Privacy and security

Who can see your patients

• Your team: anyone signed in with your practice's login.
• Your group admin: if your practice is part of a group.
• SmileReply support: only when helping you, and every visit is recorded.

When SmileReply support opens your practice, it gives a reason, and patients' names and contact details are hidden unless support needs to see them. Both are recorded in your Activity log under Access, for example SmileReply support opened this location. Reason: …

Signing in

• Password: at least 8 characters. Change it any time in Account settings. Changing it signs you out on every other device.
• Repeated wrong passwords: after 10 wrong tries, the account is locked for 15 minutes.
• Forgot your password? Use Forgot password on the sign-in page. The link works once, for one hour.

How patients get into their consultation

• Their link opens on the first device they use, and that device is remembered for 90 days.
• On any other device, they're sent a 6-digit code by text or email.
• If you archive a patient, their link stops working straight away.

How information is protected

• Everything is sent over encrypted connections.
• Location data is removed from patients' photos when they're uploaded.
• Every change in your dashboard, and every record or photo download, is noted in your Activity log.
• Information is removed on a fixed schedule. See Patient data storage, retention and exports.

What you can do

• Use a strong password that you don't use anywhere else.
• Sign out on shared computers.
• When someone leaves your practice, change your password.
• Check the Access tab of your Activity log now and then.