Data processing agreement

This agreement sets out what SmileReply does with the personal information your practice collects through the service, and what we promise about it. It forms part of our terms of service. Where the two say different things about how information is handled, this agreement wins.

Your practice accepts it when you set up your account, by ticking the box that agrees to the terms and this agreement. We keep a record of who accepted it, for which practice, when, and which version.

Who does what

Your practice decides what is collected from patients and why. SmileReply holds and processes that information for you, on your instructions, to run the service. In the language of New Zealand’s Privacy Act 2020 we hold it as your agent; under the Australian Privacy Principles your practice remains responsible for it, and we are a service provider handling it for you. Either way the information is yours, and your practice stays answerable to your patients for it.

Your instructions are the way you set up and use the service: the services you offer, the consultations you send, the settings you choose and the requests you make of us. We do not use your patients’ information for anything else. We do not sell it, use it for advertising, share it with another practice, or use it to train models.

What we handle

About your prospective patients, and the parents or guardians who complete the form for a child:

• the photographs of their teeth, which are health information
• their name, email address and mobile number, and whether the assessment is for them or for their child
• what they would like to improve, and any records from another clinic they choose to attach
• your team’s assessment, recommendation, estimate and the consultation you send
• the simulated before and after, and the consultation video
• their messages, booking requests and replies
• what they agreed to on the form, and when
• the devices they have signed in on, and the one-time codes used to do it

About your team: names, photographs, the welcome videos and personal videos they record, their sign-in details, and a log of what each login does in your dashboard.

Who can see it

Inside SmileReply, only the people who need to, and only to run or support the service. Everyone with access is bound to keep it confidential.

When SmileReply support opens your practice’s account to help you, they record a reason first. Patients’ names, contact details and photographs stay hidden on screen unless they are needed. Each visit is listed in your Activity log under Access, so you can always see who came in, when and why.

Keeping it secure

The measures in place today:

• Everything travels over encrypted connections (HTTPS).
• The copies of photographs and videos held with Cloudflare are encrypted at rest.
• Each practice’s information is kept apart, and every request is checked against the practice it belongs to.
• Passwords are stored only as secure hashes. Sign-in attempts are rate limited, and changing a password signs out every other device.
• Patients open their consultation through a private link. On a new device they confirm it is them with a one-time code sent to their own mobile or email.
• Our server can only be administered with a private key, not a password, and sits behind Cloudflare’s network protection.
• Private links are removed from our server logs.
• Backups are taken every night, kept away from the server, and restored in tests to prove they work.

We review these as the service grows, and we will not reduce the overall level of protection they give.

Services that help us

A few providers do specific jobs for us. Each sees only what its job needs, and each is bound by its own terms to protect it. We are responsible for how we use them.

Before we add or replace a provider that handles your patients’ information, we will email you at least 30 days beforehand, saying who and why. If you object on reasonable privacy grounds, we will talk it through, and if we cannot resolve it you can end your plan before the change, without penalty.

Anything you connect yourself, such as a booking calendar, a CRM through our webhooks, or your own Meta or Google advertising account, is yours, and is not one of our providers.

Information held overseas

Our server is in the United States, so your patients’ information is held there. Copies of photographs and videos are delivered from Cloudflare’s network close to your patients. New Zealand and Australian privacy law both allow this, provided the information is protected to a comparable standard. We take that responsibility on, and it does not change because a server sits in another country. The privacy notice your patients see tells them where their information is held.

How long it is kept

We delete on a schedule, counted from each patient’s last activity, and paused while you have them marked as in treatment:

When you delete or archive a patient yourself, it takes effect straight away, and the files are permanently erased 7 days later, so a mistake can be undone in the meantime. Backups are kept for 30 days, and one a month for up to 13 months, so a deleted item can remain in a backup until it ages out. Backups are only ever used to restore the service.

Helping you answer your patients

Your dashboard lets you give a patient a copy of their record, correct or remove what you hold, and stop contacting them. If something you need is not covered, ask and we will help. If a patient contacts us directly, we will pass their request to you promptly rather than answer it ourselves, unless you ask us to.

If something goes wrong

If we become aware that your patients’ information has been accessed, disclosed, lost or altered without authority, we will tell you without undue delay, and in any case within 72 hours. We will say what happened, what information and how many patients are affected, what we have done about it, and who to talk to.

We will give you what you need to decide whether it is a notifiable privacy breach under the New Zealand Privacy Act or the Australian Notifiable Data Breaches scheme, and to notify the regulator and your patients. Deciding whether to notify, and notifying your patients, stays with your practice. We will not contact your patients about it without your agreement, unless the law requires us to.

Showing that we keep to this

If you need to show your own regulator or insurer how your patients’ information is handled, ask and we will give you reasonable information about our providers, our security and how we keep to this agreement.

When your plan ends

Before you go, you can export your patient records from the dashboard, and we will help if the export does not cover what you need. Consultations already sent stay available to those patients until the schedule above removes them. We keep storing your records of care for the period the law requires, unless you ask us, once you have exported them, to delete them sooner; holding them is then yours. Everything else is deleted on the usual schedule.

Changes

If we change this agreement we will email you at least 30 days beforehand and say what has changed. If a change does not suit you, you can end your plan before it takes effect.

Getting hold of us

Email [email protected] about anything in this agreement or your patients’ information.