Privacy Policy For Our Orthodontic Practice

Effective Date: 8/10/2026
Last Updated: 8/10/2026

1. Who We Are

SmileRight Braces ("we," "us," "our") is an orthodontic practice located at 17375 Tomball Pkwy Ste 2B, Houston, TX 77064.
This Privacy Policy applies solely to SmileRight Braces's website at smilerightbraces.com and our in-office operations.
This Policy describes how we collect, use, disclose, and protect information about visitors to our website and patients of our practice. It works alongside, and does not replace, our HIPAA Notice of Privacy Practices (see Section 8), which governs our use of Protected Health Information specifically.

2. Information We Collect

2.1 Information you provide directly

• Contact information (name, phone, email, mailing address)
• Appointment/booking details submitted through our online scheduling system
• Health-related information you choose to share when booking a consultation or during treatment (e.g., reason for visit, insurance information, treatment history)
• Communications you send us (contact forms, email, text messages, phone calls, chats)

2.2 Information collected automatically

When you visit our website, we and our service providers automatically collect:
• IP address, browser type, device type, operating system
• Pages visited, time on page, referring website/URL
• Approximate location (city/region level, derived from IP)
• Marketing attribution data: UTM parameters, Google Click ID (gclid), Meta Click ID (fbclid), Microsoft Click ID (msclkid), and which ad campaign, if any, brought you to our site
• Cookie and local storage identifiers (see Section 4 - Cookies)

2.3 Information from third parties

We may receive information about you from:
• Advertising platforms (Meta, Google, Microsoft) when you interact with our ads
• Analytics providers
• Referral sources (if you were referred by another patient or provider)

3. How We Use Your Information

We use the information above to:
• Schedule and manage appointments
• Communicate with you about your care, appointments, and account
• Process payments and insurance claims
• Improve our website and services
• Measure and optimize our marketing campaigns (only with your consent - see Section 4)
• Comply with legal and regulatory obligations
• Protect against fraud and security threats

We do not sell your personal information. We do not use your specific health condition or treatment information to target advertising to you or others.

4. Cookies, Pixels & Tracking Technologies

We use the following tools on our website. Non-essential tools below only run after you provide consent through our cookie consent banner. You can change your choice at any time using the "Cookie Settings" link at the bottom of any page.

How consent works: On your first visit, no marketing or analytics cookie/tag fires. You will see a banner offering to Accept All, Reject Non-Essential, or Customize your choices. Google's Consent Mode framework and our own tag-gating logic ensure Google and Meta tags do not activate until you've made a choice, and only activate the specific categories you approved.

Do Not Track: Our website does not currently respond to browser "Do Not Track" signals, but our consent banner provides equivalent control over tracking regardless of browser signal.

5. Our Online Scheduling System

We use Acuity Scheduling, a third-party appointment booking service, to manage online consultation requests. When you book through our site:
• Your booking information is submitted directly to Acuity's platform (a Business Associate under HIPAA - see Section 8).
• If you previously consented to marketing cookies, marketing attribution fields (which ad or campaign brought you to us) may be attached to your booking record for internal reporting purposes. This information is used only to understand which of our marketing campaigns lead to appointments, and is not shared back with advertising platforms in a way that identifies your specific health information.
• If you have not consented to marketing cookies, these fields are simply left blank. Your ability to book an appointment is never affected by your cookie choices.

6. SMS / Text Messaging

By providing your mobile phone number and opting in (via our online form, over the phone, or in office), you consent to receive text messages from SmileRight Braces regarding:
• Appointment confirmations and reminders
• Account and billing information
• Promotional offers and marketing messages

Message frequency varies based on your interactions with us (typically 1-4 messages per month for appointment-related texts). Message and data rates may apply. Carriers are not liable for delayed or undelivered messages.

To opt out at any time: Reply STOP to any message. You will receive one final confirmation text, after which you will no longer receive messages from this number. You may resume messages at any time by opting in again through our website or in office.

For help: Reply HELP or contact us at 281-699-0234 or info@smilerightbraces.com.

Consent is not a condition of purchase or treatment. You are never required to opt into text messaging to schedule or receive care from us.

We do not share your mobile number with third parties for their own marketing purposes. Text messaging opt-in data is not shared with or sold to any third party.

7. Business Associates & Service Providers

As a healthcare provider, we are required by HIPAA to have a signed Business Associate Agreement (BAA) with any vendor that has access to Protected Health Information (PHI) on our behalf. The following vendors process information as part of delivering our services:

We do not sell, rent, or trade your personal information to any third party for their independent marketing purposes.

8. HIPAA - Protected Health Information

SmileRight Braces is a HIPAA Covered Entity. Our full Notice of Privacy Practices, which describes in detail how we use and disclose Protected Health Information (PHI) and your rights regarding your health records, is available at check-in and is a separate document from this Privacy Policy.

