Privacy Policy
This Privacy Policy explains how HAI (“we”, “us” or “our”) collects, uses, stores, shares and protects information in connection with the Smiles Craft mobile application (the “App”) and the related services available at Smiles Craft (together, the “Service”).
Smiles Craft is a professional clinic-management tool used by authorized dental clinic personnel — for example clinic owners, dentists, assistants, cashiers and administrators. It is not a consumer or patient-facing app and is not intended for use by the general public.
This policy addresses two groups of people:
Each clinic that uses the Service is responsible for the patient information it enters and for obtaining any consents required under applicable law before recording that information.
We collect only the information needed to operate the Service. This includes:
We use the information described above to:
We do not use patient health information for advertising or for any purpose unrelated to providing the Service to the clinic.
Where data-protection law (such as the GDPR or equivalent local law) applies, we rely on the following legal bases: performance of our contract with the clinic; our legitimate interests in operating and securing the Service; compliance with legal obligations; and, where required for health information, the clinic’s role as a healthcare provider and any consent it obtains from patients. The clinic acts as the controller of the patient information it enters, and we act as a processor handling that information on the clinic’s behalf.
We share information only as needed to run the Service:
| Recipient | Purpose |
|---|---|
| Hosting and database infrastructure provider | Storing and processing Service data on secure servers. |
| Push-notification delivery services (the platform’s push service and Apple / Google notification gateways) | Delivering notifications to your device. |
| Messaging provider used for appointment reminders | Sending reminder and confirmation messages the clinic chooses to send. |
| Authorized staff within the same clinic | Collaborating on scheduling, care and billing for that clinic’s patients. |
These providers may process information only on our instructions and are bound to protect it. We may also disclose information if required to do so by law, to comply with a legal process, to protect the rights, property or safety of patients, staff or the public, or in connection with a merger, acquisition or reorganization (subject to this policy). Information is kept separated by clinic — one clinic cannot access another clinic’s data.
No method of transmission or storage is completely secure, but we work to protect information using measures appropriate to its sensitivity.
We keep information for as long as an account or clinic relationship is active and for as long as needed to provide the Service. Clinical and financial records may be retained for longer where the clinic is required to keep them under applicable healthcare, tax or professional record-keeping laws. When information is no longer needed, we delete it or anonymize it. Specific retention periods are set by the clinic in line with its legal obligations in Lebanon.
Depending on where you live, you may have the right to access, correct, update, export, restrict or delete personal information, to object to certain processing, and to withdraw consent where processing is based on consent.
We will not discriminate against you for exercising any of these rights.
You can request deletion of your account and associated personal information at any time. To do so, email j.elachkar@haitech.ltd from the address associated with your account, or use the account-deletion request page at Account Deletion.
Upon a verified request we will delete your account and the personal information we hold about you, except where we are required or permitted by law to retain it (for example, clinical or financial records the clinic must keep for a legally mandated period). We will confirm once your request has been completed.
Patient records are deleted or amended at the direction of the responsible clinic; patients should direct deletion requests to their clinic.
With your permission, the App sends push notifications about appointments and clinic activity. You can turn notifications off at any time in your device settings. The clinic may also send patients appointment reminders and confirmations; those messages are sent only when the clinic enables them and use the phone number stored in the patient’s record.
The App is intended for use by authorized clinic staff, who are adults; it is not directed to children and we do not knowingly allow children to create accounts. Patient records managed in the App may relate to patients of any age, including minors. Such records are entered and controlled by the clinic in its capacity as a healthcare provider, which is responsible for obtaining any parental or guardian consent required by law.
Information may be stored and processed in Lebanon and in other countries where we or our service providers operate. Where information is transferred across borders, we take steps to ensure it remains protected in accordance with this policy and applicable law.
We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify users within the App or by other means. Your continued use of the Service after an update means you accept the revised policy.
If you have questions or requests regarding this policy or your information, contact: