Smile Simulation & AI
A public smile widget where the patient uploads their own photo is a marketing tool, not a clinical record system. Here is the honest read on HIPAA, the patient-direct flow, and what we do and don't claim.
Simulated preview — a visualization aid, not a guaranteed outcome.
A website smile widget where a visitor chooses to upload their own photo is a patient-initiated marketing interaction, not a clinical records system — and that patient-direct design is what keeps a clinic clear of turning a curiosity tool into a protected-health-information pipeline. We are deliberately plain about this: Smileproof does not claim to be HIPAA-ready. Here is the honest read on how the widget flow works, why it sidesteps the heaviest obligations, and where the real boundaries sit. None of this is legal advice.
HIPAA governs protected health information handled by covered entities and their business associates — the clinical, records-keeping side of care. A public marketing widget, where a website visitor voluntarily uploads their own photo to see a cosmetic preview of themselves, is a different animal: it is a consumer-facing, patient-initiated interaction, closer to someone using any consumer app than to a clinic transmitting a patient's record. That does not make privacy unimportant — it makes the framing matter. The honest position is that the widget is built as a lead-generation and visualization tool, not as a system of record, and it should be understood and used as exactly that.
Patient-direct means the patient, not the clinic, initiates and controls the upload: they land on a public page, they choose to try a preview, and they submit their own image to see their own result. The clinic is not soliciting, transmitting, or warehousing a library of identifiable patient records to run the tool. That design keeps the clinic out of the position of pushing protected health information through a marketing gadget, which is the posture you want. The patient owns the decision and the image; the clinic receives a lead and a signal of interest. It is a cleaner arrangement for everyone precisely because the sensitive action stays in the patient's hands.
We claim to be a believable cosmetic visualization and lead-generation tool, and every image it produces is labelled a visualization aid, not a guarantee. We do not claim to be HIPAA-ready, and we do not pretend a marketing widget is a clinical-grade protected-information system. For clinics whose workflows genuinely require a business-associate relationship or guaranteed data residency, we are equally plain: BAA and in-region processing are on our roadmap, not yet available. Saying so clearly is the point — a vendor that hand-waves a HIPAA badge onto a marketing tool is doing you no favours. We would rather tell you exactly what the tool is, so you can use it correctly.
Because the patient-direct widget delivers most of the commercial value — more cosmetic consults — without dragging the clinic into the heaviest compliance territory. The moment a tool moves protected health information through a covered clinical workflow, a business-associate agreement and data-residency guarantees become necessary, and since BAA and in-region processing are on our roadmap, not yet available, the responsible path today is the consumer-facing one. Leading with the widget lets a clinic capture the cosmetic-lead upside now, on honest footing, while the heavier clinical-integration capabilities mature. It is a sequencing decision, and the honest sequence starts with the patient-direct flow.
Plenty, and this is where your own diligence matters. Even for a marketing tool, obtain clear patient consent for using their image, be transparent about what happens to it, and mind the privacy rules that apply where your patients are — some jurisdictions have specific biometric-privacy laws that treat facial images seriously, entirely separate from HIPAA. The widget being patient-initiated does not outsource your responsibility to be straight with patients about their data. Treat consent and transparency as non-negotiable, ask your vendor the plain questions in the privacy questions for any vendor, and consult your own advisor about the laws in your market.
The right answer should be specific and boring, and it is the same standard we hold ourselves to elsewhere: the image is processed transiently to create the preview and is never stored by Smileproof; our AI provider may retain inputs for a limited period (up to 55 days) solely for abuse monitoring under its data-processing terms, and inputs are never used to train models. That transparency is the substance behind the posture — “patient-direct” means little if the data is quietly hoarded. Our plain-language position is on the security page, and the vendor questions worth asking anyone are in the privacy guide.
The regime changes but the honest posture does not. In the United States, HIPAA plus certain state biometric-privacy laws frame the conversation, so leading with a patient-direct marketing flow and clear consent is the sensible path while BAA and in-region processing are on our roadmap, not yet available. Across the Gulf and Levant, different data-protection regimes apply, and the same principles carry: patient-initiated uploads, clear consent, transparent handling, and no overclaiming. In every market the rule is the same — be a marketing tool that tells the truth about itself, get consent, and do not dress a widget up as a clinical system. The universal privacy questions are in the privacy guide.
Keep these straight and the compliance picture stays clean.
Honesty about what a tool is beats a badge that claims what it isn't.
Want the patient-direct widget flow explained for your specific market? book a demo — qualified clinics get a trial set up personally after a short demo.
Book a 20-minute demo and leave with a 30-day pilot — 100 previews and 5 lab reports, no card.
Book a demo →