Tasty Tech Ltd. (“Tasty Tech,” “we,” “us,” “our,” and terms of similar meaning) provides the website at www.smiledesignerpro.com (the “Site”), the Smile Designer Pro desktop and iPad applications (the “App”), cloud storage and related processing (the “Cloud”), and related support (collectively, the “Services”). For paid Customers, the Cloud is required to use the App. Free users may design only sample cases locally. This privacy policy (this “Privacy Policy”) describes how we collect, use, disclose, and retain personal information in connection with the Services.
In this Privacy Policy:
We act as a controller of Customer account, billing, device, and website analytics information. We act as a business associate (and, where applicable, a processor) of Patient Data that you submit to the Services. U.S. covered entities must have a business associate agreement (“BAA”) with us before placing PHI in the Services. Request a BAA at privacy@tastytech.ca.
Your use of the Services is also governed by our Terms of Service, available at https://www.smiledesignerpro.com/terms, which are incorporated by reference. Visiting the Site is not consent to use PHI, to send you commercial email, or to set non-essential advertising cookies.
This Privacy Policy applies to personal information we process through the Site, the App, the Cloud (including Firebase / Google Cloud), account administration, billing, and customer support. It does not apply to third-party websites or services that we do not control, even if they are linked from the Services.
By registering for an account, providing personal information through the Services, or otherwise agreeing to this Privacy Policy, you consent to our collection, use, and disclosure of that information for the purposes in this Privacy Policy or identified to you at the time of collection. Any secondary use will be only with your consent, as described in our Terms of Service, or as required by law.
Providing personal information is voluntary, but if you withhold it we may not be able to provide some or all of the Services. You may withdraw consent or opt out at any time, including from our marketing list, by contacting us as set out in Section 18. Withdrawal does not affect processing that is required by law or needed to administer your account. Revoking consent may mean you cannot use certain features.
Patient Data, including photographs and face data, is processed on your instructions. You are responsible for obtaining any consent required from the patient or other individual whose likeness or information you submit. See Sections 6 and 7.
We collect the following categories of information.
Account and profile. Name, email address, password, phone number, country, and, if you provide them, address, specialty, age range, and gender. We also record IP address, inferred country (GeoIP), sign-in timestamps and IP addresses, and device identifier, name, model, and platform when you use the App or API.
Billing and payments. Stripe customer and subscription identifiers, card brand, last four digits, and billing country and state or province. Card numbers and CVCs are tokenized by Stripe in the browser. We do not store full payment card numbers on our servers.
Usage and device. Pages viewed, referring URLs, browser and device information, App feature events (via Mixpanel), crash and error reports, and support or cancellation-survey responses.
Patient Data (on your instruction). When a paid Customer creates or opens a case, we process patient names, concerns, notes, facial and dental photographs, smile simulations and design files, and derived face-landmark data in the Cloud. Free users may design only sample cases locally and do not submit Patient Data. See Sections 6 and 7.
Communications. Emails and other messages you send us, including support requests.
We collect information from you and your authorized users; from your devices when you use the Site, App, or API; from payment processors; from analytics and advertising technologies described in Section 8; from GeoIP lookup of your IP address; and from you when you contact support.
We use Customer personal information to:
These purposes are the identified purposes for collection under Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”). Where the EU/UK GDPR applies, the legal bases are noted above. Special-category health data (GDPR Art. 9) is processed only as a processor / business associate on your instructions and, for U.S. PHI, under a BAA.
We do not use Patient Data or PHI for marketing, advertising, sale, or unrelated product analytics.
Cloud storage and processing are an intrinsic part of the App. Paid Customers cannot use the software without the Cloud. Free users may design only sample cases locally. Patient Data from paid use is transmitted to and stored or processed on Google Cloud / Firebase (Storage, Firestore, and Cloud Functions) as described in Section 7.
For that Patient Data:
What we collect. Face data includes facial geometry, facial landmarks, and dental features derived from photographs of a patient’s face and mouth that you capture or upload. We do not collect face data in the background or without your action in the App.
How we collect it. Face data is generated when a paid Customer opens, captures, or uploads a case photo and the App needs landmarks to place a design. The photograph is sent to our Cloud Function for that processing.
How we use it. We use face data only to identify landmarks, support smile design and simulation in the Services, and provide, maintain, and support those features. We do not use face data to train third-party foundation models or for marketing.
Who processes it. Landmark detection runs in our Cloud Function using Tasty Tech’s own code. Google Cloud hosts that function as infrastructure. We do not use Google AI models or any third-party AI service (including OpenAI or similar providers) to process Patient Data, photographs, or face data. Google Cloud does not use that data for its own purposes. See Google Cloud’s privacy resources.
Retention. Face data is retained with the related case as described in Section 10. You may request deletion as set out in Section 18.
