Built in
Data ownership
Your clinic runs SmileCare on its own Supabase instance. Patient data is not hosted on SmileCare servers, so you retain control of the deployment and its backups.
Controls
What protects the practice record
These are the controls built into the platform. Your deployment, policies and agreements complete the picture.
Built in
Encryption
Data is encrypted in transit with TLS 1.3 and at rest with AES-256, covering the database and stored documents in your deployment.
Built in
Role-based access
Five roles and module-level permissions let you decide who can see clinical, front-desk and administrative data. MFA/TOTP with recovery codes and session timeouts reduce the risk of unattended access.
Built in
Audit trail
Actions are written to an audit log and surfaced in a compliance panel, giving your team a reviewable record of changes and access.
Plan with us
Availability & backups
Backups and disaster recovery are part of your deployment plan. We document the approach with your team rather than promising a one-size-fits-all uptime figure.
WCAG 2.1 AA
Accessibility
The interface is aligned with WCAG 2.1 AA, with keyboard focus states, semantic headings and a published accessibility statement.
Compliance
Compliance at a glance
| Area | SmileCare | Your practice |
|---|---|---|
| HIPAA | ✓ HIPAA-aware controls and audit logging | Notice of Privacy Practices, Security Risk Analysis, BAAs, training |
| Claims coding | ✓ ADA CDT code set built in | Correct coding and payer agreements |
| Accessibility | ✓ WCAG 2.1 AA aligned, axe violations 0 at last audit | Accessible content and staff guidance |
| Encryption | ✓ AES-256 at rest, TLS 1.3 in transit | Protect credentials and device access |
| Audit | ✓ Action logging and compliance panel | Periodic access reviews |
Shared responsibility
Who owns what
SmileCare provides
- Software controls, role permissions and audit logging
- Encryption support and security documentation
- Data migration and onboarding guidance
- A clear boundary: we do not host your patient data
Your practice owns
- BAAs with vendors that handle PHI
- Notice of Privacy Practices and staff training
- Security Risk Analysis and access reviews
- Backups, incident response and business continuity
Third-party services
PayPal handles subscription payments. Your Supabase deployment hosts the application data. Clearinghouse partners handle claim connections. Email infrastructure supports outbound communication. Ask us for the current subprocessor list before signing a BAA.
Report a security issue
Email sales@smilecareapp.com with the subject “Security report”. Include the affected page or workflow and the steps to reproduce it. We aim to respond within one business day.
FAQ
Security questions
Is SmileCare HIPAA certified?
HIPAA does not have a certification programme. SmileCare provides HIPAA-aware controls — audit logging, role-based access, encryption in transit and at rest, and a compliance panel. Your practice remains responsible for its Notice of Privacy Practices, Security Risk Analysis, BAAs and staff training.
Where is patient data stored?
SmileCare is self-hosted on your own Supabase instance. We do not host, process or store patient health information on SmileCare servers. Your deployment and its backups remain under your control.
Do you provide a Business Associate Agreement?
BAA requirements are reviewed with your team during onboarding. Your practice also needs BAAs with the other vendors that handle PHI, including clearinghouses, imaging providers and communication tools.
How do I report a security issue?
Email sales@smilecareapp.com with the subject “Security report”. Include the affected page or workflow and enough detail for us to reproduce the issue. We aim to respond within one business day.
Ready to see how SmileCare fits your practice?
Start your 30-day free trial, or walk through your workflows with our team. No credit card required.