One Smile Studio Privacy Policy
Effective Date: September 1, 2026 • Version 2.0 • Owner & Operator: One Smile LLC
One Smile LLC, doing business as One Smile Studio (“One Smile Studio,” “we,” “us,” or “our”) DOES NOT share, sell, rent, or trade customer opt-in information, including phone numbers and consent records, with any affiliates or third parties for marketing, promotional, or any other purposes unrelated to providing our direct services. Text messaging originator opt-in data and consent records are kept strictly confidential and are disclosed only to the aggregators and providers that deliver our text messages.
1Who This Policy Covers
This policy applies to the One Smile Studio iOS and desktop apps, onesmilestudio.com, onesmileapp.com, and the lab portal (together, the “Services”).
| You are | You use | Our role with your information |
|---|---|---|
| A dental professional or practice staff member | The One Smile Studio app and onesmilestudio.com | We are responsible for your account and billing information. |
| A patient or prospective patient | onesmileapp.com or a practice’s consultation page | We handle your information on behalf of the dental practice you chose. |
| A dental lab | The lab portal | We are responsible for your account information and handle case files on behalf of the sending practice. |
Patient information and HIPAA. Dental practices that use the Services are covered entities under the Health Insurance Portability and Accountability Act (HIPAA). When we handle patient information for a practice, we act as that practice’s business associate under a signed Business Associate Agreement (BAA). The practice’s Notice of Privacy Practices describes how your dental information is used. If this policy and a BAA conflict about patient information, the BAA controls.
If you are a patient, your dental practice decides how your record is used, corrected, and retained. We pass any request we receive from you to that practice.
2Information We Collect
We collect only what the Services need to work.
Account and practice information
- Name, email address, mobile phone number, practice name, and practice address.
- Login credentials and multi-factor authentication settings.
- Role and permissions within a practice or lab.
Patient information (entered by a practice, or submitted by a patient to a practice)
- Name and contact details.
- Photos and videos of the face, smile, and teeth, taken in the app or uploaded.
- Consultation intake answers, cosmetic goals, and messages with the practice.
- Appointment details, consultation notes, and case history.
- Smile simulations, designs, presentations, and other images or videos created in the Services, including AI-generated ones.
- Case files and communications exchanged between a practice and a dental lab.
Payment information
- Subscription, credit purchase, and transaction details. Payments are made on our website and processed by Stripe. We do not receive or store full card numbers.
Communication and consent records
- Opt-in records, audit logs, and timestamps for SMS, email, and web portal communications.
- Support requests, inquiries, and feedback.
Device and usage information
- IP address, browser type, operating system, app version, and device identifiers.
- Usage data, diagnostic logs, and crash reports.
- Cookies and local browser storage on our websites, used for sign-in and session management.
This device and usage information is personal information when it can be linked to you.
Device permissions in the app
- Camera: to capture patient photos and videos.
- Microphone: to record audio when you record video.
- Photo library: to import images you select and to save images you export.
The app asks for each permission the first time a feature needs it. You can change permissions at any time in iOS Settings.
We do not collect precise location, contacts, Apple Health data, or advertising identifiers. We do not track you across other companies’ apps or websites.
3How We Use Your Information
We use information only to run and support the Services:
- Providing, operating, and maintaining the smile design app, patient portal, lab portal, and cloud sync.
- Delivering a patient’s consultation request and photos to the dental practice the patient chose.
- Creating smile simulations, designs, presentations, and lab case packages at a user’s request.
- Processing subscriptions, credit purchases, and billing.
- Sending verification codes, account notices, consultation updates, and message alerts.
- Providing customer support.
- Securing the Services, preventing unauthorized access, and preventing fraud.
- Fixing errors and improving performance, using usage and diagnostic data.
- Keeping timestamped legal and compliance records of communication preferences and consents.
What we do not do
- We do not sell personal information.
- We do not use personal information for advertising or share it for targeted advertising.
- We do not use patient photos, videos, or simulations in our own marketing without the patient’s written authorization.
- We do not use patient photos, videos, or dental information to train AI models.
- We do not use information collected for one purpose for a different purpose without asking first.
4AI Features
Some features use artificial intelligence to edit or generate images and video, such as smile simulations.
- What is sent. The photo or video you select, plus the instructions for the result, such as tooth shade and shape.
