Security and privacy, built into SmileSort.

Clinical data is encrypted in transit — every page is served over HTTPS only — and at rest, with AES-256.

Sessions are verified against the identity provider on every request, not just decoded from a cookie — a revoked or expired session can't be replayed.

Every table and every photo file is protected by rules in the database itself: anything done on a dentist's behalf reaches their own practice's data and nothing else, whatever the application asks for. The few server tasks that run without a signed-in dentist — opening a share link, the nightly clean-up — are limited to one practice in code.

A share link uses a 192-bit random token, opens only the folders or photographs it was created for, stops working after 7 days unless you extend it, and can be revoked at any time.

No SmileSort tool — including our internal admin portal — can show our team your patients' photographs, folders or notes; that's enforced in the database, not just hidden in the interface. Direct access to the production database is limited to SmileSort's co-founders.

The database is backed up daily, with a week of backups kept. Photograph files are not currently covered by a separate file-level backup — a gap we've assessed and disclose rather than assume away.

SmileSort's data protection programme is built around UK GDPR, with a Data Protection Impact Assessment (signed September 2026) and a Record of Processing Activities, both kept internally.

SmileSort Ltd's registration with the Information Commissioner's Office is being processed. The registration number will be published here once it's issued.

Your practice determines why clinical photographs are processed; SmileSort processes that data to provide the service, as your processor. SmileSort separately acts as controller for its own account and billing information.

AI classification never receives a patient name, date of birth or other structured identifier — only the photograph itself. Location data in a photograph's file is never read.

Deleted records stay in Trash for 28 days, then are permanently removed. A cancelled account stays read-only and exportable for 30 days; then every patient record, photograph and login is permanently deleted. Billing records stay with Stripe, as tax law requires, and usage statistics are kept only in anonymous form. Your practice remains responsible for its own clinical record-keeping obligations.

Every filed photograph, patient record and folder can be exported as a single archive at any time, including during the 30 days after cancelling — you're not locked into SmileSort to keep your own records.

Anthropic (AI classification), Supabase (database & storage), Cloudflare (hosting), Stripe and Resend (billing and email — no patient data) — every one individually checked, none holding patient data outside the UK/EU without an EU SCC + UK Addendum transfer mechanism in place.

SmileSort's AI recognises which standard view a photograph is — an upper occlusal, a smile, a left buccal — and groups photographs taken at the same appointment. That's how it knows where to file them. It doesn't assess the teeth, detect conditions, measure anything or suggest a diagnosis.

Sharing sends photographs to a lab or colleague as you see them in SmileSort, through a secure link that expires. The file is the one you stored; a rotation or flip you applied travels with it as the standard orientation tag that photo software reads. SmileSort adds no interpretation or annotation.

SmileSort doesn't recommend treatment, highlight areas of concern or automate clinical decisions. A photograph filed in the wrong place is a filing error you can correct, not a clinical output.

Before any new AI feature is built, it's checked against SmileSort's intended purpose. Anything that would interpret the clinical content of a photograph would need a fresh regulatory assessment first.

We're putting the NHS clinical risk management standard for health software in place, led by co-founder Dr Abdelrahman Mohamed, a GDC-registered dentist, as Clinical Safety Officer. It covers the ways a filing or sharing mistake could affect a patient's care — a photograph filed to the wrong patient, or shown the wrong way round.