Health Data and AI Compliance for Clinics: What to Limit Under LGPD

Health Data and AI Compliance for Clinics: What to Limit Under LGPD

Health data and AI compliance for clinics starts from one fact: under Brazil's General Data Protection Law (LGPD), health data is sensitive personal data. A clinic that uses AI needs an appropriate legal basis, a clear purpose and the minimum data necessary at every step. In practice, the safest path is a narrow agent that handles scheduling, confirmations and administrative information, while everything that involves clinical judgment stays with qualified people.

Key takeaways

• Health data is sensitive data, and the legal grounds for processing it are narrower than for ordinary personal data.
• Each purpose needs its own justification: booking an appointment is different from marketing or training a model.
• Define the agent's scope by what it does not do: it does not interpret symptoms, test results or emergencies.
• WhatsApp is where patients volunteer clinical details without being asked, so the flow must anticipate that from day one.
• Vendor, processing location, log retention and human handoff must be decided before the pilot, not after.

Why health data needs more care when AI is involved

The LGPD treats health data as sensitive because the harm from exposure is greater, and so is the risk of discrimination. A clinic already handles this kind of information every day, with medical records, professional secrecy and the rules of its professional council. AI does not create the obligation, but it multiplies the points the data passes through.

Without AI, a patient message reaches the front desk's WhatsApp and stays there. With an agent, the same message may pass through the messaging platform, the system that hosts the agent, the language model provider and conversation logs kept for audit. Each of those is a processor or a system that needs a contract, access control and a retention period.

There is also a risk specific to models: they can answer confidently and be wrong. In a sales channel that is an annoyance. In a healthcare channel, an invented answer about a symptom or exam preparation is a real problem. That is why scope design matters as much as infrastructure security.

One caveat: this article organizes decision criteria and does not replace review by your legal counsel, your data protection officer (DPO) and the clinic's technical lead. Professional secrecy and advertising rules for health professions exist beyond the LGPD and should be checked separately.

Which legal basis can a clinic use with AI?

For sensitive data, Article 11 of the LGPD lists its own grounds. The two that come up most often in clinics are specific and prominent consent for defined purposes, and protection of health, in procedures carried out by health professionals, health services or health authorities.

The point to watch is that protection of health covers patient care, not any use of the data. Confirming a booked appointment is close to care. Using a patient's history to trigger campaigns, or sending conversations to a vendor to improve a model, is a different purpose and needs a separate analysis. If the justification is consent, it must be specific to that use, not a generic acceptance buried in a long terms document.

A good exercise is to write one sentence with three parts for each agent function: which data comes in, for what purpose, and under which legal basis. If the sentence does not close, the function is not ready. For more on consent and record keeping in messaging, see LGPD Compliance for AI on WhatsApp: Legal Basis, Consent, Records.

The law's principles also help cut scope: purpose, adequacy and necessity. If the agent can book the appointment without seeing the reason for it, it should not see the reason.

What to limit in the agent's scope

In clinics, the best design decision is usually to separate administrative work from clinical work. The agent operates on the first and routes the second. As a decision guide, these functions usually fit a narrow agent:

• Share the address, opening hours, accepted insurance plans and payment methods.
• Offer open slots, and confirm, reschedule and cancel appointments.
• Send standard preparation instructions that the clinic wrote and approved, with no free adaptation by the model.
• Remind patients of documents and previous exams they should bring.
• Collect the minimum registration data needed for the booking.

These functions should stay outside the agent, or always pass through a person:

• Interpret symptoms, say whether something is urgent or suggest a course of action.
• Comment on test results, reports or treatment progress.
• Advise on medication, dosage or stopping a treatment.
• Query the full medical record. If the agent needs something from the system, make it one specific field, read-only.
• Send clinical documents in chat without adequate identity verification.
• Use patient conversations for marketing, segmentation or model training.

Making these limits real takes more than writing them in a prompt. You need to validate inputs and outputs and restrict the tools the agent can call. Guardrails for AI Agents: Input, Output and Action Controls covers how to build this in layers.

WhatsApp: where the risk shows up first

Patients write what they feel. Even if the agent only books appointments, a rescheduling message may arrive with a description of pain, the name of a medication or a photo of an exam. In other words, the clinic will receive sensitive data in the channel whether it wants to or not. The design must treat that as a normal case.

Some practical decisions for the channel:

• A short opening message saying the channel is for scheduling and general information, and that clinical details should not be sent there.
• A handoff rule: when the agent detects a symptom, pain, a request for clinical guidance or a sign of urgency, it stops, says a person will reply and points to the emergency channel when appropriate.
• Verification before sharing appointment details, especially when someone asks about another person's appointment, such as a relative.
• Attachment handling: images and documents received should not be sent automatically to the model without an explicit decision about it.
• A defined retention period for conversation history, with access limited to those who need it.

Handoff is the most important piece of the set. WhatsApp AI Agent Human Handoff: A Production Playbook shows how to define triggers, queues and the context passed to the human agent. The booking flow itself is described in Automatic Appointment Scheduling on WhatsApp with AI: How It Works.

