This Privacy Policy explains how SmileData LLC, a Georgia limited liability company ("Smile Data," "we," "us," or "our"), collects, uses, and shares information in connection with smiledata.com and the Smile Data analytics platform (together, the "Services").
It works alongside two other documents. Our Terms of Service govern your use of the Services. Where the Services involve Protected Health Information, our Business Associate Agreement governs that information and controls over this Policy for that subject matter.
1. WHO THIS POLICY COVERS
This Policy covers information about visitors to our website, people who contact us or join a waitlist, and the individuals at a dental practice or organization that subscribes to the Services.
It does not change the rights of patients of our customers. Patient information reaches us only because a practice connects its practice management database, and that information is handled under the Business Associate Agreement with that practice, not under this Policy.
2. INFORMATION WE COLLECT
Information you give us. Name, work email, practice name, mobile number, and anything else you type into a form, an email, or a demo request.
Account information. The credentials and profile details of the users a subscribing practice creates, plus role and permission settings.
Practice data. When a practice connects its Open Dental database, the Services read production, collections, scheduling, claims, hygiene, provider, and patient records from that database in order to compute the practice's own analytics. Some of this is Protected Health Information. See section 4.
Prompts and outputs. The plain-English requests you type into the AI builder, the queries the Services generate in response, and the cards, pages, dashboards, and audio episodes produced from them.
Usage information. Pages viewed, features used, approximate location derived from IP address, device and browser type, and log data such as timestamps and error reports.
Cookies, pixels, and similar technologies. On our marketing website and demo booking page we use cookies, pixels, and tags to measure visits and the performance of our advertising. Inside the Smile Data platform we use only the cookies needed to run it. See section 11.
3. HOW WE USE INFORMATION
- To provide, operate, secure, and improve the Services.
- To compute a practice's analytics, build the cards and dashboards it asks for, and generate the audio episodes it schedules.
- To authenticate users and protect accounts.
- To respond to support requests and communicate about the Services, including service notices, onboarding, and billing.
- To send marketing communications where you have asked for them, subject to section 5.
- To detect, investigate, and prevent fraud, abuse, and security incidents.
- To comply with legal obligations and to establish or defend legal claims.
We do not sell personal information for money. On our marketing website and demo booking page, advertising partners such as Google and Meta collect information through cookies and pixels, as described in section 11. Some privacy laws may treat this as "sharing" for advertising. You can opt out as described in section 11. We never use Protected Health Information or data from inside the Smile Data platform for advertising.
4. PROTECTED HEALTH INFORMATION
Practice data that identifies a patient is Protected Health Information under HIPAA. We handle it as a Business Associate of the practice, under a signed Business Associate Agreement. We use and disclose it only as that agreement and HIPAA permit, principally to provide the Services to the practice that gave it to us.
If a conflict exists between this Policy and the Business Associate Agreement with respect to Protected Health Information, the Business Associate Agreement controls.
5. TEXT MESSAGES
Smile Data offers optional text programs. We send the types of messages a recipient specifically agrees to receive. A phone number entered in a general contact or demo form alone is not permission to send marketing texts.
Smile Data Operational Alerts. Account owners, authorized team members and clients may request account, website enquiry, catalog activity and system status notifications for the business systems they manage. This program does not send marketing or sales promotions. Subscribe by texting JOIN to (770) 404-9997 from your own mobile phone after reviewing the disclosures at https://smiledata.com/sms. We retain your mobile number, the subscription message and its timestamp as consent evidence. Your number must be linked to an authorized account before operational alerts begin.
Your choice. Message frequency varies. Message and data rates may apply. Consent to receive texts is not a condition of purchasing goods or services. Reply STOP to unsubscribe or HELP for help, or contact support@smiledata.com. After STOP, the program sends a single opt-out confirmation and stops further messages until you choose to opt in again. To restart, text START and then JOIN. Separate programs, such as a verification code that you request, require their own appropriate consent.
Mobile information and consent. We do not share, sell or provide your mobile information, mobile phone number, text messaging originator opt-in data or messaging consent to third parties or affiliates for marketing or promotional purposes. All other sharing categories in this Policy exclude text messaging opt-in and consent data. Service providers that deliver and support our messaging process this information only on our behalf to provide the program, and may not use it for their own marketing.
Information used for messaging. We use your number and consent record to manage your subscription, deliver the alerts you requested, respond to help requests, honor opt-outs and troubleshoot delivery. Our messaging providers process message content, timestamps and delivery status for these purposes. We retain consent and opt-out records as needed to honor your choices and meet applicable obligations. Do not send patient information or other sensitive information by SMS.
6. AI FEATURES
The Services include features that use large language models to interpret a request, write a query against a practice's own data, and assemble the result.
- Prompts and the data needed to answer them are processed by third-party AI providers acting as our subprocessors under contract.
- We do not permit those providers to use Customer Data or prompts to train their general models.
- AI outputs can be wrong. The Terms of Service explain the limits of what an output represents, and outputs are not professional, clinical, financial, legal, or tax advice.
7. DE-IDENTIFIED AND AGGREGATED DATA
We may create de-identified and aggregated information from use of the Services, in a form that does not identify any individual, practice, or patient, and de-identified in accordance with HIPAA where the source was Protected Health Information. We use it to operate, benchmark, and improve the Services. This information is not personal information and is not subject to the rest of this Policy.
