Smilehero Privacy Policy

Effective from 4 October 2026

This policy in other languages: Suomi · Svenska · Deutsch

This policy applies to the Smilehero mobile app. Altiplan Oy processes personal data so that the app can show orthodontic appliance wear time, support the user's own progress tracking and send parent or guardian reminders selected by the user. Smilehero does not make diagnoses or treatment decisions and does not replace instructions from a dentist.

A short summary for young users

Smilehero reads wear-time data sent by the chip in your orthodontic appliance and saves it to your Smilehero account.
If you choose, you can save smile photos and mood notes and add a parent or guardian's phone number for reminders.
We do not sell your information or use it for advertising. Information is not sent to your dentist automatically; you can show it from your own app during an appointment.
You can withdraw your consent and delete your account. In Finland, if you are under 13, you need permission from a parent or guardian to use Smilehero.

1 Controller and contact details

Controller: Altiplan Oy
Business ID: 2124097-8
Address: Kivirannantie 46, 95410 Tornio, Finland
Privacy and support: support@getsmilehero.com
Support page: getsmilehero.com/support

2 Information we process and where it comes from

Account and contact details Email address for signing in and necessary service messages. The app does not require the user's real name.
Orthodontic appliance data Chip identifier, wear-time readings, reading times and the resulting wear-time history.
Content saved in the app General daily target, settings, selected character, game rewards, optional smile photos and mood notes.
Parent or guardian reminders The parent or guardian's phone number, the content of the text message and information needed to deliver it.
Permissions and technical data Information needed to use Bluetooth, the camera, photo library and notifications. Smilehero does not use location data as part of the service.
Support requests Email address, message and any attachments the user chooses to send.

The user or parent or guardian provides contact details, photos and notes. The chip in the orthodontic appliance sends its identifier and wear-time data, which the app links to the user's account. The app creates settings, rewards and message-delivery data during use.

We may also measure app usage in aggregate to improve the service. This information is not linked to an individual user, and no external analytics service is used for this purpose.

3 How we use information and our legal basis

to create an account and sign the user in
to read, store and display wear time by day, week and month
to save smile photos, mood notes, settings and game rewards
to send text-message reminders to a parent or guardian when selected by the user
to respond to support requests and maintain the security and operation of the service

Using Smilehero is voluntary, and the processing of personal data is based on consent. To the extent that wear time, photos or other information reveals the user's health or orthodontic treatment, processing is based on explicit consent.

Consent can be withdrawn at any time by deleting the account in the app or contacting support@getsmilehero.com. Withdrawal does not affect processing carried out before consent was withdrawn. If consent for processing required by Smilehero's core functions is withdrawn, the service cannot continue for that account.

4 Storage and service providers

Smilehero requires an internet connection. Information linked to the account is stored in Smilehero's back-end database provided by Supabase. The production database is located in the EU.

Text messages to parents or guardians are delivered through Twilio. To deliver a message, Twilio receives the recipient's phone number, message content and technical delivery information. Email and support providers may process information needed for service messages and support requests.

Service providers process information under contracts and Altiplan Oy's instructions. If information is processed outside the European Economic Area, the transfer uses a mechanism permitted by applicable data protection law, such as an adequacy decision, binding corporate rules or the European Commission's standard contractual clauses.

We do not sell information, use it for advertising or send it automatically to a dentist. The user may show information to a dentist from their own app during an appointment. If a dentist adds information to the patient's clinical record, the clinic is responsible for that copy under its own privacy notice.

5 Retention and deletion

Account information is kept while the account is active. When the user deletes the account in the app or requests deletion by email, personal data linked to the account is deleted from active systems without undue delay, unless retention is required by law or for a legal claim.

Message-delivery data and support requests are kept only for as long as needed to deliver the message, resolve the matter, maintain service security or comply with applicable law. Information remaining in service-provider backups and technical logs is deleted in line with their normal deletion schedules.

Removing the app from the phone does not by itself delete the account stored on the server. Deleting the account may also not erase wear-time data stored on the chip in the orthodontic appliance. Contact support@getsmilehero.com if you need instructions.

6 Young users and phone permissions

Smilehero is intended for orthodontic patients aged 10 and over, including adults. In Finland, a child under 13 needs authorisation from a parent or guardian when an information-society service relies on consent to process personal data. Local age thresholds and rules on parental consent apply in other countries. A parent or guardian should review this policy and the reminder settings together with a young user.

The app uses Bluetooth to read data transmitted by the chip in the orthodontic appliance. Taking or selecting a smile photo requires access to the camera or photo library, depending on the user's choice. Notifications require separate permission. Permissions can be changed in the phone settings.

7 Automated decisions and security

Smilehero does not make automated treatment decisions, create risk classifications or profile users. The character, coins and other rewards are motivational game features, not assessments of the user's health or treatment outcome.

Altiplan Oy and its service providers protect personal data with technical and organisational measures appropriate to the risk. Users should protect their phone with a passcode or biometric lock and install operating-system security updates.

8 Your privacy rights

Depending on applicable law, users have the right to receive information about processing, access their personal data, request correction or deletion, restrict processing, receive data in a portable format and withdraw consent. Send a request to support@getsmilehero.com. We may verify identity before completing a request.

If you are not satisfied with how your personal data is handled, you may complain to the competent data protection authority. In Finland, this is the Office of the Data Protection Ombudsman at tietosuoja.fi.

9 Changes to this policy

We update this policy if Smilehero's functions or personal-data processing changes. The current version is published at the same web address. We will provide notice in the app if a material change makes this necessary.

Privacy questions: support@getsmilehero.com