Disposing of Patient Photos and Data in the Clinic

Every orofacial harmonization (HOF) clinic accumulates data: intake forms, signed consent forms, patient records, before and after photos, WhatsApp conversations, quote spreadsheets. Attention usually goes to collection (how to ask for it and how to protect it). But the LGPD (Brazil's data protection law) also covers the end of the cycle: what no longer needs to be kept must be securely deleted. A face photo forgotten on an old phone is both a privacy risk and a liability.

This guide describes the data life cycle in the clinic, how to separate what you keep from what you dispose of, how to securely dispose of photos and documents, and how to record it all. It is not legal advice: periods and rules depend on the law and on your professional board's rules, which should be checked in an official source. For the consent basis, see LGPD consent for patient photos.

What is the life cycle of patient data?

Every piece of data goes through stages, and the clinic's policy should say what happens at each one:

The most common mistake is to think only about the first three. Retention and disposal require an explicit decision, because "forgetting" turns into indefinite accumulation of data.

What must be kept and what can be disposed of?

Separate the data into three groups and give each one a destination:

1. Required by law or by professional board rule: the patient record and associated documents. The retention period is set by outside rules and changes over time. See patient record retention period in HOF and record retention.
2. Kept for a legitimate purpose of the clinic: tax documents, contracts, receipts. Periods follow the applicable law; confirm with your accountant.
3. Kept by consent: promotional photos, testimonials, image use. They are valid while the consent is in force and can be withdrawn when the patient asks.

Data that fits none of these groups (contacts of people who only asked about prices, duplicate photos on phones, copies of documents from people who never became patients) is a candidate for disposal.

Where do photos and data hide?

The list of places is longer than it seems:

• Phone gallery of the professionals and the front desk.
• Messaging apps: conversations, groups, downloaded files, automatic backups.
• Personal cloud (automatic photo copies).
• Emails with quotes and consent forms attached.
• USB drives, external hard drives and old computers.
• Printed material: forms in folders, signed consent forms, printed photos.
• Editing and projection apps. Check what each tool stores and for how long.
• Third parties: agency, freelancer, management software.

See sending patient photos by WhatsApp and the LGPD for good practices with personal devices and data security in the HOF clinic for the full set of measures.

How do you take inventory before disposing?

Disposal without an inventory becomes an accident. First, do a simple survey:

1. List the repositories: systems, devices, folders, clouds, cabinets.
2. For each one, identify the type of data, the person responsible and the period covered.
3. Classify into the three groups above (required, legitimate interest, consent) or "no purpose."
4. Set the retention period for each group, with help from your accountant and legal counsel.
5. Mark what is past its period and schedule disposal.

How do you dispose of data securely?

The method depends on the format:

Watch out for copies. Deleting a photo from the gallery without deleting the automatic cloud copy, the file in the messaging app and the backup solves nothing. If complete deletion isn't possible (for example, backups on sealed media), document the limitation and restrict access, with guidance from whoever handles privacy at the clinic.

What happens when a patient asks for their data to be deleted?

The data subject has rights under the LGPD, and the clinic needs a process to respond to them. Good practice:

1. Receive the request through a defined channel and confirm the person's identity.
2. Assess which data can be deleted and which the law requires you to keep.
3. Delete what is possible, including promotional photos and marketing data.
4. Give the response clearly, including what could not be deleted and why.
5. Record the request, the decision and the date.

Anyone who withdraws consent for the use of their image should see the material taken out of circulation within a reasonable time: website, social media and printed materials. See data protection officer in the clinic for who can handle this process and LGPD in the clinic's patient records and photos.

Is anonymization an alternative to disposal?

In some uses, yes. Anonymization seeks to prevent the person from being identified, so that the data stops being personal. With face photos, however, this is hard: a bar over the eyes, for example, may not be enough to keep the person from being recognized by people who know them, and the face is facial biometric data in many contexts. For promotional content, the safest route is usually to not use patient images and to use a simulation with the fictional person instead, clearly labeled as illustrative.

How do you record the disposal?

A simple log is enough. Include: date, type of data, volume or period, reason for disposal, method used and person responsible. Keep this log without repeating the data that was disposed of. If questioned, it shows that the clinic has a policy and follows it. If something goes wrong, such as the loss of a device with photos, handling follows the logic of a security incident, with an analysis of the case and the applicable obligations.

Disposing well is a gesture of respect toward the patient: a clinic that knows what it keeps, why it keeps it and when it deletes it conveys the same care it shows in treatment. And it also reduces the amount of data that could leak one day.