Summary
- Smile Fitter doesn't sign HIPAA Business Associate Agreements yet.
- It collects very little: a first name, one way to reach the patient, their consultation preferences and, only if they agree, small close-ups of their smile.
- The full photo never leaves the patient's phone, and nothing on the preview page goes to advertising or analytics platforms.
- Every preview is labeled as an AI illustration, and patients confirm they understand that before they start.
HIPAA and Business Associate Agreements
HIPAA applies to covered entities, which include most dental practices that bill insurance electronically, and to the business associates that handle protected health information for them. Whether the details a prospective patient sends through a website preview count as protected health information depends on your practice and how you use them. That's a call for your privacy officer or lawyer.
We don't sign Business Associate Agreements today. If your practice concludes it needs one for this kind of tool, don't use Smile Fitter with patients until we've signed one with you, and tell us, because it shapes what we build next.
What we can tell you is how the system is designed, so you have what you need to decide:
- Data minimization: the form asks for a first name and an email or mobile number. No last name, date of birth, insurance or medical history.
- The full photo stays on the device. Only a mouth close-up goes to the AI, and it isn't stored.
- Smile close-ups are only sent with a request if the patient leaves that box checked.
- Requests are stored encrypted on Cloudflare and are visible only with your practice's dashboard key.
- No ad pixels or third-party analytics on the preview page, so nothing a patient types or uploads can reach Meta, Google or anyone else through it.
- We never sell patient details or use photos to train AI.
The trust center walks through one request from start to finish.
Dental advertising rules
US dental advertising falls under the Federal Trade Commission's truth-in-advertising rules and your state dental board's own rules. The common thread is that marketing can't be false or misleading or promise results a patient can't count on. Smile Fitter is built around that:
- The preview page says it's an AI preview, not a promise of treatment results, and the patient checks a box confirming they understand before taking a photo.
- The page footer and the shareable video both say the result is an illustration that depends on a dental exam.
- Our terms bar practices from presenting a preview as a diagnosis, a treatment plan or a guaranteed result, and from using a patient's preview in advertising without their separate written permission.
Large brands use the same approach. Invisalign's SmileView, for example, describes its results as a simulation that may vary. You remain responsible for your own advertising claims.
Calls and texts
A patient who asks for a consultation expects you to contact them about it. Marketing messages are different: the Telephone Consumer Protection Act and state laws require consent first, which is why the form has a separate, unchecked box for tips and offers. Keep your follow-up on the request, and send marketing only to patients who checked that box.
What we expect from you
- Keep the preview's labels, consent checkbox and disclaimers as they are.
- Decide, with your own advisers, whether Smile Fitter fits your HIPAA position.
- Handle the requests you receive the way you handle any other patient inquiry.
- Keep your dashboard key to people at your practice who need it.
This page describes Smile Fitter as of October 28, 2026. It isn't legal advice. Questions: [email protected].