Vendors, models and international transfer

When a clinic hires an agent platform or uses a language model through an API, the vendor usually acts as a processor, handling data on behalf of the clinic, which is the controller. That calls for a clear contract, documented instructions and security measures that match the risk. It also means that personal or free accounts on chat tools should never receive patient data, not even to summarize a conversation or polish a message.

Before choosing a vendor, the clinic should be able to answer these questions in writing:

• Where is data processed and stored? If it leaves Brazil, what safeguards cover the international transfer provided for in the LGPD?
• Is the data you send used to train models? Can that be switched off by contract?
• How long are prompts, responses and logs kept, and who can access them?
• Is there role-based access control, with a record of who saw what?
• How does the vendor report incidents and support the response to the ANPD (Brazil's data protection authority) and to data subjects?
• Can one patient's data be deleted or exported on request?

Another useful technique is to reduce the data before it reaches the model. The agent can work with an internal identifier instead of a name and national ID number, and mask fragments it does not need to see. For threats specific to applications built on language models, such as prompt injection and leakage of sensitive information, OWASP maintains a list of risks that works as a technical checklist for your IT team or vendor.

Illustrative scenario: a rescheduling request with a symptom in the middle

Imagine a small clinic with a calendar covering several specialties and patient service on WhatsApp. This is an illustrative scenario, not a real case.

A patient writes: I need to reschedule my Thursday appointment, and I should mention the swelling in my ankle got worse. The agent is configured to handle the first part and not comment on the second. It replies that it can help with the rescheduling, but that the information about the swelling will be passed to the clinic team, who will get in touch. In parallel, it opens a ticket for a human agent with the context and marks the conversation as priority, without offering any opinion on severity.

The system log keeps what matters for audit: the action taken (rescheduling), the reason for handoff (symptom mentioned) and who took over. The symptom text is not copied into auxiliary tools such as spreadsheets or performance reports. If the patient keeps asking whether to take a medication, the rule is the same: the agent does not answer and keeps the person in the human flow.

What this scenario shows is that a useful agent is not the one that knows the most, but the one that knows when to stop.

Implementation plan in steps

The method we use for projects like this follows four moves: map, limit, pilot and hand over. In healthcare, the first two get more time than usual, because that is where risk is reduced. In the steps below, documenting the legal basis sits between limiting and piloting.

• Step 1, map: list the current service flow, which data moves at each stage, who accesses it and where it is stored. Record the starting point (response time, volume of reschedules, communication failures) so you have something to compare against later.
• Step 2, limit: choose a single flow, such as confirmation and rescheduling. Define allowed data, allowed actions, read-only tools wherever possible and the list of what is prohibited.
• Step 3, document the legal basis and the risk: record the purpose and legal basis for each function, and assess whether the case calls for an impact assessment. Data Protection Impact Assessment for AI Projects (LGPD RIPD) explains when to do one and what to include.
• Step 4, pilot: run the flow at controlled volume, with restricted log access, human review of conversations and a success metric agreed beforehand. Also test difficult conversations, with symptoms, relatives and attempts to pull the agent out of scope.
• Step 5, hand over and decide: give the clinic team the documentation, owners and monitoring routine, and decide from the records whether to expand, adjust or stop.

A risk management framework such as the NIST AI Risk Management Framework can help structure periodic reviews, even in small operations. The point is simply to keep the question alive: what can go wrong, who notices, and what do we do.

What the ANPD and data subjects expect from the clinic

The ANPD is the authority that guides and enforces compliance with the LGPD, and its guides and statements are the primary source for questions of interpretation. On the patient side, what matters is being able to know which data is processed, correct it, request access and, in certain cases, ask for review of decisions made by automated means. If the agent decides nothing about the patient's treatment, the risk in that category falls, which is one more reason to keep the scope administrative.

It is also worth having a channel ready for these requests and an internal incident procedure: who notifies whom, how quickly the team meets and how the vendor takes part. Building this after the first problem is expensive and stressful.

Frequently asked questions

Can a clinic use AI with patient data without consent? It depends on the purpose. Activities directly tied to care, carried out by a health service, may rely on protection of health, while parallel uses such as marketing usually need another basis, generally specific consent. The decision for each function should be validated by legal counsel or the DPO.

Can I paste patient information into an AI chat to save time? Not on personal accounts or without a contract. Even with business tools, the clinic needs to know where the data is processed, how long it is kept and whether it is used for training. When in doubt, remove identifiers or do not send it.

Can the AI agent answer questions about exams and symptoms? We recommend it does not. That kind of answer is clinical, carries professional responsibility and the risk of error is high. The agent should recognize the topic, avoid giving an opinion and route the patient to a professional or a team member.

Do we need an impact assessment before starting? When processing involves sensitive data at scale or significant risks to the data subject, an impact assessment is good practice and may be required by the ANPD. Even a lean version helps record the purpose, data, risks and controls of the pilot, and usually saves arguments later.

Sources

• ANPD: Autoridade Nacional de Proteção de Dados
• NIST AI Risk Management Framework
• OWASP Top 10 for LLM Applications