Privacy information
How SmileIntro handles your photograph and your details. Version 2026-09-12. Written to be read in full; it is shorter than most.
Your photograph is never stored. A cropped image of your mouth is sent for tooth mapping, used to produce your guide, and exists only for the length of that request. Neither SmileIntro nor the practice keeps it, and neither can retrieve your guide once you close the tab.
This is not a medical service. SmileIntro describes what is visible in a photograph in plain words. It does not diagnose, does not name a dental condition, does not recommend treatment and does not predict a result. Only a dentist can do those things.
Who is responsible
Two organisations are involved and they are responsible for different things. This matters if you want to exercise your rights, because it tells you whom to ask.
- SmileIntro operator
- Dmytro Mykhailyshyn
- Registration
- Not yet published
- Address
- Not yet published
- Data protection contact
- Not yet published
The dental practice whose link you followed is the controller for your contact details and for the consultation that may follow. Its name, its own privacy notice and its contact route are shown on the page where you opened SmileIntro.
The SmileIntro operator is the controller for the measurements of how the service is used, and acts on the practice's instructions when handling your photograph.
What happens to your photograph
- Your photograph is chosen on your own device. Nothing is sent while you are looking at it.
- When you ask for a guide, your browser cuts out the area around your mouth. The rest of the picture, including your eyes, is not sent anywhere.
- That crop is sent to fal (fal – Features & Labels, Inc.), in the United States, which outlines each visible tooth. It is held for the length of the request.
- If, and only if, you ask for an illustrative preview, a crop of the mouth and lips is sent to OpenAI, in the United States. If you never press that button, nothing goes to OpenAI.
- Your guide is assembled in your browser. It is not stored, not emailed, and not visible to anyone but you unless you choose to send it to the practice.
Because nothing is kept, nobody — including the practice and the operator — can produce your photograph or your guide afterwards. That is a deliberate limit, and it is also why a request to delete your photograph has nothing to act on.
What is stored, and for how long
| What | Where | How long |
|---|---|---|
| Your photograph, and the crop taken from it | In transit only | The length of one request. Never written to a database. |
| A contact request: your name, the contact details you gave, your optional note, what you said you were interested in, and the time and wording of the permission you gave | The practice's account, on servers in London | The practice's own retention period, 180 days unless it has set another. Erased after that. |
| Measurements of the visit: a randomly generated identifier, the campaign tags on the link, the site that referred you, your device type and browser family, and which steps you reached | Servers in London | Up to 400 days, so a practice can compare a month with the same month a year earlier. Not linked to you unless you send a contact request. |
| A record that a permission was given: its wording, its version, the time, and a one-way keyed hash of the contact detail — not the detail itself | Servers in London | Kept as evidence of consent after the contact request itself is erased. |
The identifier, and what it is not
A random identifier is created when you open the link, so that the steps of one visit can be counted as one visit rather than several. It contains no name and no contact detail, it is not shared with any advertising network, it is not used to recognise you on other websites, and it is not used to build a profile of you. Its purpose is to tell the practice whether the service produced consultations.
If you do send a contact request, that measurement is then linked to your name, so the practice can see the path that led to you. If you do not, it stays unlinked.
Why we are allowed to do this
| Processing | Lawful basis |
|---|---|
| Sending a crop of your mouth for mapping, and for an illustration if you ask | Your explicit consent, given by the tick box before the guide is made. You can decline and simply not use the service. |
| Passing your contact details to the practice | Your consent, given on the contact form. |
| Measuring how the service is used | The legitimate interests of the practice and the operator in knowing whether the service works, balanced against a design that keeps the measurement free of your identity until you choose otherwise. |
| Keeping a record that permission was given | The legal obligation to be able to demonstrate consent. |
Where information about your teeth is treated as data concerning health, the condition relied on is your explicit consent. That is why the transfer permission is a separate tick box with its own wording, and why refusing it stops the process rather than quietly continuing.
Leaving the United Kingdom
Everything stored stays in the United Kingdom. The only data that leaves is the crop of your mouth, sent to fal, and to OpenAI if you ask for an illustration. Both process in the United States, and both hold it only for the length of the request.
The safeguard relied on for those transfers is not yet confirmed. Until it is, do not upload a photograph if you would rather it did not leave the United Kingdom.
Who else is involved
- Supabase — the database, hosted in London.
- Vercel — hosting. Request information, including an IP address, passes through it and is held briefly to limit abuse.
- Resend — sends the practice an email when a contact request arrives.
- Stripe — handles the practice's subscription. It never sees patient data.
Your rights
You can ask for any of the following, free of charge:
- A copy of what is held about you, and where it came from.
- Correction of anything inaccurate.
- Erasure.
- Restriction of how it is used, or objection to it.
- Your details in a portable form.
- Withdrawal of a permission you gave, at any time. Withdrawing does not undo what was lawfully done before.
For your contact details and anything to do with the consultation, ask the practice. For the measurement of the visit, ask the operator using the address above. If you are not sure, ask either; the two will pass it on.
One record survives an erasure request on purpose: the proof that a permission was given, which is kept as a keyed hash rather than as your contact detail. It cannot be read back to identify you, and it exists so that the practice can show it acted properly.
Age
SmileIntro is for adults. The permission you give before a guide is made states that you are eighteen or older and that the photograph is of you. Do not use it for anyone else, and do not upload a photograph of a child.
Complaints
If you are unhappy with how your data has been handled, tell the practice or the operator first. You can also complain to the Information Commissioner's Office at ico.org.uk, or by telephone on 0303 123 1113.
Changes
This notice is versioned. The version in force when you gave a permission is recorded with that permission, so it is always possible to establish what you were told at the time.
Version 2026-09-12.