Privacy Policy

1. About this Privacy Policy

This Privacy Policy explains how Smartmed Solutions Sdn. Bhd. (1415753-T) ("SmartDentist", "we", "us" or "our") collects, uses, discloses, stores and protects personal data when you use the SmartDentist mobile application, related websites, support channels and services.

It applies to account holders, dentists and other professionals, learners, Community participants, mentorship users, Ask Gigi users, event participants and people who contact us. It also explains what happens when a professional submits information about a patient or another person.

SmartDentist is the data user or data controller for the personal data described in this Policy, except where another organisation separately determines how and why it processes data.

Our registered business address is: Unit 3A.03C, Level 3A, Glo Damansara, Jalan Damansara, 60000 Kuala Lumpur, Malaysia.

2. The short version

3. Personal data we collect

3.1 Account and authentication data

When you register, sign in, reset a password or migrate an older SmartDentist account, we may process your email address, password or reset code, title, first and last name, mobile number, member type, acceptance of terms, account and profile identifiers, role, account status, login provider, session tokens, request identifiers and relevant timestamps. Passwords are handled through our authentication service and should not be available to SmartDentist staff in readable form.

3.2 Profile, professional and verification data

Your profile may include your display name, phone number, profile photograph, organisation name, organisation telephone number and address, institution, location, study or professional level, membership tier, Premium status, subscription expiry and account credit balance.

If you choose or are required to verify professional eligibility, we may process your Annual Practising Certificate (APC) or similar professional document, including the selected file, filename, file type, storage path, upload status and timestamps. We use this information to verify professional eligibility, protect restricted services and maintain an audit record of verification.

3.3 Articles, learning and events

We may process the articles and categories you open, article view and like activity, courses and lessons you open, video or lesson play, pause, stop, heartbeat and completion activity, playback position and duration, learning progress, relevant timestamps and client event identifiers. We may also process content search terms. A short list of recent searches may be stored on your device or in your browser for convenience.

If you register for an event, we may process the selected event, registration or reservation status, payment amount and currency, payment source, registration and payment timestamps, and a transaction or fulfilment reference.

3.4 Community

If you use Community, we process the categories and discussions you browse or open; discussion titles, bodies, tags and category; replies; reactions; saved and followed status; participation counts; timestamps; identity mode; reports; blocks; Community policy acceptance; and Community notification and read status.

Anonymous in public does not mean anonymous to SmartDentist. If you post using an anonymous alias, your name is hidden from other Community members as designed. SmartDentist still retains the account and ownership link needed to operate, secure and moderate the Community, respond to reports and enforce its rules.

3.5 Mentorship cases and attachments

When you submit or manage a mentorship case, we may process the case title, type, status, clinical sections and answers, follow-up questions and responses, ratings and comments, assigned dentist and specialist identifiers, audit and moderation information, usage or credit records, timestamps and generated case documents.

Attachments may include photographs, radiographs, scans, reports or other files. Associated file data may include the file name, content type, size, storage reference, verification status and signed access link. Case information may contain health and other sensitive personal data about a patient.

3.6 Ask Gigi and AI-assisted features

When you use Ask Gigi or another AI-assisted feature, we may process your discussion title, prompt and message history, structured responses, patient age and sex, chief complaint, medical history, clinical findings, charting, notes, attachments, feedback rating or comment, usage and credit data, limits and timestamps.

Supported attachments may include images, PDFs and documents. The information you submit is sent through SmartDentist systems and may be processed by an AI service provider so that a response can be generated. Ask Gigi histories may be retained so that you can revisit them and so that we can operate, secure and improve the feature.

3.7 Payments, subscriptions and credits

For Premium subscriptions, mentorship credits and some paid registrations, SmartDentist may send you to an external payment page, including Stripe where shown. The payment provider may receive your email address, payment details, billing information and technical information under its own privacy notice. SmartDentist may receive and retain a purchase-attempt identifier, client reference, transaction or payment reference, amount, currency, payment and fulfilment status, subscription status and credit balance.

SmartDentist does not collect or store your full payment-card number or security code. Temporary purchase-state information or an external payment link may be stored securely on your device or browser so that the app can resume and verify a payment attempt.

3.8 Support, communications and notifications

If you contact us or receive app communications, we may process your contact details, message and attachments, support history, notification topic subscriptions, notification title or content, sender or reference information, delivery or read state, and timestamps. Please do not include patient information in a support request unless it is necessary and you are authorised to disclose it.

3.9 Analytics and technical data

Our native Android and iOS apps use Google Analytics for Firebase to understand whether selected content and features are useful. SmartDentist sends the limited content-interaction events described in section 12. Google Analytics for Firebase also generates basic app-use and technical information, such as an app-instance identifier, user and session statistics, session duration, app launches, opens and updates, device model, operating system, app version and approximate geography.

Our servers and service providers may also receive internet protocol address, app and device information, request and response metadata, timestamps, security events, performance data and error logs when you connect to the service. We use this data to deliver the service, diagnose faults, prevent abuse and protect accounts.

3.10 Device permissions and local storage

The app may request access to your camera, photo library or document picker when you choose a profile photo, a patient case image or another attachment. We access only the item you capture or select through that flow. The current app is not designed to use your microphone for these features, record your screen or take screenshots of your activity.

We use secure device storage or browser storage for items such as session state, recent searches and in-progress purchase information. The web version may also use essential browser technologies needed to keep you signed in and operate requested functions.

4. Patient data and information about other people

Professional responsibility

If you submit information about a patient, colleague or other person, you are responsible for having a valid professional and legal basis to do so and for giving any notice or obtaining any consent required by law, ethics, your employer and professional rules.

Before uploading a mentorship case, asking an AI-assisted question or sharing material in another feature:

• remove names, NRIC or passport numbers, addresses, telephone numbers, email addresses, record numbers and other direct identifiers unless they are strictly necessary and expressly authorised;
• avoid recognisable full-face photographs and identifying image labels unless they are clinically necessary and lawfully authorised;
• use the minimum clinical information needed for the purpose;
• check images and documents for embedded identifiers, labels and metadata; and
• do not treat SmartDentist as the primary or complete patient record.

Where we receive patient data from a professional user, we process it to provide the feature requested, protect the service, meet legal obligations and handle authorised support. A mentorship case may be disclosed to the assigned mentor or specialist and to authorised personnel or processors who need access to operate or secure the service.

5. Why we use personal data

6. When information is required

We identify mandatory fields in the app or at the time of collection. Account and authentication data is required to create and secure an account. Some profile or APC information is needed only for verified or restricted features. Clinical inputs are optional in the sense that you choose whether to use Mentorship or Ask Gigi, but enough information is needed to provide a meaningful response. Payment information is required by the payment provider if you choose a paid service.

If you do not provide required information, we may be unable to register you, verify eligibility, deliver the selected feature, complete a transaction or respond to a request. Community participation, content likes, optional profile information and most communications are voluntary.

7. Legal grounds and consent

We process personal data in accordance with the Malaysian Personal Data Protection Act 2010, as amended, and other applicable law. Depending on the activity, we rely on your consent, the steps needed to provide a service or transaction you request, compliance with legal duties, protection of security and legal rights, and other grounds permitted by law.

Health information and other sensitive personal data require particular care. Where consent is the appropriate legal basis, we will seek the form of consent required by law. A professional user must not submit a patient’s sensitive information without the necessary authority. Withdrawing consent does not make earlier lawful processing unlawful, and it may prevent us from continuing a feature that depends on that information.

8. Who we disclose personal data to

We may disclose personal data only as reasonably necessary for the purposes described in this Policy to:

• authorised SmartDentist personnel, who need it for operations, support, security, finance, verification, moderation or compliance;
• mentors and specialists, assigned to provide or review a mentorship service;
• cloud, database, authentication, hosting and file-storage providers, that run the app and store its data;
• AI processing providers, that process Ask Gigi prompts, clinical context and attachments to generate a requested response;
• Google and Firebase, for the limited app analytics described in section 12 and any configured technical services;
• payment providers, including Stripe where applicable, to host payment pages, process payment information and return transaction status;
• communications, support and notification providers, to deliver operational messages and support;
• app stores, device platform providers and linked third-party services, where needed to distribute the app or open a service you choose;
• professional advisers, insurers, auditors and potential transaction parties, subject to appropriate confidentiality and only when reasonably necessary; and
• courts, regulators, law-enforcement bodies and other authorities, when disclosure is required or permitted by law or needed to protect rights, safety and security.

We do not sell your patient or clinical information. We do not permit service providers to use personal data for their own unrelated purposes merely because they process it for SmartDentist.

9. International transfers

Some service providers, specialists or support operations may process personal data outside Malaysia. This can include cloud, AI, analytics and payment services. The privacy and data-protection laws in another country may differ from Malaysian law.

Before making a cross-border transfer, we will use a mechanism permitted by Malaysian law and take reasonable steps appropriate to the data and risk. This may include assessing the destination and recipient, contractual protections, security controls, limiting access and data, obtaining consent where required, and keeping relevant transfer records. You may contact us for information about the safeguards relevant to your data.

10. Community visibility and moderation

Community discussions, replies, reactions and profile or anonymous presentation may be visible to other Community users according to the feature you choose. Do not post patient data, confidential practice information or personal information that you do not want other members to see.

