Privacy Policy

Who this covers

There are two kinds of people we hold information about. Practices are the dental offices that subscribe to SmileDesk and the staff who sign in. Patients are the people who call, text, or chat with a practice through SmileDesk. Patients are not our customers; we process their information on the practice's behalf, under a Business Associate Agreement, and the practice decides how it is used.

What we collect from practices

• Account details: name, email, password (stored only as a one-way hash), practice name, address, hours, phone numbers, and the settings you choose.
• Billing: handled by our payment processor. We keep the customer id it gives us and your plan; we never see or store card numbers.
• Practice-software credentials you enter (for example a practice-software API key), stored per practice and used only to read your schedule and write bookings.
• Server logs of requests to the dashboard, and an audit log of actions taken in it, so we can keep it working and secure.

What we collect from patients

• Phone number, the messages and call transcripts exchanged with the assistant, the name and details a patient chooses to share, appointment requests, and insurance carrier and member id when a patient offers it for an eligibility check.
• We do not ask for social security numbers, card numbers, or a full date of birth over text, and the assistant is instructed to refuse them. If a patient sends a card number or a social security number anyway, it is removed before the message is stored or read by the assistant.
• Calls are recorded and transcribed by our telephony provider. Recordings are kept there for the retention window the practice sets (30 days by default), and the practice can switch recording off.

How we use it

• To answer the patient: triage, explain, book, remind, and follow up, exactly as the practice configured.
• To let the practice see and manage every conversation in its inbox, and to page the dentist for after-hours emergencies when the practice has turned that on.
• To check insurance eligibility in real time with the payer, when the patient provides their member id.
• To write appointments into the practice's own scheduling software when it is connected.
• To audit the assistant's quality: every closed conversation is scored against a safety and accuracy rubric so the practice can review it.
• To bill practices and to keep the service secure and running.

Who else sees it

Only the services needed to do the job, each under contract, and each receiving only what its part requires:

• Our AI model providers, which run the language models that write the assistant's replies. Conversations are sent to them for that purpose.
• Our telephone and text-messaging carriers, which carry calls and text messages.
• Our database and hosting providers, which store and serve the service.
• Our payment processor, for payments.
• An insurance clearinghouse, only when an eligibility check is run, and only the details needed for that check.
• The practice's own scheduling software, when connected.

We do not sell personal information, we do not share it with advertisers, and we do not use patient information for marketing of any kind.

How long we keep it

Conversation records are kept for as long as the practice is a customer, because they are part of the patient's record at that practice. When a practice leaves, its data stays available for export for 30 days and is deleted inside those same 30 days, except the little we have to keep by law, such as billing records. That is the deadline the Service Agreement and the Business Associate Agreement both give. Practices can ask us to delete a specific patient's messages at any time.

Security

Data is encrypted in transit and at rest. Sign-in sessions are stored as hashes. Every action the assistant takes is logged to an audit trail the practice can read. Access inside SmileDesk is limited to the people who need it to support the service.

Text messaging

For (530) 430-3676, SmileDesk's demo line, the message sender is SmileDesk LLC, a California limited liability company; its texts are signed SmileDesk Dental, SmileDesk's made-up demo office, and go only to a caller who books, moves or cancels a demo visit and says yes when asked whether they would like the details by text. Patients of a practice that uses SmileDesk hear from a practice by text in three situations: they called the office and the front desk could not answer, so the office texts them back on the number they called from; they texted the office directly; or they gave the office their mobile number and agreed to appointment confirmations and reminders. An office may also text patients already in its records when a checkup is due, a visit was missed, or recommended treatment is unscheduled; those numbers come from the office's own records, never from a purchased list, and the office is responsible for having consent on file. How often a patient hears from the office depends on their own conversation and appointments.

Patients can reply STOP at any time to end messages from a practice, and HELP for help. We honor opt-outs immediately and, beyond one confirmation that the opt-out was received, never message someone who has opted out. Message and data rates may apply. Consent to receive texts is not a condition of receiving care. Mobile phone numbers and texting consent are never shared with third parties or affiliates for marketing or promotional purposes. The notice, the form, and the words patients hear are shown on the texting consent page.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Your choices

Practices can export or delete their data by contacting us. Patients should contact their dental practice, which controls their record; we will help the practice fulfill the request. Questions about this policy go to our contact page.

Changes

If we change this policy in a way that matters, we will tell practices by email before it takes effect. The date at the top always shows the current version.