Consent for publicity can be revoked. Have a clear procedure: on receiving the request, remove the image from the clinic's channels, record the date of the request and of the removal, and inform the patient. On social media, the image may already have been copied by third parties, which reinforces the importance of assessing the risk beforehand. See the flow in deleting a patient's photo on request.

Safer alternatives

• Educational content without patient images: anatomy, indications, aftercare and frequently asked questions.
• Illustrative images clearly identified as such, never presented as an actual result.
• Testimonial with express authorization, where the applicable rule allows it.
• Hired model with a specific agreement, where allowed.

An illustrative simulation can never be presented as the result of a procedure. Harmy's page on this topic is what you can publicize (CFO and CONAR).

And in Harmy?

In Harmy, the shared image carries the simulation notice, and the app should not be used to publicize a projection as an actual result. The projection is illustrative and serves the conversation during the consultation. The app does not post to social media or generate publicity consent.

Summary

To publicize a patient photo, you need specific consent, attention to your professional council's rules, care with the LGPD and a check before posting. When in doubt, do not post.