SMYLSYNC (“SMYLSYNC,” “we,” “our,” or “us”) values and respects the privacy of our Clients, their Patients, and all individuals whose information is entrusted to us. This Privacy Policy explains how we collect, use, store, and protect information in the course of providing our outsourcing and administrative services for dental practices.
1. Applicability
This Privacy Policy applies to:
- Dental practices (“Clients”) who engage SMYLSYNC for outsourced administrative, billing, credentialing, and practice support services.
- Patient information (“Protected Health Information” or PHI) that is processed on behalf of Clients.
- Website visitors, staff, and stakeholders interacting with SMYLSYNC.
2. Information We Collect
SMYLSYNC may collect the following categories of information:
- Practice Information: Contact details, staff directories, schedules, billing and insurance preferences, and other administrative data.
- Patient Information (PHI): Names, contact details, insurance and payment information, treatment histories, claims data, and related information necessary for practice operations.
- Operational Data: Service logs, communication records, and usage-related metadata.
3. Use of Information
We use data only as necessary to deliver our services, including:
- Claims processing and billing support
- Credentialing and insurance verification
- Patient scheduling and coordination
- Administrative support, reporting, and analytics
- Compliance with applicable healthcare, tax, or legal obligations
We do not sell, rent, or use Client or Patient information for marketing purposes.
4. Data Privacy & Security Commitments
- Philippine Law (RA 10173 – Data Privacy Act of 2012): All personal data is collected and processed in line with transparency, legitimate purpose, and proportionality.
- U.S. Law (HIPAA): All PHI handled by SMYLSYNC is safeguarded according to HIPAA Privacy, Security, and Breach Notification Rules.
- Safeguards: We apply encryption, access controls, secure data transmission, confidentiality agreements, and regular audits to prevent unauthorized use or disclosure.
5. International Data Transfers
SMYLSYNC operates in the Philippines while servicing U.S.-based dental practices. Data may be transferred across borders under:
- Binding confidentiality and Business Associate Agreements (BAAs) with Clients.
- HIPAA-mandated compliance training for all SMYLSYNC staff.
- Data protection measures consistent with both Philippine and U.S. laws.
6. Retention & Disposal
- Data is retained only as long as necessary to fulfill service agreements or meet legal/regulatory obligations.
- Upon termination of services, Clients may request secure return or deletion of data.
- SMYLSYNC employs secure deletion and disposal protocols for all PHI and sensitive personal data.
7. Sharing of Information
We disclose information only:
- To authorized SMYLSYNC personnel delivering contracted services
- To comply with applicable laws, court orders, or regulatory requests
- As required under HIPAA for healthcare operations, payment, or treatment purposes
8. Client & Patient Rights
- Clients may request access, correction, or deletion of data held by SMYLSYNC.
- Patients retain rights under HIPAA, including access, amendment, and accounting of disclosures (facilitated via their dental practice).
- Data Subjects under RA 10173 may exercise rights such as access, correction, objection, and data portability, subject to lawful limitations.
9. Cookies & Website Usage
We collect limited website-usage analytics to understand which pages and public actions are useful. This can include page paths, internal and outbound link clicks, including links shared in ARA, and counts for key actions such as booking or survey links, successful contact-form submissions, and ARA being opened or used.
- Interaction reports store the event type, source page, internal destination path or outbound domain, a fixed site-provided label, and time. They do not store contact-form entries, ARA message text, an IP address, or a click-level visitor identifier. Contact Us submissions are stored with the contact in our CRM, and a copy is emailed to [email protected] so our team can respond.
- Existing page-view analytics may use an anonymous first-party identifier to count repeat visits. For visitors in the EU/UK, the identifier resets daily and is not stored on their device.
- SMYLSYNC does not use analytics to track patients or sell data to advertisers.
10. Policy Updates
This Privacy Policy may be updated to reflect operational, legal, or regulatory changes. Notice will be provided to Clients when significant changes are made.
11. Contact Us
For questions, data requests, or privacy concerns, contact:
Data Privacy Officer – SMYLSYNC
Email: [email protected]
Address: B10 L18 Diamond Street, BF Resort Village, Las Piñas, Metro Manila, PH, 1747
