Superintelligence for Dermatology Clinics: Scheduling, Photos, Consent

Superintelligence for dermatology clinics, today, is not a machine that outperforms every doctor. It is a set of increasingly capable agents handling scheduling, follow-ups and image organization, with patient consent and with diagnosis kept out of the AI's reach. The decision that belongs to the clinic is which tasks the agent performs, which data it can see, and the point at which a case is handed to a person.

Key takeaways

• More capable agents expand what the clinic can delegate in scheduling and follow-ups, but they do not change who is responsible for the medical act.
• A photo of a lesion or of skin is health data, treated under Brazil's LGPD as sensitive personal data, and it requires a clear purpose and specific consent.
• The boundary must be written down: the agent organizes, reminds and routes; diagnosis, treatment decisions and prescriptions stay with the professional.
• Every workflow that handles images needs logging, access control and a simple way for the patient to withdraw consent.
• Start with one small workflow, agree on a metric beforehand, and expand only after reviewing what the agent actually did.

What does superintelligence mean for a dermatology clinic in practice?

The term superintelligence usually describes a system that outperforms humans at practically any intellectual task. That is a hypothesis, not something a clinic operates. What exists are language models and agents with tools, which get more competent with each generation at well-defined tasks. To understand the gap between the concept and what a company really puts into production, it is worth reading about the difference between AGI, ASI and AI agents.

In dermatology this matters for a simple reason. An agent that chats well on WhatsApp, interprets a photo sent by the patient and writes an empathetic reply can seem qualified to comment on skin. Seeming capable is not the same as carrying clinical responsibility. Fluent text does not prove the conclusion is right, and patients tend to trust a well-written answer.

So the useful question is not how intelligent the agent is. It is what the agent can do unsupervised, what it does with review, and what it never does. That division is the center of the project.

How can an agent handle scheduling without crossing into the medical act?

Scheduling is the safest place to start, because the result is verifiable: the slot was booked, rescheduled or canceled. An agent can confirm appointments, offer open slots, give administrative preparation notes (documents, insurance, arrival) and reorganize no-shows. The basics are described in automatic appointment scheduling on WhatsApp with AI.

The dermatology-specific risk is in triage. A patient writes that a spot has changed color, and the agent has to decide what to do. The safe rule is not to classify severity. The agent may ask about bleeding, pain or fast growth only to route the message to a team member with priority, never to reassure the patient or postpone the visit.

Some practical rules for scheduling:

• The agent never says something is not urgent. If a worrying symptom is reported, it routes to the team and shares the urgent-care channel defined by the clinic.
• The agent does not choose the procedure type or duration on its own. It uses an appointment-type table maintained by the clinic.
• Every change is logged with date, channel and what the patient was told.
• If the patient asks for a squeeze-in or an exception, the decision is human.

If the clinic starts the conversation, channel rules apply. The article on the 24-hour window in the WhatsApp API explains what the agent can reply and when an approved template is needed.

Patient follow-up: what the agent reminds and what it does not assess

Follow-up is where dermatology gains the most from organization. Acne treatment, mole monitoring, post-procedure care and ongoing medication all depend on the patient coming back on the right date. An agent can remind the patient of the agreed return, ask for confirmation, ask whether they need to reschedule, and alert the team when there is no reply.

What the agent does not do is assess progress. If the patient sends a photo saying the lesion improved, the agent can say thanks, attach the image to the correct record (if consent covers it) and notify the professional. It does not conclude that the treatment worked, suggest a dose change, or advise stopping or continuing medication.

A simple way to keep this under control is to separate three kinds of message:

• Administrative: hours, address, documents, insurance. The agent resolves these.
• Light clinical, already defined by the doctor: standard guidance the professional approved in writing. The agent repeats the approved text without improvising.
• New clinical: a new symptom, worsening, a reaction, a question about medication. The agent routes to a person and tells the patient the team will reply.

If the clinic sends reminders on its own initiative, check WhatsApp outbound messages: templates, opt-in and best practices, because consent to receive messages must also exist.

Patient photos: consent, storage and access

Images of skin, lesions and body areas are health data. The LGPD classifies health data as sensitive personal data, which calls for greater care with purpose, legal basis, security and access. Brazil's data protection authority, the ANPD, publishes guidance and reference material on its official website. How this applies to your case should go through legal counsel and the rules of your professional council.

In practical terms, consent needs to be specific to each use. Authorizing a photo for the medical record is not the same as authorizing its use in teaching material, advertising or model training. Treating everything as one generic acceptance is a common weakness.

A checklist for images in agent workflows:

• Written purpose: the photo serves the patient's care and follow-up, and the clinic says so in plain language.
• Separate consent for any other use, such as teaching, promotion or system improvement.
• A defined storage location: the photo should not sit on an employee's personal phone or in uncontrolled chats.
• Role-based access: reception does not need to see clinical images; the responsible professional does.
• Retention period and deletion routine, aligned with the medical record and the applicable rule.
• A clear path for the patient to request access, correction or withdrawal of consent.
• A record of who accessed what, when and why.

