In the Philippines, a clinic generally cannot post an identifiable patient photo on Facebook, Instagram, TikTok, its website, Google Business Profile, or ads without a valid legal basis — and for marketing posts, that usually means clear, specific, informed consent from the patient. This is especially true for “before-and-after” photos, dermatology or aesthetic procedure photos, dental cases, surgical results, lab images, ultrasound images, or any photo that can reveal a person’s health condition, treatment, body, identity, or clinic visit.

The Short Answer: Patient Photos Are Usually Protected Personal Data

A photo of a patient is not “just a picture” under Philippine law. If the patient can be identified from the face, name, body marks, tattoo, room details, caption, appointment context, or other clues, the photo is personal information under Republic Act No. 10173, or the Data Privacy Act of 2012. The law defines personal information broadly to include information from which a person’s identity is apparent, reasonably ascertainable, or identifiable when combined with other information. (National Privacy Commission)

In the health setting, the risk is even higher. The National Privacy Commission has recognized that the image of an identifiable person in a photograph or video is personal information, and that clinical photographs may involve sensitive personal information when they contain health information about patients.

That means a clinic should not assume it can post your photo simply because:

you were treated at the clinic;
the photo was taken inside the clinic;
you allowed the doctor to take a treatment photo;
your face was partially covered;
the clinic believes the result is “educational”;
the photo was already in your medical record;
the post does not mention your full name.

The legal question is not only “Did you allow the clinic to take the photo?” The more important question is: Did you specifically allow the clinic to publicly use or disclose that photo for that purpose?

Taking a Treatment Photo Is Different From Posting It Online

Many clinics legitimately take photos for medical documentation. Dermatologists, plastic surgeons, dentists, ophthalmologists, OB-GYNs, aesthetic clinics, and rehabilitation clinics often use photos to monitor progress, document baseline condition, explain treatment, compare outcomes, or keep medical records.

That is different from posting the photo online.

Situation	Usually allowed without marketing consent?	Why
Taking a wound photo for medical records	Often yes, if necessary for treatment and properly protected	Processing may be necessary for medical treatment by a medical practitioner or treatment institution.
Showing your photo privately to another doctor involved in your care	Often yes, if needed for treatment and confidentially handled	Still within healthcare purpose.
Using your photo in internal training with strict access controls and anonymization	Depends on safeguards and purpose	The clinic must still apply data privacy principles.
Posting your before-and-after photo on Facebook	Usually no, unless you gave valid consent	Public marketing is a separate purpose.
Posting your face with “thank you patient” caption	Usually no, unless you gave valid consent	Identity and clinic visit are disclosed.
Posting a body-part photo without face	Still risky	Tattoos, scars, rare condition, date, caption, or context may identify you.
Posting a photo of the clinic lobby with no people captured	Data Privacy Act may not apply to the image itself	NPC has stated that photos or videos of hospital premises are not covered by the DPA if no individual or data subject is captured.

Legal Basis: Why Consent Usually Matters

Data Privacy Act of 2012

The Data Privacy Act requires personal information processing to follow the principles of transparency, legitimate purpose, and proportionality. In simple terms:

Transparency means the clinic must tell you what it will do with your data.
Legitimate purpose means the clinic must have a lawful and specific reason.
Proportionality means the clinic should use only what is necessary and not more than needed.

The DPA allows processing of ordinary personal information only when at least one lawful criterion exists, such as consent, contract, legal obligation, vital interests, public authority, or legitimate interests that do not override the data subject’s fundamental rights. (National Privacy Commission)

But patient photos often go beyond ordinary personal information. The DPA treats information about a person’s health, genetic life, sexual life, previous or current health records, and similar data as sensitive personal information. (National Privacy Commission)

For sensitive personal information, the law is stricter: processing is generally prohibited unless a specific exception applies, such as the patient’s consent specific to the purpose before processing, processing required by law, protection of life and health when the person cannot consent, medical treatment with adequate protection, or legal claims. (National Privacy Commission)

For a clinic’s social media marketing, the most realistic lawful basis is usually specific patient consent.

Consent Must Be Specific, Informed, and Documented

Under the Data Privacy Act and its Implementing Rules, consent must be freely given, specific, informed, and evidenced by written, electronic, or recorded means. (National Privacy Commission)

For patient photo posting, good consent should clearly state:

what photo or video will be used;
whether the patient’s face, name, voice, body part, diagnosis, treatment, or result will appear;
where it will be posted, such as Facebook, Instagram, TikTok, website, ads, brochures, or clinic displays;
the purpose, such as marketing, patient education, portfolio, training, or research;
whether the clinic may crop, edit, watermark, caption, boost, or reuse the image;
how long the photo may stay online;
whether third-party platforms, marketing agencies, or photographers will access the file;
how the patient may withdraw consent;
who to contact for privacy concerns.

