LGPD in Clinic Marketing: Consent for Contact

Clinic marketing runs on contact: follow-up messages, reminders, broadcast lists, ads, profile photos. Each of these touches the patient's personal data and, in healthcare, a type of data the law treats with extra care. Brazil's General Data Protection Law (Law 13,709/2018, LGPD) does not forbid the clinic from communicating. It requires the clinic to know why it uses the data, on what legal basis, for how long and how the patient can say no.

This guide translates that into marketing for the orofacial harmonization (HOF) clinic: what personal and sensitive data are, which legal bases exist, how to ask for and record consent for contact, how to handle lists and messages, what rights patients have, and a step-by-step plan to get organized. Using patient photos is a separate subject and is covered in consent and LGPD for photos.

What data does the clinic process in marketing?

Note: the list of patients who had a specific procedure is itself health information. Using it to segment a campaign ("those who had lip filler") is processing sensitive data for marketing, and that calls for more caution than sending a general notice.

What legal bases exist?

The LGPD says all data processing needs a legal basis (art. 7 for ordinary data; art. 11 for sensitive data). In practical terms, the most relevant ones for a clinic are:

The key point: clinical care and marketing are different purposes. Data collected to treat the patient does not automatically become campaign material. If the clinic wants to use contact details for promotion, it needs its own basis for that, and consent is usually the clearest path.

Is a follow-up reminder marketing?

It depends on the content. A reassessment reminder with a clinical reason, tied to care already contracted, falls closer to the patient relationship. A message with a discount, package or invitation to a new procedure falls closer to marketing. Mixing the two in one message erases the difference and makes the clinic harder to defend. So:

• Separate the flows: care reminders on one side, promotional communication on the other.
• Give the patient the option to receive one without the other.
• Avoid commercial offers in the reassessment message. See patient recall in HOF.

How do you ask for and record consent for contact?

Valid consent has characteristics the clinic must meet. In practice:

1. Ask separately. Do not bury the agreement inside the procedure form or registration. Use its own item ("I authorize receiving communications from the clinic by WhatsApp and email").
2. State the purpose. What will be sent (reminders, news, offers) and through which channel.
3. Do not pre-check the box. Acceptance must be active.
4. Explain how to refuse and that the patient can change their mind at any time.
5. Record it. Keep the date, channel, the text shown and who recorded it. A field in the registration and in the patient record is enough.
6. Review from time to time and clean out anyone who asked to leave.

A short text for registration or the form:

Agree on the options with the contact of the person who handles the data (the person responsible at the clinic). Form templates are at patient image use consent template and WhatsApp scripts.

What rights does the patient have?

The LGPD (art. 18) guarantees the data subject, among others, the right to:

• confirm that the clinic processes their data and access it;
• correct incomplete or outdated data;
• request anonymization, blocking or deletion of unnecessary data or data processed in breach of the law;
• request information about with whom the data has been shared;
• withdraw consent (art. 8, § 5), which remains valid for what was already done but must stop going forward;
• object to processing done without consent, where the law is not being followed.

The clinic needs a simple channel to receive these requests (email, form or trained reception) and a procedure for responding within the regulated deadlines. Record each request and the reply. Deletion does not apply to data the clinic must keep by legal obligation, such as the patient record, and this should be explained to the patient.

What to do about lists and mass messages?

Even when the LGPD allows contact, other rules may apply: those of messaging and ad platforms, Brazil's Consumer Protection Code and your board's advertising rules. See advertising harmonization prices and paid ads for HOF within the rules.

What about the website, pixels and ads?

If the clinic's website uses forms, cookies, ad pixels or a WhatsApp button with tracking, it processes browsing data. The recommended minimum:

• A clear privacy policy on the site, stating what data it collects, for what, and how to exercise rights.
• A cookie notice when there are non-essential trackers.
• Care with health data in ads: do not send platforms patient lists by procedure or events that reveal a health condition. That is sensitive data.
• A lean form: ask only for what you need (name, contact, interest).

More on the site in website for HOF clinics.

How long to keep data and how to protect it?

• Patient record: follows your board's rules and healthcare legislation on retention. Check with your board and your lawyer.
• Marketing data: keep it while there is a purpose and consent. Anyone who asked to leave must be removed from lists, keeping only the record of the request.
• Access: limit by role. Reception does not need to see the patient record, and sales does not need to see photos.
• Devices: use the clinic's accounts and devices, with passwords and locks, instead of team members' personal phones.
• When an employee leaves: revoke access and collect devices.
• Vendors: anyone who processes data on the clinic's behalf (management system, agency, messaging tool) needs a contract with data protection clauses. See management software for HOF clinics.
• Security incident: have a plan for leaks or unauthorized access, including notifying the patient and the ANPD where applicable.

A one-month step-by-step plan

After that, review every six months or whenever a new channel appears (for example, a new system or a campaign).

Common mistakes

• Thinking that "the patient knows the clinic" removes any need for care.
• Using the patient record to segment campaigns.
• Pre-checking the consent box or burying it in the form.
• Creating WhatsApp groups with patients.
• Giving patients no way to ask to leave.
• Buying a contact list.
• Using team members' personal phones to store photos and conversations.
• Not recording consent, leaving you without proof.
• Sending health data to ad platforms.

How Harmy handles data

Harmy is a professional's app. The patient's photo is sent to a third-party AI to generate the projection, with the professional's acceptance in the app, and the face contours are computed on the device and are not stored. That does not replace the patient's consent: the professional must explain to the patient what will be done with the photo and obtain the necessary authorization. The app's reminders (push and email) can be turned off under Account, Reminders. The projection is an illustrative simulation; never use it in advertising as if it were a result.

LGPD checklist for marketing

• Do I know what data the clinic collects and where it is?
• Does each marketing use have a defined legal basis and purpose?
• Is contact consent separate, active, with a purpose and a record?
• Are care reminders kept separate from promotional messages?
• Can the patient refuse and withdraw easily?
• Is there a channel for data subject rights and a privacy policy on the site?
• Are lists our own, with no groups and no purchases?
• Role-based access, clinic devices and an incident plan?
• Has the team been trained?
• Has a lawyer reviewed the texts and flows?

The LGPD does not stop the clinic from communicating: it asks that communication be transparent, purposeful and respectful of the patient's choice. For those who work with health and image, that is part of the trust that sustains the business.