There is also the question of where the image goes when the agent processes it. If the model runs on a service in another country, international data transfer comes into play, covered in international data transfer under LGPD when using AI providers. The choice between a cloud service and a local model should be made before any photo circulates, not after.

What AI does not conclude: a decision guide for the clinic

The more capable the agent, the greater the temptation to widen what it decides. A short guide helps hold the line. For each task, ask in order:

• Does the task involve interpreting an image or symptom to conclude something about the patient's health? If yes, the agent does not conclude. It organizes and routes.
• Does the task change treatment, medication, the return date for a clinical reason, or the priority of care based on severity? If yes, it is the professional's decision.
• Does the task send sensitive information to a new destination or use the image for another purpose? If yes, it needs specific consent and human approval.
• Is the task administrative, reversible and logged? If yes, the agent can perform it, with a log.
• When the agent or the patient is in doubt, the path is to transfer to a person, with a summarized context.

In short, AI does not conclude: diagnosis, severity, treatment decisions, prescriptions, treatment adjustments, or the statement that a lesion is benign. It also should not promise aesthetic results or compare the patient's case with others. If an automated decision significantly affects the patient, it helps to know the right to review described in LGPD automated decision-making and the right to review (Art. 20).

There is also a technical risk. Messages and images received from outside can contain instructions that try to divert the agent's behavior, known as prompt injection. OWASP maintains a list of the main risks for applications built on language models, and it works as a checklist for anyone connecting an agent to a calendar and patient records. The design rule is to give the agent only minimal tools: read slots, book slots, attach a file to the patient profile, notify the team. No broad access to the medical record and no permission to send data to third parties.

Illustrative scenario: from a WhatsApp photo to a booked return

Illustrative scenario, not tied to any real clinic. A patient under treatment writes outside business hours, sends a photo of the treated area and asks whether everything looks normal.

The agent replies that it received the message, that it cannot assess the image, and that the clinical team will review it. It checks whether the patient has already consented to sending images through that channel. If not, it explains the purpose, asks for consent and only then attaches the photo to the profile. If she declines, the conversation continues without the image and the agent offers a return slot.

The agent asks whether there is severe pain, fever or rapid worsening, only to flag priority and show the clinic's urgent-care channel if the patient answers yes. Then it creates a notice for the responsible professional with the summary, the attached image and the return request. The next morning, a team member reviews it, the doctor decides on the treatment, and the agent simply confirms the agreed time.

Notice what the agent did: it received, asked for consent, organized, flagged and scheduled. It did not give an opinion on the skin. The whole path was logged.

How to map, limit, pilot and hand over this project

The method we apply in agent projects has four steps, and it fits clinics well.

• Map: describe how scheduling, follow-ups and photo intake work today, who does what, where images are kept and which errors keep recurring. This picture becomes the baseline for later comparison.
• Limit: define which data the agent sees, which actions it performs and which topics it always routes. Consent and image limits go in here, in writing.
• Pilot: choose a single real workflow, for example confirming and rescheduling returns, with logs and a metric agreed beforehand, such as front-desk response time or the no-show rate as measured by the clinic itself.
• Hand over: deliver the documented workflow to the team, with a named owner, and decide whether to expand, adjust or stop.

For structuring risk and governance, the NIST AI Risk Management Framework offers a useful vocabulary for mapping, measuring and managing risk. And for designing the agent simply, with predictable flows before autonomy, Anthropic's guide Building effective agents is a good technical reference. Both are supporting documentation and do not replace the legal and clinical assessment of your operation.

A note on stance: what we describe here separates official documentation (the sources mentioned), implementation experience (how to structure the pilot) and hypothesis (how agents will evolve). None of it guarantees a result, and each clinic needs to validate in its own context.

Frequently asked questions

Can AI tell whether a skin lesion is dangerous? It should not. Assessing severity is a clinical act that belongs to the professional, and a well-written answer can give the patient false reassurance. The agent can receive the image, organize it and route it to the team with priority.

Do I need consent to receive a patient photo on WhatsApp? Because a skin image is health data, the clinic must have a clear purpose and an appropriate legal basis, and additional uses such as teaching or promotion call for specific consent. The exact wording and legal basis should be defined with legal counsel and according to your professional council's rules.

Can the agent reschedule follow-ups on its own? Yes, when the change is administrative, reversible and logged, following an appointment-type table maintained by the clinic. If the change in timing has a clinical reason, such as worsening or a treatment adjustment, the decision belongs to the professional.

Where should we start without exposing sensitive data? Start with a workflow that has no images, such as appointment confirmation and follow-up reminders, with a log and a named owner. Once that workflow is stable, discuss adding photos, with consent, storage location and role-based access already decided.

Sources

• ANPD: Autoridade Nacional de Proteção de Dados
• NIST AI Risk Management Framework
• OWASP Top 10 for LLM Applications
• Anthropic: Building effective agents