LGPD in Patient Records and Photos at the HOF Clinic

Patient records and photos are the most valuable and the most sensitive material at an orofacial harmonization (HOF) clinic. Valuable because they support care, planning and the professional's defense. Sensitive because they reveal health, face and, often, a patient's private life. Brazil's General Data Protection Law (LGPD) treats this kind of information with special attention, and a clinic that does not get organized risks leaks, complaints and losing the patient's trust.

This guide covers the essentials of the LGPD applied to patient records and photos: what sensitive data is, what legal basis processing rests on, who should have access, how to store and dispose of data, and how to respond to the patient. It is general guidance, not a legal opinion: how it applies to your case should be confirmed with specialized counsel and with your professional board's rules.

What does the LGPD consider sensitive data?

Information about health is sensitive personal data. The patient record, medical history, concerns, medications in use, allergies and procedure records all fall here. A photo of a patient's face in a healthcare setting is usually treated with the same care, because it reveals the clinical condition and identifies the person. When a face is used to identify someone automatically, it can also be facial biometric data.

In practice, that means three precautions: a clear purpose (what the data is used for), necessity (only what is needed) and security (who accesses it and how it is protected). See consent and LGPD for photos.

What does processing rest on?

The LGPD requires a legal basis to process data. In a clinic, the most common ones are usually:

Beware of the most common mix-up: consent for the procedure (informed consent) is not consent to publish the image. They are different documents with different purposes. See the patient image use consent template.

Who should have access?

The principle is least privilege: each person accesses only what they need to do their work. In practice:

• The responsible professional sees the full record of their own patients.
• Reception sees scheduling and contact data, but not necessarily clinical history and photos.
• Third parties (accountant, IT company, marketing) should not see records or photos.
• Interns and new employees access only what is necessary, after training and signing a confidentiality agreement.

Define a simple rule, in writing, and review it when the team changes. See delegating tasks in the HOF clinic and hiring a receptionist.

Where and how to store

Patient record

On paper: a locked cabinet, in a room with controlled access. In a system: individual login, strong password, backups and an access log. Avoid loose spreadsheets and personal notebooks.

Photos

Clinical photos should stay in a place controlled by the clinic, linked to the patient record and named so that they do not expose the patient outside the system. Avoid leaving them in a personal phone gallery, in WhatsApp groups or in shared folders without a password. See sending patient photos by WhatsApp and the LGPD and the standardized photo checklist.

Basic security

• Passwords on phones, computers and systems.
• Backups in a protected place.
• Software updates.
• Care with open Wi-Fi networks when sending data.
• Quick team training on phishing scams.

Retention and disposal

The clinic should neither keep everything forever nor delete on its own. Retention periods for patient records are set by legal and professional board rules, and may vary by profession and type of record. The safe path:

1. Find out the period that applies to your profession and your type of document (check with your board and your counsel).
2. Record that period in the clinic's retention policy.
3. At the end of the period, dispose of it securely (shredding paper, permanent deletion in the system and in backups).
4. Record the disposal, without exposing the content.

Photos that are not part of the patient record, such as images for advertising taken with consent, should be disposed of when consent ends or is withdrawn. See disposing of patient photos and data.

Patient rights

The LGPD gives the data subject rights such as confirming that processing occurs, accessing the data, correcting what is wrong, requesting information about sharing and, in certain situations, requesting deletion. Not every request can be fully met: data the clinic must keep by legal obligation stays, and the reply should explain that.

Have a clear path: a channel (email or form) to receive the request, a person in charge, an internal deadline to respond and a record of the handling. See LGPD data protection officer at the clinic.

Incident: what to do if there is a leak

A lost phone with photos, an email sent to the wrong person, a hacked system: all of these can be security incidents. Have a simple plan:

1. Contain (change passwords, disable access, locate the device).
2. Assess what was exposed and who was affected.
3. Record what happened.
4. Assess with legal counsel whether the patient and the authority must be notified, as the law requires.
5. Fix the cause and train the team.

The sooner the clinic reacts, the smaller the damage. Preventing the incident is still better than fixing it.

Common mistakes

• Thinking the procedure consent form covers advertising with images.
• Keeping photos on a personal phone, with no password.
• Sending a record or photo over an unprotected channel.
• Giving the entire team full access.
• Deleting or keeping everything with no policy.
• Having no channel for patients to exercise their rights.
• Posting a patient's photo without specific written authorization.

How Harmy fits in

In Harmy, the professional gives their acceptance in the app before the photo is sent to a third-party AI. The face contours are computed on the device and are not stored. The public routes of the patient link do not return the patient's name. The account can be deleted from within the app. This does not replace the clinic's LGPD policy: the patient record, patient consent, retention and disposal remain the professional's responsibility.

Summary

Treat patient records and photos as sensitive data: a clear purpose, a reviewed legal basis, restricted access, retention and disposal under a written policy, and separate consent for advertising and for AI. Train the team, have an incident plan and answer the patient transparently.