A vague line in a treatment form such as “I authorize the clinic to use my photos” may be challenged if it does not explain the actual posting, platform, purpose, audience, or extent of use. A consent for treatment photos is not automatically consent for public advertising.

Civil Code Right to Privacy, Dignity, and Peace of Mind

Even outside the Data Privacy Act, the Civil Code protects privacy and dignity. Article 26 says every person must respect the dignity, personality, privacy, and peace of mind of others, and that certain acts may produce a cause of action for damages, prevention, and other relief even if they are not criminal offenses. (Lawphil)

Articles 19, 20, and 21 of the Civil Code also support liability when a person acts contrary to law, causes damage by willful or negligent conduct, or causes injury in a manner contrary to morals, good customs, or public policy. (Lawphil)

If the unauthorized post caused humiliation, anxiety, embarrassment, reputational harm, family conflict, workplace problems, or emotional distress, moral damages may be relevant. Article 2217 defines moral damages to include mental anguish, serious anxiety, besmirched reputation, wounded feelings, moral shock, and social humiliation, while Article 2219 allows moral damages in cases involving acts under Articles 21 and 26. (Lawphil)

Medical Ethics and Professional Discipline

For physicians, privacy is not only a data privacy issue. The 2019 Code of Ethics of the Medical Profession adopted by the Philippine Medical Association and Professional Regulation Commission emphasizes patient dignity, informed consent, privacy, and confidentiality. It states that physicians should preserve patients’ dignity and anonymity, obtain voluntary informed consent before procedures or treatment, and keep private and confidential what is learned about the patient, except when disclosure is required by law, ordinance, or administrative order for justice, safety, or public health.

The Medical Act of 1959, Republic Act No. 2382, also allows discipline of physicians for grounds such as false or unethical advertising and violation of the Code of Ethics approved by the Philippine Medical Association. (Supreme Court E-Library)

This means an improper clinic post may create overlapping issues:

a data privacy complaint against the clinic;
a professional ethics complaint against the physician;
a civil claim for damages;
in serious cases, a criminal complaint.

When Posting Patient Photos May Be Lawful

A clinic may post patient photos only when the clinic can show a proper legal basis and safeguards. In ordinary marketing situations, that means the patient gave valid consent.

A Clinic Is on Safer Ground When All of These Are Present

The consent is separate from the treatment consent. It should not be hidden inside a long admission or procedure form.
The consent is specific to posting or publication. “For medical documentation” is not the same as “for Facebook ads.”
The patient understands the scope. The clinic should explain where the image will appear and what information will be visible.
The patient is not pressured. Consent should not feel like a condition for receiving medical care, discount approval, release of records, or follow-up treatment.
The photo is limited to what is necessary. If the purpose can be achieved by cropping, blurring, anonymizing, or using a stock illustration, the clinic should consider the less intrusive option.
The clinic can prove consent. Screenshots of chat approval, signed forms, recorded consent, or electronic consent logs may matter if a dispute arises.
The clinic respects withdrawal. Withdrawal may not erase copies already downloaded or shared by strangers, but the clinic should stop further use and remove the post from its own channels when there is no other lawful basis to continue.

“But My Face Was Covered” — Is It Still Illegal?

Possibly.

A patient photo can still be personal information even when the face is hidden. Under the DPA, identity may be apparent from the photo alone or when combined with other information. (National Privacy Commission)

Examples:

a tattoo, mole, scar, birthmark, or rare condition is visible;
the caption says “our patient from BGC who had rhinoplasty last Friday”;
the post tags the patient or replies to comments identifying them;
the clinic posted the image around the same time the patient publicly mentioned the treatment;
the image shows a name on a wristband, chart, prescription, lab request, ultrasound, dental model, or screen;
the body part or medical condition is unique enough to identify the person within a family, workplace, or small community.

Blurring the eyes is often not enough. Cropping the face is often not enough. A truly anonymized photo should make it very unlikely that the person can be identified directly or indirectly.

Special Rule for Intimate or Private-Area Images

If the clinic photo involves nudity, undergarments, genital area, buttocks, female breast, sexual activity, or similar private areas, Republic Act No. 9995, the Anti-Photo and Video Voyeurism Act of 2009, may become relevant.

