This Privacy Policy explains how Smila Aligners Ltd ("Smila", "we", "us", "our") collects, uses, stores and protects personal data when you visit smila.uk or interact with us through this website.
We are committed to protecting your privacy and handling your data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
The data controller responsible for your personal data is:
- Smila Aligners Ltd
- Company number: 16991984 (registered in England & Wales)
- Registered office: 3-4 Norfolk Place, London, W2 1QN, United Kingdom
- Email: info@smila.uk
If you have any questions about this policy or how we handle your data, please contact us at info@smila.uk.
2. What data we collect
We collect the following categories of personal data:
2.1 Information you give us directly
When you submit our contact form, we collect:
- First and last name
- Email address
- Phone number (optional)
- How you heard about us (optional)
When you email us or book a consultation through Google Calendar, we collect your name, email address and required phone number, plus any optional context you choose to share. Google Meet is used for the video consultation.
2.2 Information you share through our enquiry assistant
If you choose to use our website enquiry assistant, we collect your consent choice, the enquiry topic you select, your answers, your name and contact details, your preferred reply method, and the conversation transcript. Because an enquiry may concern dental treatment, your answers may include health information that you choose to provide.
We also record the page and referring URL, browser user agent, session timestamps, and a one-way hash of your IP address. The IP hash is used only to prevent abuse and cannot be used by the assistant to recover your original IP address.
2.3 Information collected automatically
When you visit the site, our hosting provider (Vercel) logs technical data including:
- IP address
- Browser type and version
- Operating system
- Pages visited and time of visit
- Referring URL
This data is used for security, debugging and aggregate analytics. We do not use third-party tracking cookies. See our Cookie Policy for details.
3. How we use your data
We process your personal data for the following purposes:
- To respond to your enquiry and provide the information you've requested
- To send you a confirmation email acknowledging your contact
- To contact you about a free consultation if you've requested one
- To route enquiry-assistant messages to our patient care team and preserve a record of your consent
- To protect the enquiry assistant against spam, automated traffic and other abuse
- To keep internal records of our communications with you
- To improve our website, services and customer experience
- To comply with our legal and regulatory obligations
4. Legal basis for processing
We rely on the following legal bases under UK GDPR Article 6:
- Consent (Art. 6(1)(a)) — when you submit the contact form or confirm the privacy notice before entering your contact details in the enquiry assistant, you consent to us using your details to reply.
- Explicit consent (Art. 9(2)(a)) — before you provide contact details or add treatment or health information in your own words through the enquiry assistant, we ask you to confirm your explicit consent.
- Legitimate interests (Art. 6(1)(f)) — to operate, secure and improve our website, and to respond to enquiries about our service.
- Legal obligation (Art. 6(1)(c)) — to comply with applicable laws, including responding to lawful requests from authorities.
5. Who we share your data with
We do not sell your personal data. We share it only with trusted service providers who process it on our behalf, under written data processing agreements:
- Vercel Inc. — website hosting and infrastructure. Data may be processed in the United States under appropriate safeguards (Standard Contractual Clauses).
- Google LLC (Google Workspace, Google Calendar and Google Meet) — email delivery, appointment scheduling and video consultations.
- Elestio GmbH — hosts our form-processing automation (n8n) in Germany (EU).
- Wise Solutions — operates the Smiles Tracker enquiry and lead-management service on our behalf.
- Supabase Inc. — provides the European-hosted database infrastructure used by Smiles Tracker.
We may also disclose your data when required by law, court order, or to protect our legal rights or the safety of others.
6. International data transfers
Some of our service providers (notably Vercel and Google) may process your data in the United States. Where this happens, we rely on the UK's data adequacy decision for the EU (where applicable) and on Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO) as the safeguard mechanism.
7. How long we keep your data
We keep your personal data only as long as necessary for the purposes set out above:
- Contact form submissions: up to 24 months after your last contact with us, unless you become a customer or ask us to delete it sooner.
- Enquiry assistant records: active access to an incomplete session expires after 30 days. Enquiry details, consent records and completed conversation transcripts may be kept for up to 24 months after your last contact, unless you become a customer or ask us to delete them sooner.
- Email correspondence: up to 6 years where required for tax and accounting records.
- Server logs: up to 30 days, then anonymised or deleted.
8. Your rights
Under UK GDPR, you have the following rights regarding your personal data:
- Right of access — to ask for a copy of the data we hold about you.
- Right to rectification — to correct inaccurate or incomplete data.
- Right to erasure ("right to be forgotten") — to ask us to delete your data, subject to legal exceptions.
- Right to restrict processing — to limit how we use your data.
- Right to data portability — to receive your data in a structured, machine-readable format.
- Right to object — to processing based on legitimate interests.
- Right to withdraw consent — at any time, without affecting prior processing.
To exercise any of these rights, email info@smila.uk. We will respond within one month.
9. Your right to complain
If you believe we've handled your data incorrectly, you have the right to complain to the UK supervisory authority:
- Information Commissioner's Office (ICO)
- Website: ico.org.uk
- Phone: 0303 123 1113
We'd appreciate the chance to address your concerns directly first — please contact us at info@smila.uk.
10. Security
We take appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure or destruction. This includes encrypted connections (HTTPS), access controls on our internal systems, and use of reputable service providers.
No internet transmission is ever 100% secure, but we use industry-standard practices to keep your data safe.
11. Children's data
Smila's clear aligner treatment is intended for adults (18+). We do not knowingly collect personal data from children under 18 through this website. If you become aware that a child has submitted data to us, please contact info@smila.uk and we will delete it.
12. Cookies
We use a small number of essential cookies only. We do not use third-party tracking, advertising, or analytics cookies that identify you personally. See our Cookie Policy for full details.
13. Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. For material changes that affect your rights, we will take reasonable steps to notify you (for example, via a notice on this site or by email if we have one for you).
14. Contact
Questions about this policy or your data? Email info@smila.uk.