US Privacy Notice Addendum

SMADIDESK US PRIVACY NOTICE ADDENDUM

Version: 2026-09-20
Last updated: September 20, 2026

This US Privacy Notice Addendum (the "Addendum") supplements the SmadiDesk Privacy Policy and applies to Practices located in the United States and to data processed through the US SmadiDesk service. It is provided by SimplyRoots Limited, a company registered in England and Wales (company no. 10404398), registered office 14 Hill Top, London, NW11 6EE, United Kingdom, trading as SmadiDesk. In any conflict between this Addendum and the Privacy Policy as to US matters, this Addendum controls; in any conflict concerning PHI, the Business Associate Addendum ("BAA") controls.

1. ROLES

1.1 The Practice is the covered entity and controller-equivalent. The dental practice that subscribes to SmadiDesk determines why and how caller and patient information is used. Under HIPAA the Practice is the covered entity; under state privacy laws the Practice occupies the role equivalent to a controller (or "business," in California terms) for Caller Data.

1.2 SmadiDesk is a business associate and service provider/processor. SmadiDesk creates, receives, maintains, and transmits information - including PHI - only on behalf of and at the direction of the Practice, as the Practice's business associate under HIPAA and as a service provider/processor under state privacy laws. A BAA between SmadiDesk and each Practice governs PHI and must be accepted before live patient call forwarding is enabled.

1.3 Callers should contact the Practice. If you called a dental practice that uses SmadiDesk and want to exercise rights over your information (access, correction, deletion), contact the practice you called. It controls that data; SmadiDesk acts on its instructions. This mirrors HIPAA, under which individual rights (45 C.F.R. Sections 164.524, 164.526) run against the covered entity.

2. AI CALL HANDLING: CATEGORIES OF INFORMATION PROCESSED

When handling calls on a Practice's behalf, SmadiDesk processes:

- Call audio and recordings of conversations between Callers and the AI receptionist;
- Transcripts generated from call audio;
- Caller data: caller phone number, name and contact details as disclosed on the call, reason for calling, appointment or callback requests, and urgency/emergency indicators;
- Call metadata: timestamps, durations, disposition, and routing information;
- Practice-provided data: practice configuration, staff details, hours, services, and knowledge-base content used to answer callers.

Any of the above may constitute PHI when it relates to an identifiable patient's health condition, care, or payment. All such PHI is handled under the BAA. Calls handled by the US service are recorded and transcribed by default, and the AI receptionist discloses AI handling, recording, and transcription at the start of each call.

For Practice account holders and website visitors, SmadiDesk also processes account, billing, and technical data as described in the main Privacy Policy.

3. HIPAA

For HIPAA covered entities that use SmadiDesk with PHI, SmadiDesk acts as a business associate only after an applicable BAA is executed. SmadiDesk handles PHI only as permitted by the BAA and HIPAA: to provide the service (answering and handling the Practice's calls, capturing caller details and requests, and presenting them to the Practice), as required by law, and for the proper management and administration of the service to the extent the BAA permits. If no BAA is in place, the Practice must not submit or route PHI through SmadiDesk. SmadiDesk applies administrative, physical, and technical safeguards consistent with the HIPAA Security Rule, including encryption of data in transit and at rest, row-level access isolation between practices, and least-privilege production access. SmadiDesk does not use PHI for advertising and does not sell PHI.

4. STATE PRIVACY LAWS (INCLUDING THE CCPA)

4.1 CCPA/CPRA applicability. The California Consumer Privacy Act, as amended (the "CCPA"), applies to "businesses" that meet statutory thresholds (annual gross revenue above the CCPA threshold, or buying/selling/sharing personal information of 100,000 or more California consumers or households, or deriving 50% or more of revenue from selling or sharing personal information). SmadiDesk does not currently meet these thresholds.

4.2 CCPA exemptions that apply regardless of thresholds. Even where the CCPA applies: (a) PHI exemption - the CCPA does not apply to PHI collected by a covered entity or business associate governed by HIPAA, nor to a business associate's information to the extent it is maintained in the same manner as PHI (Cal. Civ. Code Section 1798.145(c)); Caller Data handled for Practices is maintained under the BAA in the same manner as PHI. (b) Service-provider role - for any residual Caller Data not within the PHI exemption, SmadiDesk acts as a service provider processing on the Practice's documented instructions, not as a business making independent use. (c) B2B data - information about Practice staff and account holders is business-contact data processed to provide the service; where the CCPA applies to it, the rights and disclosures in the main Privacy Policy apply.

