Privacy Notice

Who we are

Smartchair.AI Inc., doing business as SmartChair.AI, is a Delaware corporation headquartered in Waltham, Massachusetts. We make a retrofit sensor and cloud platform that measure whether a dental chair is occupied, so practices and groups can see actual chair time across their locations.

What we collect on the website

Information you give us:

• Demo bookings: HubSpot hosts our scheduling page and collects your name, email address, selected meeting time and any other details you choose to provide. We use this information to arrange your demo and manage the business relationship.
• Email: we receive your email address, message and any information you choose to send to a smartchair.ai address. Email is also available if you prefer not to use the scheduling page.
• Online orders: We collect the signer’s name and business contact information, practice and billing details, installation locations and contacts, chair quantities, and installation preferences. We also retain the order form, the documents accepted, the typed signature, acceptance time, IP address and browser information as evidence of the transaction.

Our website links to the HubSpot booking page. That page has its own privacy and cookie controls; our website cookie choice does not control the external booking page.

Information collected automatically:

• After you accept analytics cookies, Google Tag Manager loads Google Analytics to record pages visited, referral information, browser and device type, and approximate location derived from your IP address. We do not see your full IP address in Analytics reports.
• Hosting and security providers process technical information, such as IP addresses and request details, to deliver the website and protect it from abuse. This essential processing is separate from optional analytics.

If you decline analytics or your browser sends Global Privacy Control, we do not load Google Tag Manager. Booking links and email remain available.

What the SmartChair.AI platform collects

The sensor service collects chair-occupancy readings, timestamps and device identifiers. It also processes sensor and operating information needed to run and support the service, such as device status and firmware information.

No cameras, no microphones, no patient identifiers. The sensor cannot tell who is in the chair, what procedure is under way, or what was said.

For dashboard access we hold each user's name, work email, role and sign-in activity. Customers may provide production summaries for their reports. Those summaries remain customer data and are handled under the customer's agreement. Any use beyond that customer's reporting, including model development or combined analysis, requires permission under that agreement and appropriate data protections.

Do not submit patient records through our website, scheduling tools, email or an unapproved connection. Patient-linked processing requires an agreed data scope, the necessary agreements, including a Business Associate Agreement where applicable, and appropriate safeguards before it begins.

How we use information

• To answer demo requests and questions, and to schedule and run demos.
• To prepare offers, administer orders and payments, arrange installation, maintain acceptance records, and send order and account communications.
• To provide, operate, secure and improve the platform and the website within the permissions in the applicable agreements.
• To interpret sensor readings using machine learning. Additional models relating chair time to production or supporting scheduling suggestions may use customer data only where the applicable agreement permits that use.
• To send service messages about a customer account. We only send marketing email if you asked for a demo or opted in, and every marketing email carries an unsubscribe link.
• To understand how the website is used, in aggregate, when you have accepted analytics cookies.
• To meet legal obligations and enforce our agreements.

Before combining customer data for model development, we require permission for that purpose and a documented method to prevent identification of patients and practices. Removing names alone is not sufficient. This notice does not authorize use of protected health information for model training or expand permissions for data already collected.

We do not sell personal information or customer data, and we do not share personal information for cross-context behavioral advertising. Permission to provide or support our service does not include permission for a provider to use customer data to train its own models.

Who we share it with

• Service providers: Amazon Web Services for platform hosting and analytics infrastructure; Cloudflare for website delivery and protection; HubSpot for demo scheduling and business-contact management; Google for website analytics, email and meeting tools; and providers helping us support customers. Access to customer data must be limited to the authorized service and covered by appropriate contractual protections.
• A customer's designated administrators, for that customer's data.
• Authorities or other parties where the law requires it, or to protect the rights, safety and property of SmartChair.AI, our customers or others.
• A successor in a merger, acquisition or sale of assets, subject to applicable law and existing obligations protecting the information.

Payments: Stripe processes card and bank-account payments, bank-account verification, receipts and invoices for orders placed through start.smartchair.ai. Payment credentials are entered on Stripe’s pages. SmartChair.AI does not store full card numbers or bank-account credentials; we receive payment status and transaction references needed to administer your order. See Stripe’s Privacy Policy: https://stripe.com/privacy.

