Documents and photographs
Uploading files to a patient record, and what happens to them at rest.
Files attach to the patient they belong to: referral letters, scans, lab results, clinical photographs, signed paperwork.
How they are protected
Storage access is checked against a signed membership claim on every request, the same boundary that protects the database. A file URL is not a password — someone without a current membership in your clinic cannot fetch it.
This is why revoking a member matters immediately. Access is enforced at the store rather than in the interface, so removing someone stops them fetching files as well as opening pages.
Clinical photographs
Before-and-after photographs are clinical records like any other, and in most regimes they are also the thing patients are most sensitive about. Two habits worth keeping:
- Record consent for the photograph itself, separately from consent for treatment.
- If you intend to use an image in marketing, that is a different consent again. Treatment consent is not publication consent.
A photograph taken for a record and a photograph used on a website are the same file doing two jobs with two different legal bases. Keep the paperwork for both.
Housekeeping
Name files so they mean something to whoever opens them in three years. panoramic-2026-03.jpg beats IMG_4821.jpg, and the person it helps most is you.
Common questions
- Is there a file size limit?
- Large scans are fine. If an upload fails, it is usually the connection rather than the file — retry before you resize.
- Are files deleted when I delete a patient?
- Deleting the record removes its attachments. If you need a copy for a legal retention obligation, export it first.