Security and HIPAA
Patient data under a signed BAA
SmileData handles patient data as a Business Associate under a BAA every practice signs. Data is encrypted in transit and at rest, access is set by role, and AI providers may not train their general models on it.
What we commit to in writing
01HIPAA
A signed Business Associate Agreement
Patient information is handled as a Business Associate of your practice, under a BAA every practice signs when its use involves patient data. We use and disclose it only as that agreement and HIPAA permit.
Business Associate Agreement02Encryption
In transit and at rest
Administrative, technical and physical safeguards, including encryption in transit and at rest.
Privacy Policy, section 903Access
Scoped by role, logged
Access controls scoped by role, logging, and least-privilege access for our own personnel. Your practice sets the roles and permissions of its users.
Privacy Policy, sections 2 and 904Where it lives
In the United States
The Services are operated in the United States and information is processed there. Cloud hosting and AI model providers that touch patient data agree in writing to terms at least as protective as the BAA. The list is available on written request.
BAA sections 3 and 4, Privacy Policy section 1405AI
Not used to train general models
Prompts and the data needed to answer them are processed by AI providers acting as our subprocessors under contract. We do not permit those providers to use Customer Data or prompts to train their general models.
Privacy Policy, section 606No ad trackers
Nothing for advertisers inside the app
We do not place advertising or marketing pixels, tags or cookies inside the Smile Data platform, and we do not send platform data to advertising companies.
Privacy Policy, section 1107If something goes wrong
Reported within ten business days
A breach of unsecured patient information is reported to your practice without unreasonable delay, and no later than ten business days after discovery.
BAA section 508When you leave
Returned or destroyed
Your practice software stays your system of record; we hold an analytics copy. You can export while your subscription is active, and on termination patient information is returned or destroyed within sixty days.
BAA sections 6 and 9, Privacy Policy section 10
Ad tags on the website, none in the app
smiledata.com and the booking page may use analytics and advertising tags, as the cookie policy explains. app.smiledata.com, where practice data lives, uses none.
Cookie policySecurity questions
Is SmileData HIPAA compliant?
Do you sign a Business Associate Agreement?
Is our data used to train AI?
Where is the data processed?
What happens to our data if we leave?
HIPAA questions
Email support@smiledata.com and mark the message HIPAA, or call 404-777-4020. We will send the subcontractor list on written request.
Put your data to work.
Sign up todayNot ready to sign up? Book a demo with our team.
Connects to your practice software. $0 onboarding. No contracts. HIPAA compliant.