Superintelligence for Dermatology Clinics: Scheduling and Aftercare Limits
How to limit an AI agent in a dermatology clinic: scheduling tasks, what goes to the clinical team, and post-procedure questions under LGPD.
Want to apply this in your company?
Book a call with Juan →In a dermatology clinic, an AI agent can handle the schedule well: confirming appointments, sending administrative instructions, and logging requests for follow-up visits. What it should not do is assess lesions, recommend treatment, interpret symptoms after a procedure, or decide whether something is normal. Superintelligence, in this context, does not mean a system that replaces the physician or the clinical team. It means an agent with bounded tasks, clear escalation rules, and a record of every decision.
Key takeaways
- The agent should manage the calendar, confirmations, rescheduling, and administrative instructions, with appointment types and provider schedules registered in advance.
- Any question about symptoms, healing, reactions, or urgency after a procedure should go to the clinical team, with an immediate alert and no attempt by the agent to answer.
- Health data is sensitive under LGPD, Brazil's data protection law, so the agent should receive only the minimum data each task requires.
- The pilot should start with one real workflow, with conversation logs, an agreed success criterion, and a weekly review by the team.
- Before expanding scope, the clinic decides whether to adjust the rules, extend to new workflows, or stop using the agent.
What the agent can handle alone in scheduling
Dermatology scheduling has particularities that deserve attention. There are evaluation visits, scheduled follow-ups, procedure sessions with fixed intervals, and appointments that require preparation, such as avoiding sun exposure or stopping certain products for a set period. A well-configured agent can absorb much of this volume without depending on a person being available at all times.
The tasks that are usually safe for the agent are administrative and repetitive: checking availability according to registered rules, offering times within the correct professional's calendar, confirming attendance, sending reminders, and recording rescheduling. It is also reasonable for the agent to share the documents the clinic requests, the payment methods accepted, and the address, as long as the clinic's management has approved those texts.
The point that needs care is preparation guidance. If the clinic asks a patient to stop a medication or avoid sun for a certain period before a procedure, that instruction must come from text approved by the clinical team and be reproduced without reinterpretation. The agent should not improvise explanations of why the rule exists or whether it applies to a specific person's case. When a patient asks whether they can make an exception, the correct response is a handoff.
Automatic scheduling on WhatsApp has its own operating rules, and it is worth understanding the overall design before configuring the calendar, as we explain in automatic appointment scheduling on WhatsApp with AI.
What must go to the clinical team
The most important boundary separates administrative information from clinical judgment. A list of questions that must leave the automated flow helps the team sleep better, because it does not depend on the memory of whoever is at the front desk that day.
- Pain, burning, bleeding, swelling, discharge, fever, or any sign of infection after a procedure.
- A spot, crust, peeling, or redness the patient describes as different from what they expected.
- A suspected allergic reaction, a new medication, or a question about interaction with something prescribed.
- A request to photograph the area and send the image for assessment, when the clinic does not yet have a proper and secure process for that.
- A request for an exception to a preparation rule, a cancellation with a charge, or a change of procedure.
- Any message in which the patient shows distress, fear, or urgency that suggests risk.
In these cases, the agent should reply briefly and warmly, state that the team will be contacted, ask only for the data needed to call back, and log the reason for the handoff. If the clinic has an on-call schedule or an urgent contact channel, that channel should appear in the message clearly. An agent that tries to reassure the patient with generic remarks about healing creates a false sense of safety, which is exactly the risk to avoid.
Post-procedure: where the boundary sits
The period after a dermatology procedure generates many messages, and many of them look simple. The person asks whether they can wear makeup, exercise, use a certain product, or whether it is normal to still be red. Some of these questions have standard answers that the clinic can approve in writing, such as general aftercare found in the instructions handed to the patient. Others depend on the judgment of the person who performed the procedure.
A practical way to organize this is to separate content into three layers. The first is standardized guidance, approved by the clinical team and delivered without variation. The second is conditional guidance, where the agent may respond only if the question falls within a defined topic and the patient is within a timeframe set by the clinic. The third is clinical doubt, which always goes to the team. This separation must be written into the agent's instructions, with examples of questions for each layer.
Time matters as well. Some complications appear in the first few days, others weeks later. The clinic should define how long the agent performs automatic follow-up check-ins and from when it only records and escalates. Proactive follow-up messages require care with consent and with templates approved by the platform, and the topic is covered in the 24-hour WhatsApp API window and how the agent should behave.
