HIPAA Compliance Statement

Effective Date: December 17, 2025
Last Updated: December 22, 2025

1. Introduction

At Fixmysmile AI, we take the privacy and security of your health information very seriously. As an AI-powered platform serving the dental industry, we understand the importance of complying with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act.

This HIPAA Compliance Statement outlines how we protect Protected Health Information (PHI) and our commitment to maintaining the highest standards of data security and patient privacy.

2. Our Role as a Business Associate

Under HIPAA, Fixmysmile AI typically operates as a Business Associate when we provide services to "Covered Entities" (such as dentists, orthodontists, and dental practices). We also handle health-related information directly from users (consumers) as part of our AI simulation services.

In all cases, we implement rigorous safeguards to protect the information entrusted to us.

3. Protected Health Information (PHI) We Handle

In the course of providing our services, we may collect or process the following types of information that could be considered PHI:

Facial Images: Photos uploaded for AI smile simulations.
Dental Interests: Information about desired treatments (e.g., Invisalign, Implants, Veneers).
Contact Information: Name, phone number, and email address provided for lead generation.
Location Data: Zip codes used to match users with local dental providers.
Clinical Details: Any dental history or preferences shared during the consultation process.

4. Administrative Safeguards

We have implemented comprehensive administrative policies to manage our HIPAA compliance:

Risk Analysis: We conduct regular assessments to identify potential risks to the confidentiality, integrity, and availability of electronic PHI (ePHI).
Staff Training: All Fixmysmile AI employees and contractors who handle sensitive data receive mandatory HIPAA training.
Access Management: We restrict access to PHI to only those individuals who require it to perform their job functions.
Business Associate Agreements (BAAs): we enter into BAAs with our Covered Entity partners and our own subcontractors who may have access to PHI.

5. Technical Safeguards

We employ state-of-the-art technical measures to secure data:

Encryption: All data is encrypted both at rest (using AES-256) and in transit (using TLS 1.2+).
Identity & Access Management: We use secure authentication protocols (including multi-factor authentication) for all systems storing sensitive data.
Audit Logging: We maintain detailed logs of system access and data modifications to monitor for unauthorized activity.
Automatic Log-offs: Systems containing PHI are configured to log off users after a period of inactivity.

6. Physical Safeguards

Our digital infrastructure is hosted by world-class cloud providers (Vercel and Supabase) whose data centers maintain the highest levels of physical security:

Secure Facilities: Data centers are protected 24/7 by physical security, biometric access controls, and video surveillance.
Device Security: We maintain strict policies regarding the security of any company devices used to access our infrastructure.

7. Data Minimization and Retention

We believe the best way to protect data is not to keep it longer than necessary:

Image Deletion: Facial images used for AI simulations are deleted from our immediate processing cache within 24 hours.
Lead Data: Lead information is retained only as long as necessary to facilitate the connection with the dental providers you requested.
Purge Requests: Users may request the permanent deletion of their data at any time by emailing [email protected].

8. HIPAA and AI Processing

Our AI processing workflows are designed with privacy in mind:

Anonymized Processing: Where possible, data is de-identified before being processed by AI models.
No Training on PHI: We do NOT use your specific PHI or uploaded facial images to train general-purpose public AI models.
Secure AI Pipelines: Our connections to AI providers (like Replicate) are secured and governed by data processing agreements that prioritize privacy.

9. Breach Notification

In the unlikely event of a discovery of a breach of unsecured PHI, Fixmysmile AI will:

Notify affected individuals without unreasonable delay (and in no case later than 60 days).
Notify the Secretary of Health and Human Services (HHS).
Provide notice to our Covered Entity partners as required by our BAAs.

10. Contact Us

If you have any questions about our HIPAA compliance or how we handle your health information, please contact our Privacy Officer at:

Email: [email protected]
Subject: HIPAA Inquiry
Address: Fixmysmile.ai, 1209 Orange Street, Wilmington, DE 19801, United States

Fixmysmile AI is committed to being a trusted partner in your dental journey. We continuously review and update our security practices to ensure they meet or exceed modern industry standards.