Roles
Your practice decides why and how patient details are collected through Smile Fitter. Miles Media handles them on your behalf, only to run Smile Fitter for you. Under state privacy laws that use these terms, your practice is the business (or controller) and Miles Media is the service provider (or processor).
The data
- About whom: people who use the smile preview on your page or website.
- What: first name, email or mobile number, treatment and shade chosen, marketing consent, consultation days and times, phone, note, page and campaign details, and before and after close-ups of the smile if the patient agrees to send them.
- Why: to make the preview, deliver the request to your practice, and prevent abuse.
- Not included: the full photo, which stays on the patient's device. The mouth close-up sent to the AI is processed and not stored.
What we commit to
- Use patient details only to provide Smile Fitter to your practice, following these terms and your reasonable written instructions.
- Never sell or share them, use them for advertising, combine them with data from other sources, or use them to train AI models.
- Limit access to people at Miles Media who need it to run and support Smile Fitter, under a duty of confidentiality.
- Keep reasonable security measures in place: encryption in transit and at rest, separate access keys for each practice, hashed request tokens, salted hashes instead of IP addresses, rate limits and a bot check.
- Help you answer patients who ask to see, correct or delete their details, within 10 business days of your request.
- Answer reasonable written questions about how we handle your practice's data.
- Tell you if we can no longer meet these commitments.
Subprocessors
We use the service providers on our subprocessor list. Before adding a new one that receives patient details, we'll update the list and email practices using Smile Fitter at least 14 days ahead. If you object, you can stop using Smile Fitter before the change applies. We remain responsible for our subprocessors' handling of your data.
Security incidents
If we learn that your practice's patient details have been accessed or disclosed without authorization, we'll tell you without unreasonable delay, and within 72 hours of confirming it, with what we know about what happened, what data was involved and what we're doing about it. We'll help you meet any notification duties you have.
Deletion
When your practice stops using Smile Fitter, or asks us to, we delete its patient details within 30 days, after giving you a copy if you ask for one. Requests collected on demo pages are deleted automatically after 90 days.
HIPAA
These terms are not a HIPAA Business Associate Agreement, and Smile Fitter doesn't include one today. If your practice is a HIPAA covered entity and decides it needs a BAA for this kind of tool, don't use Smile Fitter with patients until we've signed one with you. More on HIPAA and Smile Fitter.
Questions: [email protected].