Remarketing for a HOF clinic and LGPD

Remarketing is the practice of showing ads to people who have already had some contact with the clinic: they visited the website, interacted with the profile, opened a message. In ordinary retail, it is routine. In a healthcare clinic, it is delicate ground, because the simple fact that a person was interested in a procedure can reveal information about their health, and LGPD (Brazil's personal data protection law) treats health data as sensitive. An ad that appears saying "you viewed lip filler, come back to book" seems harmless to the one who set it up and invasive to the one who receives it.

This page tries to answer the practical question: what can be targeted? The honest answer is that there are safer paths and riskier paths, depending on the legal basis, consent, platform policies and your professional board's advertising rules. It is not legal advice. Before building any strategy that uses people's data, consult a data protection professional. For the general context, see LGPD in clinic marketing and cookies and pixels on the clinic's website.

Why health calls for more care

LGPD defines sensitive personal data, including data concerning health. A simple data point, such as "this person visited the under-eye filler page", can, combined with the visitor's identification, indicate interest in a health procedure. In addition, a facial image, when used to identify a person, receives reinforced treatment. See the entries LGPD, sensitive personal data and LGPD legal basis.

On top of that comes ad platform policy, which usually prohibits or restricts targeting based on health conditions and the use of sensitive data. Even if something were technically possible, the account can be limited. Finally, the advertising rules of the professional board and of CONAR (Brazil's advertising self-regulatory body) set limits on ad content. Remarketing has to get through four filters: LGPD, platform, board and ethics.

Four remarketing audiences, from safest to riskiest

As a rule of thumb, the closer the audience gets to an identifiable individual with a health interest, the higher the risk. The more it relies on interaction with general content, the lower.

What tends to be safer

With no guarantee of compliance, a few practices reduce the risk:

• Target by interaction with educational content, without gathering data on procedures or conditions.
• Keep procedure pages out of the remarketing audience. Group by broad themes, such as "skin care content".
• Do not upload patient lists to platforms without legal review and specific consent.
• Use generic, informative ads, with no reference to what the person viewed.
• Respect the user's choice: if they declined cookies, do not include them in audiences.
• Limit the period in which the data is used and define its disposal.
• Document the purpose, the legal basis and the decision.

Legal basis, consent and purpose

LGPD requires data processing to have a legal basis and a clear purpose. In marketing, consent is the most discussed basis. It must be free, informed, specific and prominent, and the data subject must be able to withdraw it. Consent is not hidden in a generic term.

See also LGPD data protection officer in the clinic, the clinic privacy policy template and the clinic LGPD consent form template. The templates need legal review.

Pixels and the website: what happens without you seeing it

A pixel installed on the website collects browsing data and sends it to the platform. If the site has a booking form, procedure pages or a patient area, it is easy to send more than you imagine. Common mistakes:

1. Installing the pixel without a cookie notice.
2. Sending events that contain a procedure, a concern or form data.
3. Setting up conversions that carry name, email or phone without a legal basis.
4. Forgetting the old pixel on pages the clinic no longer uses.
5. Letting a third party (agency, freelancer) configure it without review.

Run a technical audit with whoever is responsible for the website and the agency. See website for a HOF clinic, landing page and paid ads within the rules. If an agency is hired, the contract should provide for data processing and liability.

Alternatives to invasive remarketing

You do not always need to track people to stay in touch. A few alternatives respect privacy more:

• Broadcast list for people who asked to receive content. See broadcast list on the clinic's WhatsApp.
• Email marketing with clear consent. See email marketing for a HOF clinic.
• Recurring content on your profile and blog, which attracts people who already have an interest. See content marketing for HOF.
• Patient recall by direct contact, as agreed with the patient. See patient recall.
• Asking for referrals at the right time. See patient referrals.

What Harmy does and does not do with data

Harmy is a consultation tool and does no remarketing or advertising. Face contours are calculated on the device and are not stored, and the photo is sent to a third-party AI only to generate the image, with the professional's consent in the app. The patient link opens the slider on the patient's phone, with the clinic's logo and contact, without exposing the name. That care serves as a reference: the less data circulates, the lower the risk.

Remarketing in healthcare does not have to be forbidden in every case, but it demands the right question before each campaign: how will the person feel when they see this ad? If the answer is discomfort, the problem is not the tool, it is the strategy.