Patient registration form template with LGPD compliance

November 11, 2026 · 4 min read

Editorial illustration about a patient registration form template with LGPD

Patient registration is the first document the clinic keeps about a patient, and it is also where the obligations of Brazil's General Data Protection Law (LGPD) begin. A lean form with a clearly explained purpose avoids asking for information nobody uses and leaves the clinic safer in case of an inspection or an incident.

This template provides a registration form with a section of information about data processing. Use it together with the clinic privacy policy and the clinic LGPD consent form.

What is the minimum and what is optional?

Data	Use	Note
Name, date of birth	Identification	Required
CPF (Brazilian taxpayer ID)	Issuing receipts and identification	Required if issuing a tax document
Phone and email	Contact for care	Required
Address	Billing, invoice	As needed
Legal guardian	Minors	When applicable
Health data	Patient record	Sensitive data, separate basis
Contact preferences	Communication	Optional, with option to decline
Image authorization	Photos for promotion	Specific and separate

Form template

Template

PATIENT REGISTRATION FORM

Clinic: ________ CNPJ: ________ Date: ________

1. Identification data

Full name: ________
Date of birth: ________
CPF: ________
Phone with WhatsApp: ________
Email: ________
Address: ________

2. Legal guardian (if a minor or legally incapable)

Name: ________ CPF: ________ Relationship: ________

3. Emergency contact

Name and phone: ________

4. Information about how your data is processed

The data above is used to: (a) identify you and schedule appointments; (b) issue receipts and billing documents; (c) comply with legal and regulatory obligations; (d) record your care in the patient record, protected by professional secrecy.

Your health data is handled with special care and is accessed only by those who need it for your care. The clinic does not sell your data.

Data may be shared only when necessary with: laboratories, payment processors, the accountant, or when required by law.

Data will be kept for the period required by applicable rules or, if there is none, for ________.

You may request confirmation of processing, access, correction and other rights provided by the LGPD through the contact: ________ (name of the person in charge and email).

5. Optional authorizations (may be declined without affecting your care)

Receive reminders and messages from the clinic by WhatsApp or email: Yes ( ) No ( )
Receive news and offers: Yes ( ) No ( )
Use of image for promotional purposes (separate document): Yes ( ) No ( )

I have read and understood the information above.

Place and date: ________

______________________ Patient (or legal guardian)

Points that deserve attention

Sensitive data. Health information has reinforced protection. It stays in the patient record, with restricted access, and should not circulate through informal channels.

Minors. Registration requires the legal guardian and, at the appointment, an authorization document. See the guardian authorization template for minors.

Separate marketing. Someone who agrees to be treated does not automatically agree to receive offers. Keep separate checkboxes and respect a refusal.

A photo is not registration. Image use has its own document, such as the image use consent form. See also consent and LGPD for photos.

Data subject rights in daily practice

Define in advance who receives requests (access, correction, deletion where applicable) and how quickly they are answered. A dedicated email and one person in charge are enough in small clinics. Record the request and the response. When data needs to be anonymized for a study or case presentation, see the entry on anonymization.

Incidents

If a device containing data is lost, or there is improper access or a leak, the clinic must act fast: contain it, assess the risk, notify whoever needs to be notified and document everything. Define this flow before you need it, and train the team to alert the person in charge as soon as they notice a problem.

Frequently asked questions

What data can I ask for when registering a patient?

What is needed for the purpose: identification, contact, billing data and, when health care is involved, the data for the patient record. Avoid asking for what you will not use. The LGPD (Brazil's General Data Protection Law) requires necessity and adequacy.

Does registration require the patient's consent?

Not always. The LGPD provides other legal bases, such as contract performance and protection of health. The basis for each purpose should be defined with legal support. For additional uses, such as marketing or photos, specific consent is usually requested.

Can I use the registration data to send promotions?

Only if the purpose has been disclosed and there is an adequate basis, normally specific consent with the option to decline. Mixing consent to promotions with consent to care is a practice to avoid.

How long should the data be kept?

Patient record data follows the rules of the professional council. Other data should have a retention period defined in the clinic's policy. Confirm the periods with your lawyer.

Terms mentioned

LGPD in facial harmonization Patient record in facial harmonization Informed consent in orofacial harmonization Anonymization