SMILEO Privacy Policy

SMILEO is a consultation visualization platform for licensed dental providers, operated by Salient Digital, LLC (“Salient Digital,” “we,” “us,” or “our”). This Privacy Policy describes how we collect, use, and protect information when dental providers and their patients use our application and services.

Salient Digital, LLC is a HIPAA Business Associate. Dental practices using SMILEO are Covered Entities, and we handle Protected Health Information (PHI) in accordance with HIPAA requirements and our Business Associate Agreements.

Provider Information (Dental Professionals)

When dental providers create an account and use SMILEO, we collect:

• Name, professional title, and biography
• Email address and phone number
• Practice name, address, and branding (logo, colors)
• Professional credentials
• Billing and subscription information (processed by a third-party payment processor)
• Workspace email account for calendar and email integration

Patient Information (Collected by Providers)

When providers use SMILEO for patient consultations, the following patient data is processed:

• First name, last name, email address, and phone number
• Facial photographs (selfies used for smile preview generation)
• AI-generated smile preview images
• Treatment information including procedures, costs, and financing details
• Consultation notes and communication history
• Email engagement data (opened, clicked)
• Consent records (timestamp, IP address)

Automatically Collected Information

• Device push notification tokens (for consultation reminders)
• Advertising attribution identifiers (ad-platform click IDs and UTM parameters) when patients arrive via marketing links
• Page view and interaction data for proposals and treatment plans
• IP address (for consent and security audit records)

We use collected information to:

• Generate AI-powered smile preview visualizations for dental consultations
• Create and deliver personalized treatment proposals to patients
• Send consultation reminders and follow-up communications
• Send SMS/text messages related to smile previews, consultation scheduling, additional photo requests, provider follow-up, and patient inquiries when patients provide their phone number and consent to receive text messages
• Process payments and manage provider subscriptions
• Provide analytics on consultation pipeline and conversion
• Attribute marketing effectiveness through advertising identifiers
• Maintain audit trails for HIPAA compliance
• Improve our AI models and service quality

We do not sell personal information to third parties. We share information only with the following categories of service providers, all of whom are bound by appropriate data processing or Business Associate Agreements:

• Cloud Hosting and AI Infrastructure — application hosting, data processing, and AI-powered smile preview generation
• Authentication Provider — identity management and session security
• Payment Processor — billing and subscription management
• Communication Service Providers — email, SMS/text messaging delivery, inbound message handling, message logs, calendar integration, reminders, and related communication infrastructure
• Marketing Analytics Platforms — conversion tracking, only when a provider configures their own pixel or tag

• All data is transmitted over HTTPS/TLS encryption
• Data is stored on HIPAA-compliant cloud infrastructure
• Patient facial photographs are uploaded to encrypted object storage via signed URLs
• Database hosted on encrypted PostgreSQL
• Access is controlled through authenticated sessions via our authentication provider
• Multi-tenant architecture ensures provider data isolation

SMILEO uses third-party cloud AI services to power core features. Before any data is sent to these services, providers are required to review and consent to this processing in-app.

What data is sent

• Patient facial photographs — used for AI-powered smile preview generation
• Consultation recordings and transcripts — used for consultation analysis and summary generation

Who it is sent to

HIPAA-compliant cloud AI infrastructure operating within the United States.

Why

• Smile preview generation — creating realistic dental treatment visualizations from patient photos
• Consultation analysis — generating summaries, action items, and follow-up recommendations from virtual consultation recordings

Data protection

• All data is encrypted in transit via HTTPS/TLS
• Processing is governed by HIPAA-compliant Business Associate Agreements (BAA) with our cloud AI provider
• The cloud AI services do not retain patient data beyond the duration of processing — data is not used to train AI models or shared with third parties
• Providers must consent to this data processing in-app before any patient data is sent to AI services

Dental providers may choose to connect their own advertising accounts to SMILEO so that advertising performance appears alongside their patient pipeline. Connections are made through the platform's own authorization flow (for example, Facebook Login for Business), and a provider only ever grants access to the ad accounts they select.

Meta Platform Data we receive

• Campaign, ad set, and ad performance metrics (spend, impressions, reach, clicks, and similar) for the connected ad account
• Ad creative details such as ad names and thumbnail images
• The list of ad accounts and Pages the authorizing user manages, used only so the provider can pick which account to connect
• The name and ID of the Meta user who authorized the connection, used to bind the connection to the correct provider account

How we use it

• To display advertising performance reporting in the provider's SMILEO dashboard
• To send conversion events (for example, consultation booked, treatment presented, treatment accepted) back to the provider's own ad account through the platform's Conversions API so the provider can measure return on ad spend
• To help optimize the provider's own marketing, for example by combining advertising performance with the provider's patient pipeline to identify which campaigns produce accepted treatment, and by supporting retargeting audiences built from visitors to that provider's own pages
• We do not create, edit, pause, or otherwise manage campaigns, ads, audiences, or budgets on the provider's behalf

Pages that SMILEO hosts on a provider's behalf (such as smile preview and intake pages) may load that provider's own advertising pixel or tracking tag so the provider can measure and retarget visitors to their pages. Platform Data received from a provider's connected ad account is used only for that provider's reporting and conversion measurement.

Protecting patient information

• Conversion events sent to advertising platforms never include Protected Health Information. Patient identifiers are hashed before transmission, and no clinical details, photos, or treatment specifics are shared
• Advertising data is stored per provider and is never shared with other providers or third parties
• Access tokens are stored encrypted and are deleted immediately when a provider disconnects the integration

Disconnecting and deleting Meta data

Providers can disconnect a connected ad account at any time from the Meta Ads page in their dashboard, which deletes the stored access token. Historical performance data already synced can be deleted on request by contacting us at the address below. You may also remove SMILEO's access from your Facebook or Meta Business settings, which revokes our ability to retrieve any further data.

When patients provide their phone number through SMILEO forms, QR codes, provider intake flows, or directly to a dental provider, they may consent to receive text messages related to their smile preview, consultation, scheduling, additional photo requests, and follow-up communication.

Message frequency varies based on the patient's interaction with the provider. Message and data rates may apply. Patients may opt out of SMS messages at any time by replying STOP, or request help by replying HELP.

• Patient photos used for preview generation are retained for the duration of the active consultation relationship
• Consultation records and proposals are retained as long as the provider account is active
• Email logs and communication history are retained for compliance audit purposes
• Providers may request deletion of specific patient records at any time
• Upon account termination, all associated data is deleted within 30 days

Patients whose information is processed through SMILEO may:

• Request access to their personal information through their dental provider
• Request correction of inaccurate information
• Request deletion of their records
• Opt out of marketing email communications and SMS/text messages at any time, including by replying STOP to text messages

To exercise these rights, patients should contact their dental provider directly, or reach us at privacy@smileo.com.

Providers may:

• Access and export all their data at any time
• Update or correct account information through the Settings page
• Delete patient records individually
• Request complete account and data deletion

SMILEO is designed for use by licensed dental professionals and their adult patients. We do not knowingly collect information from children under 13. If a dental provider uses SMILEO for a minor patient, the provider is responsible for obtaining appropriate parental consent as required by applicable law.

We may update this Privacy Policy from time to time. We will notify providers of material changes via email or in-app notification. The “Last Updated” date at the top of this page reflects the most recent revision.

For questions about this Privacy Policy or our data practices:

• Email: privacy@smileo.com
• Website: https://smileo.com