This policy is published by Smileline Technologies Ltd, company number 17408336, registered in England and Wales with its registered office at 1 Lyric Square, London, England, W6 0NB. It applies to residents of Washington (My Health My Data Act, RCW 19.373) and Nevada (SB 370), and sits alongside our general Privacy Policy.
Read this first. Smileline is software used by dental practices. If you are a patient, the practice you contacted decides what it collects about you and why — it is the entity responsible for your data, and we handle it only on its instructions. Contact the practice first. We will help them respond, and you can also contact us directly using the details at the end.
1. What consumer health data we handle
"Consumer health data" is defined broadly by these laws — it includes information that identifies your past, present or future physical or mental health status, and inferences drawn from other data. On behalf of a dental practice, we may handle:
- your name, telephone number, email address and postal address;
- the treatment you enquired about or received, appointment history, and notes the practice records about your care;
- dental and clinical information the practice records or syncs from its practice management system;
- messages you exchange with the practice, and — where the practice switches recording on — the recorded audio and transcript of telephone calls, which typically describe symptoms and treatment;
- information about your visit to the practice's website, including the pages you viewed, which can indicate the treatment you were interested in.
2. Where it comes from
From you directly, when you enquire, book, call, chat or fill in a form; from the practice, including from its practice management system; and from your device when you visit the practice's website, where the practice's tracking script is installed.
3. Why we handle it
Only to provide the Service to the dental practice: storing its records, delivering its messages and calls, scheduling appointments, and producing its own reports. We do not use consumer health data for our own purposes, and we do not use it to train artificial-intelligence models.
4. Who we share it with
We share consumer health data only with the service providers that run Smileline, listed as sub-processors in our Data Processing Agreement. Each is bound by contract to handle it only on our instructions. We also share it with anyone the practice itself connects and instructs us to send it to.
We do not sell consumer health data. "Sell" has a wide meaning under these laws, including sharing in exchange for anything of value. We do not do it, and we would not do it without first obtaining your separate, signed authorization, which these laws require and which we do not currently seek from anyone.
Uploading advertising conversion events derived from patient data to advertising platforms could constitute a sale. We have switched that feature off for practices in the United States for that reason.
5. Your rights
If you are a Washington or Nevada resident, you have the right to:
- Confirm whether we are collecting, sharing or selling your consumer health data, and to access it, including a list of who it has been shared with;
- Withdraw consent to our collection and sharing of your consumer health data;
- Delete your consumer health data. We will delete it from our records and our backups, and notify the service providers we shared it with to do the same. Note that the dental practice may be required by its own professional obligations to keep clinical records for a period, and that duty is separate from ours;
- Appeal a refusal. If we decline your request we will tell you why and how to appeal. If we deny your appeal, we will give you a way to contact the Washington Attorney General, or the Nevada Attorney General, to lodge a complaint.
To exercise any of these, email privacy@smileline.io with "Consumer health data" in the subject line. We will confirm receipt and respond within 45 days, and will tell you if we need a further 45 days. Exercising a right costs nothing and we will not treat you differently for it.
6. How long we keep it
For as long as the practice's account is active, plus the deletion window described in the Data Processing Agreement. Practices can set shorter retention for message content, activity records and call recordings.
7. Where it is held
Practices in the United States are served from our US region, and their data is held in the United States. Some of our service providers process data elsewhere, as described in our Privacy Policy.
8. Changes and contact
Each revision of this policy carries a version date, shown at the top of the page. We will not make a material change to how we use consumer health data already collected without your consent.
Smileline Technologies Ltd · Company 17408336 · 1 Lyric Square, London, England, W6 0NB · privacy@smileline.io