RA 9995 prohibits taking photos or videos of a person’s sexual act or private area without consent under circumstances where the person has a reasonable expectation of privacy. It also prohibits copying, distributing, publishing, broadcasting, showing, or exhibiting such photos or videos, and the law applies even when the person originally consented to the recording if there was no written consent for the later publication or distribution. Penalties may include imprisonment of three to seven years and fines from ₱100,000 to ₱500,000. (Lawphil)

This matters in real clinic situations such as:

breast surgery photos;
genital dermatology photos;
OB-GYN or fertility clinic images;
body contouring photos;
nude pre-operative images;
laser hair removal photos of intimate areas;
post-operative photos showing private areas.

For these cases, a clinic should be extremely careful. A consent form for treatment or clinical documentation is not automatically written consent to publish or display intimate images.

What You Can Do If a Clinic Posted Your Photo Without Consent

Step 1: Preserve Evidence Before the Post Disappears

Do this carefully and quickly.

Save:

screenshots of the post, including date and time;
the clinic name, page URL, username, and profile details;
comments identifying you or discussing your condition;
captions, hashtags, boosted ad labels, or comments by clinic staff;
screenshots showing shares, reactions, or views if visible;
copies of messages where you objected or asked for removal;
any consent form you signed;
any treatment contract, receipt, prescription, or appointment confirmation;
photos showing why you are identifiable, such as tattoos or scars.

For Facebook or Instagram, capture the full page context, not just the photo. For TikTok, save the video link, username, caption, comments, and screen recording. If the post is an ad, save the ad library entry if available.

Avoid reposting the clinic’s photo publicly while complaining about it. That may unintentionally spread the same image further.

Step 2: Check What You Actually Signed

Look for these documents:

patient information sheet;
treatment consent;
photography consent;
media release;
before-and-after consent;
data privacy consent;
privacy notice;
procedure package contract;
messages with the doctor, admin, aesthetician, or clinic page.

Read the wording closely.

Ask:

Did it mention public posting?
Did it mention social media?
Did it mention ads or boosted posts?
Did it allow showing your face?
Did it allow showing your diagnosis or treatment?
Was it separate from the medical procedure consent?
Were you told you could refuse?
Was there a withdrawal process?
Was the consent signed by the correct person?

If the document only allowed photos “for medical records,” the clinic may have exceeded the purpose when it posted them online.

Step 3: Send a Written Privacy Request to the Clinic

Before filing with the National Privacy Commission, current NPC rules generally require the complainant to first inform the personal information controller, personal information processor, or concerned entity in writing and give it a chance to act. If there is no timely or appropriate action, or no response within 15 calendar days, the complaint may proceed; the NPC may waive this requirement for good cause or serious violations.

Send the request by email, clinic messenger, registered mail, or courier. Keep proof of sending and receipt.

Your written request should say:

Identify the post and attach screenshots.
State that you did not consent, or that any consent did not cover public posting.
Ask for immediate removal or blocking of the image.
Ask the clinic to stop further use, boosting, sharing, printing, or reposting.
Ask for the legal basis relied upon.
Ask who accessed, handled, edited, uploaded, or received the photo.
Ask whether a marketing agency, photographer, influencer, or platform was given a copy.
Ask for confirmation that copies in marketing folders, drafts, and scheduled posts were deleted or blocked.
Ask for the name and contact details of the clinic’s Data Protection Officer or privacy contact.
Set a reasonable response period and save all replies.

Step 4: File a Complaint With the National Privacy Commission

The NPC handles complaints involving misuse, malicious disclosure, improper disposal, and violations of data privacy rights. Its own guidance says a formal complaint must be in the required format, printed and filled out, notarized, and submitted in person, by courier, or by scanned email to the NPC. (National Privacy Commission)

The NPC’s complaint mechanics also state that a complaint should be filed with copies of evidence and witness affidavits, and that electronic documents should be digitally signed and in PDF format when practicable. (National Privacy Commission)

For a patient-photo complaint, prepare:

Requirement	Practical notes
Notarized complaint-affidavit or verified complaint	Use the current NPC complaint form/template from the official NPC site.
Your government ID or passport	Foreigners should use passport/ACR I-Card if applicable.
Screenshots and links	Include full post context, not only the cropped image.
Proof you are the person in the photo	Explain identifying features if face is hidden.
Consent forms or lack of consent	Attach what you signed, or state that no consent was given.
Written request to clinic	Attach email, chat, courier receipt, or registered mail proof.
Clinic response or non-response	Important for exhaustion of remedies.
Witness affidavits	Useful if others saw the post and identified you.
Certification against forum shopping	Current NPC rules require this to accompany the complaint.
Filing fees or exemption documents	NPC Circular No. 2023-01 lists a ₱500 complaint filing fee, additional fees for damages claims, possible bonds for certain urgent relief, and exemptions for qualified indigent litigants.

