How should I define the scope of consent when a doctor says they will post photos taken at the hospital after surgery for marketing or social media?

I would appreciate advice from anyone with experience handling requests for deletion, commercial use, or the provision of original files. Legal advice is also welcome.