LeviteAVC
POPIA and patient content: what practices need to know
Any content that shows a patient or client needs their consent before it is filmed or posted. Health-related information is treated as special personal information under the Protection of Personal Information Act, which sets a higher bar than a quick verbal yes on the day of the shoot.
This is a practical guide written from a content production point of view, not legal advice. POPIA obligations sit with your practice as the responsible party. If you are unsure how it applies to your specific setup, check with an attorney or your professional body.
Why patient content is treated differently
POPIA separates ordinary personal information from what it calls special personal information. Anything concerning a person's health falls into the second group, and processing it is restricted unless a specific ground applies. Consent is the ground most practices will rely on for marketing content.
The practical consequence is that a photo of a patient is not the same as a photo of a customer holding a coffee. Even where the person is happy to appear, the content reveals that they attended a healthcare provider and often what treatment they had. That is precisely the category the Act is most protective of.
Identifiability is what triggers this. A wide shot of a treatment room with nobody recognisable in it is a different matter from a close-up of someone's face, and a before-and-after of a specific person is the most sensitive case of all.
What does proper consent look like?
- Specific, not blanket. "We may use your image in marketing" is weak. What is being filmed, and for what, should be spelled out.
- Clear on where it goes. Instagram, Facebook, your website and a paid advert are different things. Say which apply.
- Clear on how long. Content posted today can still be online in five years. The person should know that.
- Recorded, not verbal. A signed form or a clear written message means there is a record if it is ever questioned.
- Freely given. Consent tied to getting an appointment or a discount is not freely given.
- Withdrawable, with a real process. Someone must be able to ask for it to come down, and the practice must be able to act on that.
Where practices most often get caught out
The common problems are rarely deliberate. They come from content moving faster than process.
- Someone in the background. A reception shot filmed on a busy morning can capture other patients who never consented. That is a disclosure of their attendance.
- Staff posting from personal phones. A team member sharing a moment from the practice is still processing patient information, whether it went out on the practice account or their own.
- Reusing old footage. Consent given for one campaign two years ago does not automatically cover a new advert today.
- Reviews and messages. Screenshotting a patient's thank-you message reveals that they are a patient. That needs consent too.
- Assuming anonymised is safe. A cropped image can still be identifiable to people who know the person, and small communities make that more likely, not less.
POPIA is not the only rule for before-and-after content
Consent handles the personal information side. For registered healthcare practitioners there is a second, separate requirement: the advertising rules of the relevant professional body. For HPCSA-registered practitioners that includes limits on how treatment outcomes may be presented. Chiropractors fall under the Allied Health Professions Council of South Africa, which has its own rules.
Clearing one does not clear the other. A before-and-after post can have flawless POPIA consent and still fall foul of an advertising rule, or vice versa. Both need to be considered before it goes out.
How does LeviteAVC handle this?
We confirm consent with the practice before any shoot involving patients or clients, and we scope what will be filmed in advance rather than deciding on the day. If your practice already has a consent process, we work inside it. If not, we help set one up before content starts.
Where a practice would rather avoid patient imagery entirely, that is a workable brief. Practitioner-led content, treatment explainers, facility tours filmed outside hours, and motion graphics all build a credible feed without a single identifiable patient in frame.
Industry pages with the specific compliance detail: dental, aesthetics, chiropractic and wellness clinics.
Questions practices ask
Do I need consent to post a patient's photo or video?
Yes. Any identifiable patient or client imagery is personal information under POPIA, and health-related information is treated as special personal information, which carries a higher bar for lawful processing.
What should patient consent actually cover?
It should be specific: what is being filmed, where it will be posted, and how long it may be used. It should be recorded in writing rather than agreed verbally on the day, and it must be genuinely withdrawable.
Does this apply to before-and-after photos too?
Yes. Before-and-after imagery is health-related personal information, so it needs consent under POPIA. For HPCSA-registered practitioners it also has to stay inside the HPCSA's advertising rules, which is a separate requirement on top of consent.
Can a patient withdraw consent after we have posted?
Yes. Consent under POPIA can be withdrawn, so a practice needs a route for someone to ask for content to come down, and a way to act on it promptly across every platform it was posted to.
Need help setting up a consent process?
Tell us about your practice and we will walk you through what a workable process looks like before any filming happens.
WhatsApp us