Clinic Privacy Policy Template for Your Website

November 11, 2026 · 4 min read

Editorial illustration about a clinic privacy policy template for the website

A privacy policy is the public document in which the clinic explains, in plain language, what data it collects, what for, who it shares it with and how data subjects exercise their rights. On a clinic's website, it usually sits in the footer and is cited in forms, booking pages and cookie banners.

A well-written policy conveys professionalism and complies with Brazil's General Data Protection Law (LGPD). A copied policy that does not describe real practice can be worse than none. Use this template as a starting point.

What should the policy contain?

Block	What to explain
Who we are	Name, CNPJ (Brazilian company registration number), address and contact of the controller
Data collected	Which data, and where it comes from
Purposes	What each piece of data is used for
Legal basis	The grounds for each type of processing
Sharing	With whom and why
Storage and security	Where and how we protect it
Retention period	For how long
Data subject rights	How to exercise them
Cookies	What the website uses
Changes	How we update the text

Policy template

Template

PRIVACY POLICY

Last updated: ________

1. Who we are. ________ (clinic), CNPJ ________, headquartered at ________, is responsible for processing the personal data described in this policy. Privacy contact: ________ (name and email).

2. What data we collect.

Data you provide: name, phone number, email, date of birth, address and the message sent through forms or WhatsApp.
Care data: health information and images, recorded in the patient record and protected by professional confidentiality.
Website browsing data: IP address, device type, pages visited and cookies.

3. What we use it for. To answer inquiries and schedule appointments; to provide and record care; to issue receipts and meet legal obligations; to improve the website and the service; to send communications, when you authorize them.

4. Legal basis. We use your data in accordance with the LGPD, on the following grounds: performance of a contract or preliminary procedures; protection of health; compliance with a legal or regulatory obligation; legitimate interest, where applicable; and consent, where required.

5. Who we share it with. Only when necessary: laboratories, payment processors, accountants, technology providers acting on our behalf and authorities, when required by law. We do not sell your data.

6. How we protect it. We adopt measures such as access control, passwords, backups and staff training. No system is completely immune, and we commit to acting transparently in the event of an incident.

7. How long we keep it. For as long as needed for the purposes and for legal and regulatory requirements. Patient records follow the rules of the professional council. Contact and marketing data are kept until you ask for removal or no longer have a relationship with the clinic.

8. Your rights. You may request confirmation of processing, access, correction, anonymization, portability, information about sharing and withdrawal of consent, under the terms of the LGPD. Send your request to ________.

9. Cookies. The website uses cookies necessary for it to work and, if you accept, analytics and advertising cookies. You can change your choice in the cookie notice or in your browser.

10. Minors. Data of minors is processed with the consent of the legal guardian.

11. Changes. This policy may be updated. The current version will always be at this address, with the date of the last update.

Points that tend to cause problems

Describing what doesn't exist. If the policy says it doesn't use advertising cookies and the website does, there is a transparency problem. Before publishing, list the tools that are actually installed.

Mixing patients and visitors. A website visitor and a patient in care are in different situations. When necessary, separate the text and leave the processing of health data to the dedicated documents, such as the patient record and the informed consent.

Photos and images. Using a patient's image in promotion requires its own authorization; the policy is not enough. See consent and LGPD for photos.

How do you publish it well?

Put the link in the footer of every page, in the forms and on the WhatsApp Business profile. Write in clear language and avoid too much legal jargon. The goal is for the patient to understand it, not just for the document to exist. Train the team to answer data subject requests on time and record each request and response.

Frequently asked questions

Does every clinic need a privacy policy on its website?

Anyone who processes personal data, which includes contact forms, cookies and appointment booking, must inform the data subject clearly. A privacy policy is the usual way to do that, and it must reflect the clinic's actual practice.

Does the privacy policy replace the patient's consent?

No. It explains how data is processed. Consent, when it is the legal basis, is a specific act by the data subject, and health care has its own rules on patient records and confidentiality.

Can I copy another clinic's policy?

It is risky. The policy must describe what your clinic actually does. Use templates as a starting point and adapt them with a lawyer's help.

Do I need to appoint a data protection officer?

In Brazil, the LGPD provides for a data protection officer (encarregado) and requires publishing their contact details. Whether you need one and in what form depends on your size and the type of processing. Confirm with your lawyer.

Terms mentioned

LGPD in facial harmonization Patient record in facial harmonization Informed consent in orofacial harmonization Anonymization