In summary, under HIPAA you have the right to:
• Request access to and copies of your health records
• Request corrections to your health records
• Request restrictions on certain uses/disclosures of your PHI
• Receive an accounting of certain disclosures of your PHI
• File a complaint with us or with the U.S. Department of Health and Human Services if you believe your privacy rights have been violated, without retaliation

To exercise any of these rights, contact our Privacy Officer, JOHN ANDREWS, at privacy@smilerightbraces.com or 281-699-0234.

Note on website tracking and PHI: Information you enter into our public website (e.g., browsing our services pages) before you've identified yourself as a patient is generally not treated as PHI. Information you submit through our booking form, once tied to a scheduling request, is protected under this section and Section 7.

9. How We Share Your Information

We share information only:
• With the Business Associates listed in Section 7, solely to provide our services
• With your insurance provider, to process claims, if applicable
• When required by law (court order, subpoena, public health reporting)
• With your explicit consent
• In connection with a business transfer (merger, acquisition, or sale of practice assets), in which case successor entities would be bound by this Policy's commitments regarding your information

We do not sell your personal information as defined under Texas, California, or other applicable state privacy law.

10. Data Retention

We retain patient health records for the period required under Texas law (generally a minimum of 7 years for adult patients, and until age 21 or longer for minor patients, per Texas Medical Board and Texas Dental Board recordkeeping rules - confirm current requirement with counsel, as retention periods for orthodontic records can differ from general medical). Marketing attribution and website analytics data (non-health-identifying) is retained for up to 25 months, consistent with standard analytics retention practices, unless you request earlier deletion under Section 11.

11. Your Privacy Rights

11.1 Texas residents (Texas Data Privacy and Security Act)

If you are a Texas resident, you have the right to:
• Confirm whether we process your personal data, and access it
• Correct inaccuracies
• Delete your personal data
• Obtain a portable copy of your data
• Opt out of the processing of your personal data for targeted advertising, sale, or certain profiling
• Appeal a denial of any of the above rights

To exercise these rights, contact us at privacy@smilerightbraces.com. We will respond within 45 days. If we deny your request, you may appeal by contacting privacy@smilerightbraces.com with "Privacy Appeal" in the subject line; we will respond to appeals within 60 days. If your appeal is denied, you may contact the Texas Attorney General.

11.2 California residents

If you are a California resident, you have the rights to know, delete, correct, and opt out of the sale or sharing of your personal information, and to non-discrimination for exercising these rights. We do not sell personal information. To exercise these rights or to submit a "Do Not Sell or Share My Personal Information" request, contact privacy@smilerightbraces.com or use the cookie consent tool on our website to withdraw marketing/analytics consent at any time.

11.3 Other states

If you are a resident of a state that has enacted a comprehensive consumer privacy law (including but not limited to Colorado, Connecticut, Virginia, Utah, Oregon, Montana, or others as may apply from time to time), you may have similar rights to those described above. Contact privacy@smilerightbraces.com to exercise these rights, and we will honor applicable state requirements based on your state of residence.

11.4 Consumer health data

Some states (e.g., Washington's My Health My Data Act, Nevada) provide specific protections for "consumer health data." We do not use precise geolocation to infer visits to our physical office for advertising purposes, and we do not use geofencing technology around health facilities as regulated by these laws. To the extent these laws apply to you, you have the right to withdraw consent to processing of consumer health data and to request deletion, by contacting privacy@smilerightbraces.com.

12. Children's Privacy

Our website is not directed at children under 13, and we do not knowingly collect personal information from children through our website without parental involvement. Orthodontic treatment for minor patients is provided with the consent and involvement of a parent or legal guardian, who provides and controls the minor's information submitted to us.

13. Data Security

We use administrative, technical, and physical safeguards designed to protect your information, including encrypted data transmission, access controls limiting employee access to PHI on a need-to-know basis, and vendor vetting for HIPAA compliance. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

14. Third-Party Links

Our website may contain links to third-party websites (e.g., insurance providers, financing partners). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies independently.

15. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top reflects the most recent revision. Material changes affecting how we handle previously collected information will be communicated via a notice on our website or, where required by law, by direct notice to you.

16. Dispute Resolution

Any disputes arising from your use of our website or this Privacy Policy are subject to the arbitration and dispute resolution provisions in our Terms and Conditions, available at smilerightbraces.com/terms-and-conditions.

17. Contact Us

SmileRight Braces
17375 Tomball Pkwy Ste 2B, Houston, TX 77064
Phone: 281-699-0234
Email: privacy@smilerightbraces.com
Privacy Officer: JOHN ANDREWS