Trust isn't a checkbox you bolt on. It's earned by being clear about what's true today, what's coming, and who's accountable when something breaks. Here's all three.
SmileOS isn't a generic SaaS rebranded for dentistry. It's built by Haroon Ismail, a UK GDC-registered clinical director who runs cosmetic and orthodontic consultations every week. Every workflow has been used in a real chair before it shipped.
Most software companies bury this. We don't, because dentists know the difference between a marketing claim and a clinically defensible one.
Patient data lives on Supabase Postgres in AWS London (eu-west-2), UK. Encrypted at rest and in transit over TLS. AI runs on Microsoft Azure OpenAI under our own subscription - audio transcribed in the EU (Sweden); note-drafting is moving to an EU-only data zone, safeguarded under the Microsoft DPA (EU SCCs + UK Addendum).
Every read and write filters on your tenant ID before touching the database. One clinician can't query another practice's records.
Short-lived signed tokens, no third-party auth vendor in the data path. Password hashing with bcrypt, no plaintext storage.
Every mutation (case created, consent signed, payment verified) writes to an append-only audit table. Searchable by clinical director.
Dr Hi Ltd (t/a SmileOS), registered in the UK. Founder reachable by contact form or WhatsApp on 07457 427 086 - no support queue.
We don't touch card data. Payments flow through Stripe (PCI-DSS Level 1). Refunds, disputes, invoices - all via Stripe's regulated path.
Dr Hi Ltd is registered with the UK Information Commissioner's Office as a data controller, registration reference ZC221978.
Row-level security is enabled on all 36 database tables, behind the API-layer tenant scoping above. A job runs every day that tests the public key against every sensitive table and alerts us if anything is ever readable. Being straight about the shape of it: the application connects with a service role that bypasses RLS by design, so RLS is the second line, not the first.
A versioned UK GDPR Article 28 Data Processing Agreement, presented and signed inside SmileOS before you use it. It names Dr Hi Ltd by company number and registered office, lists every sub-processor and where they process, and re-prompts you to sign again whenever the terms change. Not yet solicitor-reviewed - that is on the roadmap below.
The Article 28 DPA is live and signable in-app today (see above). Independent solicitor review of its wording is still to come, and we will say so plainly until it is done.
We have written our own processor-side data protection assessment of the AI note-taking, and a short DPIA template your practice can complete and sign - ask and we will send both. What is still to come is the formal version reviewed with a UK dental defence union, and independent data-protection review. Until that is done we will not describe either document as reviewed.
Third-party pentest scheduled before our first 50 founders go live. Findings shared with the cohort.
Not certified - and we won't claim it until we are. We're aligning internal controls now to be audit-ready by year-end.
We deliberately don't display "ISO 27001 certified" or "HIPAA compliant" badges, because we aren't certified, and dentists know fake badges when they see them. If you need a specific compliance assurance before signing, email the founder and we'll tell you exactly where that line is for us - and when we'll cross it.
Three things most dental software gets wrong - and how SmileOS handles them differently.
Voice-first capture means notes happen during the consult, not after hours. The patient sees you, not your laptop.
Consent and estimate generation are inside the consultation flow - not a separate file the patient never receives.
Every case sits in a stage. Unsigned consents, unverified payments, missing ClinChecks - visible at a glance, not hidden in folders.
Before you commit. Before you sign anything. Email the founder - you'll get a real answer, not a marketing reply.
Ask the founder →