- Who processes it. Google (Gemini and Veo models) and an image-processing service that we operate on Google Cloud.
- How it is protected. These services process the content only to return the result to you. Our agreements with them do not allow the content to be used to train their models.
- User-initiated only. Photos and videos are sent to an AI feature only when an authorized user explicitly selects an image and initiates a simulation (or when a patient submits a consultation with consent). You can use all other features of the Services without using AI features.
- What you get back. AI results are simulations. They are not a diagnosis, a treatment plan, or a promise of a clinical outcome. Results are labeled as simulations when shown or exported. Actual results from a dental provider will be different.
Practices are responsible for obtaining any patient consent or authorization required before using a patient’s image in an AI feature or in the practice’s own marketing.
5SMS & MMS Messaging & Compliance
Text Message Program Terms & Conditions
By opting into our SMS/MMS messaging services, you agree to receive text messages related to our Services. These include verification codes, account and system notices, consultation updates, message alerts, appointment reminders, and customer support. The program serves dental professionals and staff, patients, and dental labs.
You will only receive messages if you have explicitly opted in, for example by checking the consent box on a sign-up or consultation form. Consent to receive text messages is not a condition of buying any product or service. We maintain timestamped audit records of all opt-in actions and comply with the TCPA, CTIA guidelines, and 10DLC requirements.
You can cancel SMS notifications at any time by replying “STOP”. You will receive a final confirmation message, and no further messages will be sent unless you opt in again.
Message frequency varies based on your interactions and consultations. Messages relate directly to services you requested. We never send promotional spam. Messages do not contain clinical details. Any link in a message opens a page on onesmilestudio.com or onesmileapp.com that requires you to sign in.
Reply “HELP” for assistance or email info@onesmileapp.com. We respond within 24 to 48 hours.
Carrier Information: Standard message and data rates may apply. Carriers, such as AT&T, Verizon, T-Mobile, and regional carriers, are not liable for delayed or undelivered messages.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service infrastructure, is permitted solely to facilitate service delivery. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties, other than the aggregators and providers that deliver the text messages.
6Information Sharing & Disclosure
We do not sell, rent, or trade personal information. We share information only in the ways listed here.
Service providers
| Provider | What it does for us | Information involved |
|---|---|---|
| Google (Firebase Authentication, Cloud Firestore, Cloud Storage, Google Cloud) | Sign-in, cloud storage, sync between devices, hosting, and first-party operational logs | Account information, patient information, device and usage information |
| Google (Gemini and Veo models) | AI image and video features | Photos, videos, and instructions you submit to an AI feature |
| Stripe | Payment processing | Billing contact and payment details |
| Twilio | Text message delivery | Mobile number and message content |
| Postmark | Email delivery | Email address and message content |
| Apple (iOS System Diagnostics) | Operating system crash and stability reporting (only when enabled in iOS device settings) | Device model, OS version, and crash logs (no patient information) |
Every service provider is bound by contract to protect your information to the same standard as this policy, and to use it only to provide its service to us. Providers that handle patient information for us have signed a Business Associate Agreement.
- Dental practices. If you are a patient, the information and photos you submit go to the dental practice you chose. That practice controls them from then on.
- Dental labs. A practice can send case files, images, and instructions to a dental lab through the lab portal. This happens only when the practice chooses to send them.
- Legal compliance. We disclose information when required by law, subpoena, or court order, or to protect our legal rights, property, or safety.
- Business transfers. If we are involved in a merger, acquisition, or sale of assets, information may transfer to the new owner and stays protected under this policy. Patient information stays subject to the applicable BAA.
* All the above categories exclude text messaging originator opt-in data and consent. That information is not shared with any third party, other than the aggregators and providers of the text message service.
7Data Storage & Security
Where information is stored. The app stores practice and patient information on the device so it works offline, and syncs it to our cloud storage in the United States. The app’s local data is excluded from iCloud backup. The Services are intended for use in the United States.
How we protect it
- Encryption of data in transit (TLS) and at rest in our cloud storage.
- Role-based access controls, so each user sees only the practices and cases they are assigned to.
- Multi-factor authentication for accounts.
- Monitoring, security updates, and periodic review of access rules.
- Backups and recovery procedures for cloud data.
- Privacy and security training for anyone on our team who can access patient information.