Analytics and contact records: On our demo and signup sites, optional Google Analytics and HubSpot tracking load only where enabled and after you accept analytics cookies. If you request a demo or place an order, HubSpot may associate consented browsing activity with your contact record so we can follow up with context. Declining optional analytics does not prevent a demo request or order. Change your choice using “Your Privacy Rights” in the footer. We treat Global Privacy Control as a decline.

External booking and meeting services also describe their processing in their own privacy notices.

Cookies and your choices

A banner on your first visit asks whether you accept analytics cookies. Accept or Decline; your answer is kept in your browser for up to 12 months. Change it at any time from the "Your Privacy Rights" link in the footer.

If your browser sends a Global Privacy Control signal, we treat it as a decline, including when you previously accepted analytics. To enable analytics, first turn off that browser signal and then choose Accept.

Changing from Accept to Decline stops analytics and reloads the page to remove the loaded analytics scripts. It does not erase information already received by Google Analytics.

Strictly necessary items, such as the setting that remembers your cookie choice, do not require analytics consent.

How long we keep it

• Demo bookings, business contacts and email: for as long as needed to respond, manage the relationship and meet applicable recordkeeping obligations.
• Platform account data, occupancy readings and production summaries: according to the customer agreement and applicable law, including agreed removal schedules, backups and legal holds. Customers retain their rights in their raw occupancy readings and supplied data.
• Model development: any permitted training datasets and retained model outputs remain subject to the applicable agreement and data protections. This notice grants no perpetual right to retain customer data or use it for new purposes.
• Website analytics: retention depends on the Google Analytics settings and the type of information. Aggregate reports may be retained separately from event-level data. Contact us for details of the retention settings applicable to your request.
• Signed order forms and acceptance records are retained for seven years after the service term ends. Personal contact details and notes in unsigned offers are removed twelve months after those offers expire. Detailed Stripe payment-event data is reduced after ninety days, while limited event identifiers and transaction references remain to prevent duplicate processing.

Security

The SmartChair.AI platform is hosted on Amazon Web Services in the United States. It uses encrypted connections, and its Amazon S3 and DynamoDB storage use encryption at rest. Access is restricted by role and customer authorization. Website, booking and communication services also process information as described above. No method of transmission or storage is perfectly secure.

Offers, order forms, acceptance records and payment status are stored using Cloudflare. Access is restricted to authorized SmartChair.AI personnel and service providers who need it to administer and support orders.

International transfers

Our platform is hosted in the United States. Website, scheduling and communication providers may process information in other countries. Where data-protection law requires safeguards for an international transfer, those safeguards must be in place, such as applicable contractual safeguards. Contact us for information about the arrangements relevant to your data.

Your rights

Depending on where you live and which laws apply, you may have the right to know what personal information we hold about you, to receive a copy, to correct it, to delete it, to limit how we use it and to object to certain uses. You will not be treated differently for exercising a right.

California residents: where the California Consumer Privacy Act applies, rights include knowing, deleting and correcting personal information and opting out of sale or sharing. We do not sell or share personal information as those terms are defined in that law. You may use an authorised agent to submit a request.

Residents of the European Economic Area, the United Kingdom and Switzerland: where applicable, you may also complain to your supervisory authority and withdraw consent to consent-based processing. The legal basis depends on the activity: contract for providing requested services, legitimate interests in operating and securing our business, consent for optional analytics and where otherwise required, and legal obligation.

To exercise a right, email info@smartchair.ai. We will verify the request and reply within the time the applicable law allows. Where we process information on behalf of a practice, we may direct the request to that practice or assist it under our agreement.

Children

The website and current sensor service are intended for businesses and their staff, not children under 16. Do not submit information about children through the website or scheduling tools. Any separately authorized patient-linked service, including pediatric records, requires the agreed safeguards and applicable agreements.

Changes to this notice

We update this notice when our practices change. The date at the top identifies this version. A material change is announced before it takes effect. Updating this notice does not amend an existing customer agreement or authorize a new use of previously collected data; any required agreement or permission must be obtained first.

Contact

Smartchair.AI Inc., doing business as SmartChair.AI, Waltham, Massachusetts. Email info@smartchair.ai for anything about this notice or your information.