Privacy, explained in plain language.

1. Scope and clinic responsibilities

This policy covers the SmileFlow website, checkout and AI smile-analysis service. When a dental clinic places SmileFlow on its website and receives a visitor's contact details, that clinic may also act as an independent controller. Its own privacy notice and professional obligations apply to the information it receives.

2. Information we process

• Identity and contact data: name, email address, optional phone number, clinic selection and consent choice.
• Submitted content: a smile photograph and the aesthetic orientation generated from it.
• Business and billing data: clinic or agency details and transaction information supplied through Stripe.
• Technical data: IP address and limited request information used for delivery, security, fraud prevention and rate limiting.

3. How smile photographs are handled

A submitted photograph is received for the requested analysis, converted in memory and sent to Google's Gemini API for model processing. The current SmileFlow application does not write the image to a SmileFlow database or file-storage system. Infrastructure and AI providers may process request data under their own contractual terms, security controls and retention practices.

4. Legal bases for processing

• Performance of a contract: to provide subscriptions, setup, support and requested SmileFlow services.
• Explicit consent: to process a submitted smile photograph and to send contact details to the selected clinic for follow-up.
• Legitimate interests: to secure the service, prevent fraud and abuse, troubleshoot failures and improve reliability.
• Legal obligations: where we must retain or disclose information for tax, accounting, regulatory or lawful-request purposes.

You may withdraw consent before submission by not using the analysis. After submission, contact us and the receiving clinic if you want to exercise a data protection right.

5. How we use information

• Provide the requested AI-generated aesthetic orientation.
• Send consented contact details and a compact report summary to the chosen clinic.
• Process subscriptions, deliver onboarding and provide support.
• Protect service availability, enforce limits and investigate misuse.
• Meet legal, tax and accounting requirements.

6. Service providers and disclosures

We do not sell personal data. We may disclose the minimum necessary information to:

• Google Gemini API: image analysis and report generation.
• Resend: delivery of lead, onboarding and service emails.
• Stripe: subscription checkout, billing and payment processing.
• Hosting and security providers: delivery, operational logging and abuse prevention.
• The selected dental clinic: contact details and analysis context after explicit consent.
• Authorities or advisers: where required by law, to protect legal rights or in connection with a corporate transaction.

7. International transfers

Some providers may process data outside the United Kingdom or European Economic Area. Where required, we use recognised safeguards such as adequacy regulations, standard contractual clauses or the UK International Data Transfer Agreement or Addendum.

8. Retention and security

Smile photographs are not intentionally persisted in SmileFlow application storage. Contact, billing, email-delivery and operational information is retained only as long as necessary for service delivery, security, legal obligations and dispute resolution. Receiving clinics and service providers apply their own documented retention periods. We use technical and organisational measures appropriate to the service, but no internet service can guarantee absolute security.

9. Your data protection rights

Depending on your location and applicable law, you may have rights to:

• Access the personal data held about you.
• Correct inaccurate or incomplete data.
• Request erasure or restriction of processing.
• Object to processing based on legitimate interests.
• Receive portable data where applicable.
• Withdraw consent without affecting earlier lawful processing.
• Complain to a data protection authority.

To exercise a right, email contact@getsmileflow.com. If a clinic received your submission, contact that clinic as well. UK users may complain to the Information Commissioner's Office at ico.org.uk.

10. Children

SmileFlow is not intended for children under 18, and we do not knowingly invite children to submit photographs or contact information. If you believe a child has submitted information, contact us so we can investigate and take appropriate action.

11. Healthcare and sensitive information

SmileFlow provides an aesthetic orientation and is not a diagnostic service. Do not upload medical records, radiographs or unrelated sensitive documents. Clinics are responsible for determining whether their implementation meets applicable professional, contractual and data protection requirements.

12. Changes and contact

We will update the date above when this policy materially changes. Questions can be sent to contact@getsmileflow.com.
Fluxora LTD
United Kingdom