4.3 Other state laws. Comprehensive state privacy laws (Virginia, Colorado, Connecticut, Texas, Utah, Oregon, and others) contain HIPAA-related exemptions for PHI and/or business-associate data and small-business thresholds that SmadiDesk does not currently meet; SmadiDesk's role for Caller Data is in each case that of a processor. Washington's My Health & My Data Act is broader than the comprehensive laws and covers consumer health data outside HIPAA, but exempts PHI governed by HIPAA and data governed by a business associate agreement.

4.4 No sale or sharing. SmadiDesk does not sell personal information, does not "share" personal information for cross-context behavioral advertising, and does not use Caller Data for advertising, profiling with legal effects, or training generalized AI models. Caller Data is used only to deliver the service to the Practice.

5. RETENTION

- Call recordings: our ordinary retention policy targets deletion once recordings are more than 90 days old, unless earlier deletion is requested by the Practice or longer retention is required by law. Deletion requires successful provider-side removal followed by removal of our stored reference; a scheduled or attempted purge is not proof of completed deletion.
- Transcripts and lead data: retained for the Practice's operational use and handled under its documented instructions, applicable law and the BAA. Recording deletion does not itself delete transcripts or lead records.
- Account data: cancelling a subscription, a failed payment or service suspension does not automatically delete account data. Practices can request account closure, return or deletion through [email protected]. We verify the request and handle it under applicable law and the BAA. This does not change the BAA's Section 9.3 obligation to return or destroy PHI within ninety (90) days of termination, subject to its stated infeasibility exceptions and continuing protections.
- Billing records: retained as required by tax and accounting law.
- Technical logs: retention depends on the log's purpose and the applicable service configuration; there is no single 90-day maximum for every log. We apply data minimization and structured logging controls and verify the relevant retention settings.
- Backups and service-provider copies: we do not treat these as deleted until deletion or expiry is verified. Where the BAA or law permits continued retention, protections and restrictions continue for that purpose.

6. DE-IDENTIFIED DATA

SmadiDesk may create and use aggregated, anonymized, or de-identified information for analytics, security, service improvement, reporting, and product development. Where source information is PHI, de-identification is performed in accordance with the BAA and HIPAA, including 45 C.F.R. Section 164.514 or another method permitted by law, and the resulting information does not identify the Practice's patients.

7. PUBLIC DEMO AND VOICE PREVIEWS

Public demos, fictional-practice examples, sandbox calls, and voice previews must not be used to submit real patient information, PHI, or sensitive personal information. SmadiDesk may use separate vendors or processing paths for demos and voice previews that are not approved for PHI. The public demo is trained on a fictional sample practice and is not connected to any real practice's systems.

8. SECURITY MEASURES SUMMARY

- Encryption in transit (TLS) and at rest;
- Database row-level security enforcing strict tenant isolation between practices;
- Role-based access controls and least-privilege access to production systems;
- Multi-factor authentication support (TOTP and recovery codes) for dashboard accounts, with step-up authentication for sensitive actions;
- Structured logging with PII scrubbing; error tracking configured to avoid sensitive payloads;
- API authentication, signature verification on inbound webhooks, input validation, and rate limiting;
- Vendor management: subprocessors are bound by written agreements; PHI-touching subprocessors require BAA or equivalent posture before US patient calls (see the subprocessor list).

9. SUBPROCESSORS / SERVICE PROVIDERS

SmadiDesk uses service providers and subprocessors to provide telephony, AI processing, hosting, storage, security, analytics, email, and support functions. For HIPAA-covered workflows, SmadiDesk will use only approved PHI-processing vendors and configurations covered by required agreements or documented no-PHI architecture.

10. INTERNATIONAL DATA PROCESSING

SmadiDesk is operated by a United Kingdom company. For US customers: call audio and AI voice processing occur in the United States through our telephony and voice providers; the application runs on hosting infrastructure primarily located in the United States (Virginia); and the service database - including call records, transcripts, and leads - is hosted in the United Kingdom (London region). Where personal data is transferred internationally, SmadiDesk uses appropriate safeguards consistent with applicable law, and PHI remains protected by the BAA and by HIPAA-required safeguards regardless of hosting location.

11. CHILDREN

The service is B2B and intended for use by dental practice staff. Caller Data may incidentally include information about minors who call a Practice; such data is processed solely on the Practice's behalf under the BAA, and requests concerning it should be directed to the Practice.

12. CHANGES AND CONTACT

We may update this Addendum as the service and the law evolve; material changes will be notified to Practices by email or dashboard notice. Questions: [email protected], or SimplyRoots Limited, 14 Hill Top, London, NW11 6EE, United Kingdom.