Under the amended 2021 NPC Rules of Procedure, the NPC raffles or assigns a complaint to an investigating officer within five calendar days from receipt, and if the complaint is given due course, the respondent may be required to file a verified comment within 15 calendar days from receipt of the order.

Actual timelines vary. Simple removal disputes may be resolved faster if the clinic cooperates. Contested cases involving damages, multiple respondents, agencies, unclear consent forms, or technical evidence may take months or longer.

Step 5: Consider a Professional Complaint if a Doctor Was Involved

If the post was approved, uploaded, or used by a physician or physician-owned clinic, there may also be a professional ethics issue. The Professional Regulation Commission and the relevant professional regulatory board may consider whether the conduct violated professional standards, especially patient privacy, dignity, informed consent, confidentiality, and ethical advertising.

This route is different from an NPC complaint. The NPC focuses on data privacy rights and personal data processing. PRC proceedings focus on professional conduct and possible discipline of the licensed professional.

Step 6: Consider Civil or Criminal Remedies for Serious Harm

A civil action may be considered when the post caused measurable damage, reputational harm, emotional distress, business loss, family conflict, workplace consequences, or humiliation.

Possible civil bases include:

Civil Code Article 26 for privacy, dignity, personality, and peace of mind;
Articles 19, 20, and 21 for abuse of rights, unlawful conduct, negligence, or acts contrary to morals and public policy;
Article 2219 in relation to moral damages.

For intimate or private-area images, RA 9995 may support a criminal complaint. For captions that publicly and maliciously impute a disease, sexual condition, vice, defect, immoral act, or other matter that dishonors or discredits a person, defamation or cyber-related issues may also arise depending on the exact wording and platform.

Common Real-Life Scenarios

“The clinic posted my before-and-after acne treatment photo but covered my eyes.”

If your skin condition, face shape, hairstyle, clinic visit, or caption makes you identifiable, the photo may still be personal information. If the post reveals your treatment or condition, it may also involve sensitive personal information. The clinic should be able to show a lawful basis, usually specific consent for public posting.

“I signed a form, but I didn’t know it was for Facebook ads.”

Consent must be informed and specific. A clinic is in a weaker position if the form did not clearly mention public posting, platforms, advertising, or the type of image to be shown. The more sensitive the photo, the more important clear consent becomes.

“The clinic gave me a discount in exchange for posting my results.”

A discount-for-content arrangement is not automatically illegal, but the consent should still be freely given and specific. The clinic should not pressure the patient, hide the terms, or continue using the image beyond what was agreed.

“The clinic posted my child’s dental or dermatology photo.”

For minors, consent should come from a parent or legal guardian, and the clinic should take extra care. Even with parental consent, the clinic should consider the child’s dignity, future privacy, and whether the post is necessary. A child’s health or treatment photo can follow them online for years.

“The doctor posted my case in a private doctors’ group.”

A private professional group is not the same as a public Facebook page, but privacy rules still apply. The question is whether the sharing was necessary, proportionate, properly anonymized, and protected. If the patient can be identified or the case includes sensitive health information, the clinic or doctor should have a clear lawful basis.

“The clinic says it owns the photo because its staff took it.”

Ownership of the file or copyright in the photograph does not erase the patient’s privacy and data protection rights. A clinic may own the camera, phone, file, or image composition, but it still processes personal data if the photo identifies a patient.

“The clinic deleted the post, but people already shared it.”

Deletion helps but may not fully resolve the issue. The clinic may still need to explain who accessed the image, whether it was boosted or shared with third parties, what steps it took to stop further use, and what safeguards it will apply. Save evidence before deletion, because proof becomes harder once the post is gone.

“I am a foreigner treated in the Philippines.”

The Data Privacy Act protects individuals, not only Filipino citizens. If a Philippine clinic processed your identifiable patient photo, the clinic may still be covered. If you are abroad, practical issues include notarization, apostille or consular authentication, ID copies, time zones for hearings, and appointing a Philippine representative through a Special Power of Attorney when needed. The NPC’s amended rules expressly address notarization by a Philippine Embassy or Consulate, or apostille, for non-resident citizens without an authorized Philippine representative.

What a Proper Clinic Photo Consent Form Should Look Like

A strong patient-photo consent form should not be a vague one-liner. It should be separate, readable, and understandable.

It should include:

patient name and contact details;
clinic name and privacy contact;
description of the photo or video;
body part or treatment involved;
whether the face or identifying features will be shown;
specific platforms where it may appear;
whether paid ads, boosted posts, brochures, website galleries, or reels are included;
whether captions may mention treatment, condition, age, gender, or location;
whether the image may be edited, cropped, blurred, watermarked, or combined with other images;
whether third-party photographers, social media managers, marketing agencies, or platform providers may handle the file;
duration of use;
withdrawal process;
risks of online posting, including screenshots and sharing by others;
signature or electronic confirmation;
date and proof that the patient received a copy.

