Data protection officer (DPO) at a harmonization clinic

When people talk about LGPD (Brazil's data protection law) at an orofacial harmonization (HOF) clinic, the first ideas are consent, the privacy policy and care with photos. But there is a role that often falls into limbo: the data protection officer, known by the acronym DPO (in Portuguese, "encarregado"). This is the person the clinic appoints to receive data subjects' requests, guide the team and talk to the authority when necessary.

This guide explains, in management language, what the role means, when it is required or recommended, who can take it, what it involves day to day and how to formalize it without excessive bureaucracy. It is not a legal opinion. The exemption rules and the particulars depend on the national authority's rules and on the size of the clinic, and must be confirmed with whoever handles the area. See the general concept in LGPD.

What does LGPD say about the officer?

LGPD provides that the controller (here, the clinic) appoint an officer for the processing of personal data, and that the officer's identity and contact details be publicly disclosed, clearly and objectively. The national authority may establish cases of exemption and complementary rules, including differentiated treatment for small-scale agents. That is why the right question is not "does my practice need a DPO or not?" but "how is my clinic classified under the rules in force and how do we document the decision?"

The activities set out for the officer include:

• accepting complaints and communications from data subjects, providing clarification and taking action;
• receiving communications from the authority and taking action;
• guiding employees and contractors on data protection practices;
• carrying out the other duties set by the controller or by complementary rules.

Who can be the officer?

Whichever you choose, the person needs to:

1. Understand the basics of LGPD and of the clinic's routine.
2. Have a direct line to management, to bring serious decisions up in time.
3. Have reserved time, even if only a few hours a month.
4. Be known by the team and patients.
5. Keep confidentiality about what they see.

What does the officer do in the routine of an HOF clinic?

In a small clinic, the role is not a full-time position; it is a responsibility with a routine:

• Maintain the data inventory: where records, photos, systems, clouds and phones are. See disposal of patient photos and data.
• Review documents: privacy policy, terms, forms, collection notices and contracts with third parties. Use the clinic privacy policy template as a starting point.
• Handle data subject requests: access, correction, deletion, portability, withdrawal of consent.
• Train the team: at onboarding and at each review, with real cases from the front desk, marketing and the treatment room.
• Support incidents: receive the alert, lead the investigation and get management to decide on communication.
• Follow up with suppliers: systems, agencies and software that process data on behalf of the clinic.
• Review marketing: consent, emails, ads, pixel and use of images. See LGPD in clinic marketing and cookies and pixel on the clinic website.

How does handling a data subject request work?

Deadlines and response format are set out in the law and in the authority's rules; confirm the current ones. A refused request must have a clear justification, for example when it involves data the clinic is required to keep, such as the patient record. See patient record retention period in HOF.

How to formalize it without excessive bureaucracy?

A lean formalization has four steps:

1. Decide who will be the officer and record the decision in a simple, dated document.
2. Publish the contact on the website and in the privacy policy (name or role and email).
3. Describe the role on one page: what they do, who they report to, how much time they spend.
4. Train the team to forward requests to the officer and to recognize incidents.

And when an incident happens?

An incident is any event that could compromise personal data: a lost phone with photos, an email sent to the wrong patient, unauthorized access to the system, a break-in. The officer has a central role:

• Receive the alert quickly, without punishing the person who reports it. Punishing creates silence.
• Contain the problem, with practical actions (change passwords, revoke access, lock devices).
• Assess the risk to data subjects with legal and technical support.
• Decide on communication to the authority and to data subjects, according to the rules in force.
• Record what happened, what was done and what will change.

Understand the concept in security incident and see prevention measures in data security at the HOF clinic.

How does using tools like Harmy fit into this conversation?

Every tool that processes patient data must be in the inventory and understood by the officer. In Harmy's case, the facts relevant to the inventory are:

For the officer, the question is: was the patient informed about the use of the tool and did they consent? Does the professional record that consent? See AI with patient photos: consent and patient consent to use Harmy.

The officer is not a legal shield or a figurehead position: it is the person who keeps the clinic attentive to the subject every month. In HOF clinics, where the patient's face is part of the work, having someone with this responsibility clearly assigned is a concrete way to care for what the patient has entrusted.