No system is perfectly secure. Practices are responsible for device passcodes, for who has access to their devices, and for removing users who leave the practice.
8Breach Notification
If a security incident affects patient information, we notify the affected practice as required by our BAA and the HIPAA Breach Notification Rule. Where other laws apply, including state breach laws and the FTC Health Breach Notification Rule, we notify affected individuals and regulators as those laws require.
9Data Retention & Deletion
| Information | How long we keep it |
|---|---|
| Account information | While the account is open, then 30 days |
| Patient information held for a practice | Until the practice deletes it, or up to 180 days after the practice’s subscription ends |
| Consultation requests a practice has not accepted | 90 days after submission |
| Photos and videos sent to AI features | Not kept by the AI provider after the result is returned |
| SMS opt-in, consent, and HIPAA compliance audit records | 6 years after the last message or applicable event |
| Billing and transaction records | 7 years, as tax and accounting law requires |
| Backups | Overwritten within 90 days |
Deleting your account. In the app, go to Settings > Delete Account. You can also email info@onesmileapp.com. Deletion removes your account and the information tied to it from our active systems within 30 days, except what the law requires us to keep.
If you are a patient. Use the patient portal or email info@onesmileapp.com to ask for deletion or to withdraw consent. If your information is part of a practice’s dental record, the practice decides the request, because dental boards and state law set how long records must be kept. We forward your request to the practice within 5 business days.
10Your Rights & Choices
You can:
- Access, correct, or delete your personal information.
- Get a copy of your personal information.
- Withdraw consent at any time, including consent to AI features.
- Opt out of text messages by replying “STOP”, and out of non-essential emails by using the unsubscribe link.
- Change camera, microphone, and photo permissions in iOS Settings.
To use these rights, email info@onesmileapp.com. We verify your identity, respond within 45 days, and never penalize you for making a request. If we decline a request, you can appeal by replying to our decision.
Patients. Your rights to see, correct, and receive a copy of your dental record come from HIPAA and are handled by your dental practice. We help the practice respond.
State privacy rights. Depending on where you live, state law may give you the rights listed above. We do not sell personal information, do not share it for cross-context behavioral advertising, and use sensitive information, such as photos and dental information, only to provide the Services.
11Facial Images & Biometric Information
We process photos and videos of faces to display them and to change the appearance of teeth at a user’s request. We do not use them to identify anyone. We do not create, store, or share face templates, faceprints, or other biometric identifiers.
12Children & Minors
The Services are not directed to children under 13, and we do not knowingly collect information directly from them. You must be 18 or older to create an account or submit a consultation request. A parent or legal guardian must submit any request for a patient under 18. Practices that enter information about a minor patient are responsible for having the parent’s or guardian’s consent.
If you believe a child has given us information without that consent, email info@onesmileapp.com and we will delete it.
13Cookies & Tracking Technologies
Our websites use essential cookies and local browser storage to keep you signed in and remember your preferences. We do not use third-party analytics or advertising cookies; we rely only on first-party operational logs within our own infrastructure to monitor reliability and performance. You can control cookies in your browser settings. Blocking essential cookies may stop sign-in from working.
The app does not use cookies for advertising and does not track you across other companies’ apps or websites.
14We Do Not Provide Dental Care
One Smile Studio is software. We are not a dental practice and do not diagnose, treat, or give dental advice. Dentists who use the Services are independent professionals, responsible for their own clinical judgment and for holding a license where their patients are located. Any assessment of your photos comes from the dentist, not from us. A simulation shows a possible cosmetic result and does not replace an in-person examination.
If you have a dental emergency, contact a dentist or emergency services directly.
15Third-Party Links
The Services may link to third-party websites. We are not responsible for their privacy practices. This policy applies only to information collected by One Smile Studio.
16Changes to This Privacy Policy
We may update this policy. The current version, with its effective date and version number, is always available on our websites and in the app. For a material change, we give notice by email or in the app at least 30 days before it takes effect. If a change would let us use your information in a new way, we ask for your consent first.
17Contact Us
Entity: One Smile LLC
Privacy contact: Director of Compliance
Mailing address: 8150 Leesburg Pike #503, Vienna VA 22182
Email: info@onesmileapp.com
Websites: https://onesmilestudio.com (dental professionals and labs) and https://onesmileapp.com (patients)