How Long to Keep Patient Records in HOF

Among the legal questions clinic owners ask, the retention period for patient records comes up constantly, and almost always with a word-of-mouth answer: "I heard it's twenty years." The topic is serious because you can get it wrong in both directions. Discarding too early can leave the clinic without documents to defend itself. Keeping records without criteria or protection can expose health data and facial images beyond what is necessary.

This guide helps you build a coherent retention policy: what to check in the rules, how to handle paper, digital files and photos, how to dispose of records safely and how to deal with deletion requests. It does not give a single period, because that depends on your council's rules and on current law in Brazil, which can change. Always confirm the current rule and consult a lawyer.

What the patient record is in an HOF clinic

The patient record is the set of documents from the care provided: patient identification, medical history, assessment, plan, informed consent, a record of the procedure (date, area, material and lot, when applicable), instructions, complications and follow-ups. In HOF, it generally also includes the clinical photographs that document the before and after.

Two points that often raise questions:

• Simulations made in an app (such as Harmy's projection) are not a result or a clinical record of the procedure. If the clinic decides to keep them, it should treat them as care material, with the same protection, and label them as simulations.
• WhatsApp conversations with the patient may contain health information. See sending patient photos by WhatsApp and LGPD.

Where to find the right period

There is no single number that applies to everyone. The rule can come from more than one source, and the strictest one that applies to your case prevails:

Two concepts help explain why the period tends to be long: the statute of limitations, which is the time during which a person can claim their rights, and record retention, which is the duty to keep the document available. Many clinics keep records for a long time precisely so they can defend themselves if a claim is filed. See informed consent in HOF and legal defense.

Paper, digital and photographs

The document format changes the precautions, but not the duty to retain.

For digital documents, the legal validity of signatures and scanning depends on technical requirements. See digital signature of forms in HOF and the entry on ICP-Brasil digital certificate. Scanning a paper record in order to discard the original later has its own rules, and should be checked against your council's rule before any disposal.

Retention vs. LGPD: not opposites

A frequent question: if LGPD requires deleting data when the purpose ends, how can you keep records for so long? LGPD allows keeping data when there is a legal or regulatory obligation to retain it, or for the regular exercise of rights. In other words: during the required period, the clinic must keep the record, with security, restricted access and a clear purpose. After the period, it must delete it.

This means two obligations at once:

1. Keep what the rule requires, for as long as it requires.
2. Protect and limit its use, and delete when the period ends.

See LGPD in the clinic's records and photos.

What if the patient asks to delete their data?

Data subjects have the right to request deletion, but that right meets a limit when there is a duty to retain. A responsible answer:

1. Record the request with the date.
2. Check which data the clinic is required to keep and which is dispensable (for example, marketing material and mailing list contacts).
3. Delete what you can and tell the patient in writing what will be kept and why.
4. Make sure the retained data is only used for the retention purpose.

For the full policy, see disposal of patient photos and data.

The time for disposal

Once the applicable period has passed, disposal should follow three rules:

• Internal authorization: the person in charge decides, recording the date and the list of what will be discarded.
• Secure destruction: paper shredded or incinerated; digital files deleted from every location, including backups and devices.
• Disposal record: a simple minute with the date, the person responsible and a description of the material.

Avoid throwing records into the regular trash. Health data on paper discarded without destruction is an incident waiting to happen. If there is a leak, see the entry on security incident.

Retention policy: a skeleton

Adapt it, review it with a lawyer and file it with the process manual. If the clinic has no data protection officer, define who answers for that role.

A simple compliance routine

Once a year, set aside an afternoon for four tasks: check whether the rule has changed, look at which records have completed their period, carry out and log the disposals, and test the backup (actually restore a file). If you have never tested your backup, you do not have a backup. To strengthen the routine, see the HOF clinic process manual and electronic patient records for HOF.

A note on support apps

If the clinic uses Harmy, keep in mind that the facial contours are calculated on the device and are not stored, and that the photo is sent to a third-party AI to generate the projection, with the professional's consent in the app. The app's history does not replace the clinic's patient record. Each clinic must decide how to archive what it considers part of the care and how to inform the patient about it in the consent form.