For sensitive procedures, the safer practice is to show the patient the exact image or final version before posting.

What Clinics Should Do to Avoid Violations

Clinics that use patient images should have a real workflow, not an informal “ask the admin to post it” system.

Minimum good practices include:

Use a separate patient-photo consent form.
Keep treatment consent separate from marketing consent.
Avoid making marketing consent a condition for treatment.
Use de-identified images when possible.
Blur or crop more than just the eyes.
Remove names, dates, charts, wristbands, lab results, screens, and metadata.
Limit staff access to patient photos.
Keep a log of who took, approved, edited, and posted the image.
Have the doctor or privacy officer review sensitive posts.
Train social media staff on the Data Privacy Act.
Have a takedown process for withdrawal or complaints.
Use written contracts with photographers and marketing agencies.
Do not store patient photos in personal phones or personal cloud accounts without controls.
Do not reuse old patient photos for new campaigns without checking the scope of consent.

Frequently Asked Questions

Can a clinic post my before-and-after photo without my permission?

Usually, no. If you are identifiable or the photo reveals your health, treatment, or clinic visit, the clinic needs a lawful basis. For public marketing, that usually means your specific, informed consent.

Is it still a violation if my face is not shown?

It can be. A body-part photo may still identify you through tattoos, scars, rare conditions, timing, captions, tags, or other context. If people who know you can recognize you, privacy and data protection issues may arise.

Can I ask the clinic to delete my photo?

Yes. Under the Data Privacy Act, a data subject may request blocking, removal, or destruction of personal information when it was unlawfully obtained, used for unauthorized purposes, no longer necessary, or otherwise covered by grounds under the law. (National Privacy Commission)

What if I signed a consent form but later changed my mind?

You may withdraw consent for future processing. The clinic should stop further use unless it has another lawful basis. However, withdrawal may not fully undo screenshots, shares, or downloads already made by other people outside the clinic’s control.

Can a clinic use my photo for “educational purposes” without consent?

It depends on the details. If the photo is truly anonymized and no patient can be identified, the risk is lower. If the patient is identifiable or health information is revealed, the clinic still needs a lawful basis and must follow transparency, legitimate purpose, and proportionality.

Can I file directly with the NPC?

In most cases, you should first inform the clinic or concerned entity in writing and give it a chance to act. Current NPC rules require this exhaustion step before a complaint is given due course, unless the NPC waives the requirement for good cause or serious violations.

How much is the NPC filing fee?

NPC Circular No. 2023-01 lists a ₱500 filing fee for complaints, with additional fees for damages claims and other applications. Qualified indigent litigants may be exempt if they submit the required documents, such as a barangay certificate of indigency and supporting affidavits.

Can I sue for damages if the post embarrassed me?

Possibly. The Civil Code recognizes privacy, dignity, and peace of mind, and allows damages in proper cases. Moral damages may be relevant when there is mental anguish, social humiliation, besmirched reputation, wounded feelings, or similar injury caused by the wrongful act. (Lawphil)

Is it criminal if the clinic posted an intimate medical photo?

It may be, depending on the image and facts. RA 9995 covers certain private-area, sexual, or intimate photos and videos taken or distributed without the required consent under circumstances involving a reasonable expectation of privacy. (Lawphil)

Does the law protect foreigners treated in Philippine clinics?

Yes. The Data Privacy Act protects individuals whose personal data is processed by covered persons or organizations. A foreign patient whose identifiable photo was processed by a Philippine clinic may have data privacy rights, although filing from abroad can involve practical notarization, apostille, representation, and evidence issues.

Key Takeaways

A clinic should not publicly post identifiable patient photos without a valid legal basis.
For social media, ads, websites, and before-and-after galleries, the safest and usual legal basis is specific, informed, documented consent.
Consent to take a treatment photo is not automatically consent to post it online.
Patient photos may be sensitive personal information if they reveal health, treatment, condition, or medical history.
Hiding the face does not automatically anonymize the patient.
Intimate or private-area images may raise serious issues under RA 9995.
Patients may request removal, access, explanation, blocking, or deletion under the Data Privacy Act.
Before filing with the NPC, the patient usually needs to notify the clinic in writing and allow action within 15 calendar days, unless the NPC waives the requirement.
Possible remedies include an NPC complaint, PRC professional complaint, civil damages action, or criminal complaint in serious cases.