We may review, restrict, remove or preserve Community content and account information to investigate a report, enforce Community rules, protect users and comply with law. Blocking another member changes your Community experience but may not erase content or records needed for moderation and security.

11. AI-assisted features

Ask Gigi uses automated processing to generate an informational response from the material you submit. Your prompts, clinical context and attachments may be sent to an AI service provider, potentially outside Malaysia, under SmartDentist’s service arrangements. We may keep the conversation and feedback to provide history, maintain safety, investigate problems and improve the service.

AI output is assistive and may be incomplete or wrong. It is not a substitute for examination, professional judgment, diagnosis, treatment planning or emergency care. SmartDentist does not use Google Analytics to collect Ask Gigi prompts, patient details, clinical files or generated answers.

12. Google Analytics for Firebase

The current native Android and iOS apps use Google Analytics for Firebase. The web app does not use this native analytics implementation. Analytics events must never be treated as screenshots: an event is a short structured record that an action occurred.

What SmartDentist deliberately excludes:

• no screenshots, screen recordings or automatic SmartDentist screen-view events;
• no SmartDentist account ID, email address, name, telephone number or custom Google Analytics user ID;
• no patient, clinical, mentorship-case or Ask Gigi content;
• no Community discussion title, body, reply, tag, author, anonymous alias, notification text or search term; and
• no advertising identifiers or advertising-personalisation signals from the app’s custom configuration. Advertising storage, advertising user data, advertising personalisation and personalisation storage are denied.

Google may process app analytics data in accordance with its terms and privacy information. The SmartDentist implementation is designed for aggregate product measurement, not advertising profiles. Analytics failures do not prevent you from opening the selected content or feature.

13. Retention and deletion

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including to provide an active account, preserve learning or case history requested by you, complete and reconcile transactions, investigate abuse, comply with legal or professional record-keeping requirements, resolve disputes and enforce agreements.

Retention periods differ by data type and system. We consider the sensitivity and amount of data, the risk of harm, the purpose, whether it can be achieved another way, contractual requirements and applicable law. When data is no longer required, we delete it, de-identify it or securely isolate it until deletion from backups is practicable. Legal holds, security investigations and mandatory records may delay deletion.

If you close an account or request deletion, some information may remain for the periods required for transaction, audit, moderation, fraud-prevention, legal or backup purposes. Public Community content may be de-identified rather than removed where lawful and necessary to preserve the integrity of a discussion.

14. Security

We use reasonable organisational, technical and physical safeguards appropriate to the nature of the data. Measures may include access controls, authentication, secure transmission, protected device storage, signed and time-limited file access, monitoring, backups, supplier controls and procedures for responding to suspected incidents.

No online service can guarantee absolute security. You are responsible for using a strong password, protecting your device and account, signing out of shared devices, checking recipient and file contents before submission, and notifying us promptly if you believe an account or patient information is at risk.

Where a personal data breach is notifiable under Malaysian law, we will notify the Personal Data Protection Commissioner and affected individuals within the applicable requirements, including the statutory timeframes that apply to the incident.

15. Your choices and rights

Subject to the Malaysian Personal Data Protection Act and any permitted exceptions, you may:

• ask whether we hold your personal data and request access to it;
• ask us to correct personal data that is inaccurate, incomplete, misleading or out of date;
• withdraw consent where processing depends on consent;
• ask us to stop or limit certain processing, including direct marketing;
• request transmission of personal data to another data controller where the statutory right to data portability applies and the transfer is technically feasible and compatible;
• request account closure or deletion, subject to information we must or may lawfully retain; and
• raise a concern with us or lodge a complaint with the Malaysian Department of Personal Data Protection.

Send a request to support@smartdentist.app. To protect you and others, we may verify your identity and authority before acting. Please describe the account, data or feature concerned. We will respond within the period required by applicable law. A request may be refused or limited where law permits, and we will explain the reason where required.

16. Children

SmartDentist is intended for dentists, dental professionals, eligible learners and other users capable of forming a valid account agreement. It is not directed to children. A professional must not create an account for a child or submit a child patient’s information unless there is a lawful professional purpose, appropriate authority from a parent or guardian where required, and proper de-identification and safeguarding.

17. Third-party services and links

The app may open a third-party website, payment page, app store or other service. The third party’s own terms and privacy notice apply to its independent processing. We encourage you to review them before providing information. SmartDentist is not responsible for a third party’s independent privacy practices.

18. Changes to this Policy

We may update this Policy when the app, our providers or the law changes. We will publish the revised version with a new effective date and, where appropriate, give notice in the app or by another reasonable method. If a change requires new consent, we will request it before relying on that consent.

19. Contact us

You may also contact the Malaysian Department of Personal Data Protection through its official website at https://www.pdp.gov.my/.