8. HOW WE SHARE INFORMATION
We share information only in these situations:
- Subprocessors. Vendors that host our infrastructure, deliver email and text messages, process payments, provide AI model access, and provide customer support tooling. Each is bound by contract to protect the information and to use it only to provide services to us. Subprocessors that handle Protected Health Information are bound by a Business Associate Agreement.
- At your direction. When you ask us to connect the Services to something, or share a dashboard, or send an export.
- Legal. When required by law, subpoena, or other legal process, or where we believe disclosure is necessary to protect rights, safety, or property. Where we may lawfully do so, we will tell the affected customer first.
- Analytics and advertising partners. On our marketing website and demo booking page only, as described in section 11.
- Business transfer. In connection with a merger, acquisition, financing, or sale of assets, subject to this Policy continuing to apply.
9. SECURITY
We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit and at rest, access controls scoped by role, logging, and least-privilege access for our personnel. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
If we become aware of a breach affecting Protected Health Information, we report it under the timelines in the Business Associate Agreement. For other personal information, we notify affected individuals and regulators as applicable law requires.
10. RETENTION
We keep information for as long as an account is active and afterwards for as long as we need it to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. A practice may export its data at any time while its subscription is active. On termination, we handle Customer Data and Protected Health Information as the Terms of Service and the Business Associate Agreement require.
11. COOKIES, ANALYTICS, AND ADVERTISING
Two different places, two different rules. Our marketing website (smiledata.com) and our demo booking page (book.smiledata.com) are public pages for people learning about Smile Data. The Smile Data platform (app.smiledata.com) is where practice data, including Protected Health Information, is shown. We treat them differently.
Inside the Smile Data platform. We do not place advertising or marketing pixels, tags, or cookies inside the platform, and we do not send platform data to advertising companies. We use cookies needed to run it, such as keeping you signed in, and service providers that monitor errors and performance under contract.
On our marketing website and booking page. We use, or may use, these tools:
- Google Analytics and Google Tag Manager, to understand how visitors find and use our pages.
- Google Ads, to measure whether our ads lead to visits and booked demos, and to show our ads to people who visited our site.
- Meta Pixel and Meta Conversions API (Facebook and Instagram), for the same purposes on Meta's platforms.
- Other advertising platforms we run ads on, such as LinkedIn, TikTok, or YouTube, for the same purposes.
These tools collect information such as the pages you view, the links and buttons you click, the site that sent you, your device and browser type, your IP address, and identifiers stored in cookies. The companies that provide them may use this information under their own privacy policies.
When you book a demo. We may send a hashed (scrambled) copy of the email address you gave us to Google and Meta so they can tell us whether an ad led to a booked demo. We do not send your mobile phone number, anything you type into the notes of the booking form, or any practice or patient information.
Your choices.
- Use the cookie settings on our website, where available, to accept or decline non-essential cookies. Visitors from the European Union, United Kingdom, and Switzerland are asked before non-essential cookies are used.
- Turn on Global Privacy Control in your browser. We treat it as a request to opt out of advertising cookies on our website.
- Opt out of interest-based ads at https://optout.aboutads.info, https://www.youronlinechoices.eu, https://adssettings.google.com, and in your Facebook or Instagram ad preferences.
- Block or delete cookies in your browser settings. Turning off necessary cookies will break parts of the Services.
- Email support@smiledata.com and ask us to opt you out.
Do Not Track. Browsers' "Do Not Track" setting has no common standard, so we do not respond to it. We do honor Global Privacy Control as described above.
12. YOUR CHOICES AND RIGHTS
- Email. Unsubscribe from marketing email using the link in any marketing message.
- Text. Reply STOP to opt out.
- Cookies and advertising. See section 11.
- Access, correction, deletion, and portability. Depending on where you live, you may have the right to request a copy of your personal information, correct it, delete it, or receive it in a portable format, and to appeal a decision we make about such a request.
- How to ask. Email support@smiledata.com. We will verify your identity before acting. We will not discriminate against you for exercising a right.
If the information you are asking about is a patient record inside a practice's database, ask that practice. They are the covered entity and they control it, and we will refer your request to them.
13. CHILDREN
The Services are business software and are not directed to children. We do not knowingly collect personal information directly from children through the Services. Patient records may relate to minors and are handled as Protected Health Information under the Business Associate Agreement.
14. INTERNATIONAL USERS
The Services are operated in the United States and information is processed there. If you access the Services from outside the United States, you understand that your information will be transferred to and processed in the United States.
15. CHANGES TO THIS POLICY
We may update this Policy. If we make a material change, we will update the date at the top and give notice through the Services or by email before the change takes effect. Continued use after the effective date means you accept the updated Policy.
16. GOVERNING LAW
This Policy is governed by the laws of the State of Georgia, without regard to conflict of law principles. Disputes are resolved as set out in the Terms of Service.
17. CONTACT
SmileData LLC
Email: support@smiledata.com
Phone: 404-777-4020
For questions specifically about Protected Health Information, contact us at the same address and mark the message "HIPAA."