There is also a design point that is often underestimated: the agent should never state that a case is resolved. It can ask whether the person wants to confirm a follow-up visit, but the clinical closure belongs to the team. This avoids replies like "looks normal, you can carry on," which the agent has no basis to give.
Health data, consent, and LGPD
LGPD treats health-related data as sensitive personal data, which requires heightened care in processing. In practice, the clinic must define which information the agent can see, which it can record, and how long those records are kept. For scheduling, a name, contact details, time slot, appointment type, and provider are enough. For post-procedure contacts, the agent should receive the minimum needed to route the case, not a full clinical history.
It is also necessary to assess where the data is processed. If the tool uses services hosted outside Brazil, the transfer must be reviewed under the law, and the subject is covered in international data transfer with AI and what LGPD requires. The patient should be told they are interacting with an automated system, and the clinic should have a channel for handling requests related to their data. For official guidance, Brazil's National Data Protection Authority (ANPD) publishes materials on the gov.br portal.
A useful operational safeguard is to restrict human operators' access to the agent's conversation history, with a record of who looked at what. This protects both the clinic and the patient, and it makes internal audits easier when something goes off track.
How to set up the pilot in four steps
The safest path is to start small, with one real and measured workflow. We follow the method we apply in agent projects: map, limit, pilot, and transfer. Applied to dermatology, it looks like this:
- Map: list the appointment types, the providers, the approved preparation rules, and the questions that arrive today on WhatsApp, separating administrative questions from clinical ones.
- Limit: write down what the agent may answer, what it must hand off, and what it must not touch, including the list of warning signs that trigger an immediate handoff. Also define which data it can access.
- Pilot: choose a single workflow, such as confirming and rescheduling evaluation visits, run it for an agreed period, log every conversation, and review samples with the team.
- Transfer: once the agreed metric is met and the errors are understood, decide whether the clinic expands, adjusts the rules, or stops. Document what was learned and who is responsible for maintaining the instructions.
Before putting the agent in front of real patients, test edge cases with fictional data in an isolated environment. The logic of simulated testing is explained in how to test AI agents with mocks and a sandbox.
On the technical security side, the risk of hidden instructions in patient messages, such as someone trying to make the agent ignore its rules, is discussed in OWASP's guidance on prompt injection prevention. For managing risks in AI systems in general, NIST publishes a reference framework. Neither replaces the clinic defining its own rules, but both help structure the conversation with vendors and the technical team.
Illustrative scenario: a question after a treatment
Illustrative scenario: a patient writes on WhatsApp two days after a session, saying the treated area looks redder than expected and asking whether she can apply a cream she has at home. The agent should not suggest the cream or say the redness is normal. It should reply that the clinical team will be notified, direct her to the contact channel the clinic designates for cases like this, ask for her full name and the procedure date to speed up the callback, and log the conversation with an urgent handoff tag. If she reports fever or severe pain, the message should direct her immediately to the urgent care option the clinic has indicated.
The next day, the team reviews the pilot records and checks whether the handoff reached them within the agreed timeframe. If a case went unanswered, the failure lies in the queue process, not in the agent's reply, and that must be fixed before any expansion.
For a clinic still deciding whether it makes sense to automate this kind of contact, it is also worth reading superintelligence for physiotherapy clinics and what to organize before the agent books, since the logic of scheduling by provider and preparation is similar.
Frequently asked questions
Can the agent answer questions about aftercare following a dermatology procedure? Yes, as long as the answer is standardized guidance approved by the clinical team and delivered without variation. Anything involving symptom assessment, the appearance of the treated area, or a decision about next steps must be handed off to the team. The rule needs to be written into the agent's instructions, with examples of each type of question.
Do I need to tell patients they are talking to an automated system? Yes, that is the safest and most respectful practice. The clinic should make clear at the start of the conversation that initial contact is handled by AI and how to reach a member of the team. This also helps maintain trust, especially on health topics.
What data should the agent access for scheduling in a clinic? Only what the task requires: name, contact details, time slot, appointment type, and provider. Full clinical information does not need to be in the automated flow. The less sensitive data the agent receives, the lower the risk in case of failure, and the easier it is to explain the treatment to LGPD requirements for management and patients.
When should the clinic stop the agent or reduce its scope? If the pilot shows replies outside the rules, handoffs that do not reach the team within the agreed timeframe, or patients who appear confused about what was said, the right decision is to pause, review the instructions, and test again before resuming. Stopping is not a failure: it is part of the method, which exists so the clinic decides based on records rather than impressions.