A cookie is a small file stored by your browser. The Site uses cookies and similar technologies to operate the Site and keep you signed in, to measure how the Site is used, to measure advertising conversions, and to reduce automated abuse on signup. Some are set by us (session management and sign-in persistence) and some by our service providers, including Google Analytics, Google Ads, and Google reCAPTCHA.
The App does not use browser cookies. It sends product-analytics events to Mixpanel (feature usage, not Patient Data).
Most browsers let you restrict or delete cookies. If you disable cookies, parts of the Site may not work. For more about cookies, see aboutcookies.org. You can also use Google ad settings and aboutads.info. Essential session cookies are required for the Site to function. We do not currently display a cookie-consent banner.
We do not sell personal information. We share Customer personal information with service providers who process it on our instructions. When we do, we require those providers to be bound by obligations consistent with this Privacy Policy.
We may also disclose information if required by law, legal process, or government request; to protect the rights, property, or safety of Tasty Tech, our users, or others; or to a buyer or its agents in a sale of our business, subject to customary confidentiality arrangements and, for PHI, HIPAA requirements.
If you are a California resident, our use of Google advertising cookies may be “sharing” for cross-context behavioral advertising under the CCPA/CPRA. You may opt out via the links in Section 8 or by emailing privacy@tastytech.ca.
We retain Customer account information for the life of the account and as needed afterward for legal, tax, accounting, dispute, and security purposes. Billing records are kept as required by law. Analytics data is retained according to each vendor’s settings. Patient Data, including face data and other Cloud case data, is retained while your paid subscription (or Lifetime license) is active. If you cancel a subscription and the account stays inactive, we delete that Cloud data twelve (12) months after cancellation. You may request earlier deletion. Residual copies may remain in backups for a limited period after that. We will return or destroy PHI as required by the applicable BAA and HIPAA.
There is no in-product control to delete an entire account. To request deletion of your account or Patient Data, email privacy@tastytech.ca. You can edit some profile fields in your account area. Technical delays may apply, and residual copies may remain in backups for a limited time.
We use commercially reasonable safeguards for Customer information, and for PHI we apply safeguards aligned with the HIPAA Security Rule, including access controls, encryption in transit, and encryption at rest on our cloud providers. No method of transmission or storage is 100% secure. We cannot guarantee absolute security of information you transmit to us.
We will comply with applicable law regarding unauthorized access to or disclosure of personal information, including PIPEDA breach-notification duties. If we discover a breach of unsecured PHI, we will also notify you without unreasonable delay so you can meet your HIPAA notification duties.
Under PIPEDA you may request:
You may also request correction of inaccuracies and, where the law allows, deletion. Depending on where you live, you may have further rights under the GDPR, UK GDPR, LGPD (Brazil), or CCPA/CPRA, including to withdraw consent, object to or restrict certain processing, obtain a portable copy, appeal a refusal, or (in California) opt out of “sharing” for cross-context advertising. We will not discriminate against you for exercising CCPA rights.
To exercise these rights, email privacy@tastytech.ca. We may need to verify your identity. Patient Data requests from a patient should go to the Customer (the practice). We will assist the Customer as required by the BAA or applicable law.
When you register, we add your email to our product newsletter. You can opt out in your Profile, by using the unsubscribe link in our emails, or by writing to privacy@tastytech.ca. You cannot opt out of emails needed to administer your account (for example, billing, security, and service notices). Canada’s Anti-Spam Legislation (“CASL”) applies to our commercial electronic messages.
Tasty Tech is in Canada. Personal information may be stored or processed outside your province of residence and in a country other than the country in which you provided it, including the United States (Google Cloud / Firebase, Stripe, and the analytics and advertising vendors in Section 8). Where required, we use appropriate safeguards for those transfers. Information processed in another jurisdiction may be subject to the laws of that jurisdiction, including lawful access by local authorities.
The Services are for dental professionals and are not directed to children under 18. We do not knowingly collect personal information from children as consumers. If a Customer stores information about a minor patient, the Customer is responsible for any required parental notices and consents.
The Services may link to other websites and services. We are not responsible for their content or privacy practices. Review their policies before providing information to them. This Privacy Policy applies only to the Services.
We may revise this Privacy Policy from time to time. The “last updated” date and version below will change when we do. For material changes, we will notify you at the email address on your account. Continued use of the Services after the effective date constitutes acceptance of the revised Privacy Policy, except where applicable law requires a different form of consent. If you do not agree, stop using the Services and request account deletion.
Questions, access or deletion requests, withdrawal of consent, BAA requests, and privacy complaints:
Attn: Privacy Officer
Tasty Tech Ltd.
942 Shaw Street
Toronto, Ontario M6G 3M6
Canada
Last updated on September 11, 2026
Version 1.7