Data Retention Policy

Platform Data

CRM contacts, leads, pipeline records, patient profiles, appointment history, and any custom fields you create inside BiteBot.

Communications

Data generated by the A.I. Calling Receptionist, A.I. Messaging bot, and any SMS, email, or webchat conversations handled through BiteBot.

Marketing & Campaign Data

Ad campaign performance, audience segments, landing page analytics, and social media scheduling data created through Ad Launcher, Ad Studio, and the Social Media Planner.

Ad account credentials and connected social media tokens are revoked immediately upon account cancellation and are not retained.

SmileGen Transformation Data

Patient photos, AI-generated visualizations, video transformations, and associated patient contact details captured when a smile transformation is created.

SmileGen's 30-day purge is automatic and runs daily. Deletion is permanent and cannot be reversed. Practices can also delete individual transformations immediately from the SmileGen History tab without waiting for the automatic cycle.

4A. Biometric Data Clarification

SmileGen processes facial photographs for AI visualization only. We do NOT:

• Create or store biometric templates
• Perform facial recognition for identification
• Extract biometric identifiers for storage

Photographs are processed solely to generate cosmetic smile visualizations and are automatically deleted after 30 days. No biometric data is retained beyond the standard image-retention period.

Account & Billing Data

Technical & Audit Logs

Inactive Accounts

If your BiteBot account remains inactive for ninety (90) consecutive days without formal cancellation, all data associated with your account — including any Protected Health Information — will be automatically purged from our systems.

This is consistent with our Business Associate Agreement (BAA §2.11). You are solely responsible for downloading, exporting, or otherwise preserving any data from your account before the 90-day window closes.

Deletion Requests

For patients

To request deletion of your data:

• Contact the practice that created your record — they can delete it directly from their BiteBot or SmileGen dashboard.
• Or email us at [email protected] with the practice name, your name, and an approximate date so we can locate the record.

For practices

Bulk or account-level deletion

Email [email protected] with:

• Your practice name
• Location ID (found in your dashboard URL)
• What to delete: specific records, all CRM data, all SmileGen data, or "delete my entire account"

We process deletion requests within 7 business days and confirm completion via email.

Access and amendment (BAA §2.7)

To the extent BiteBot maintains a Designated Record Set on your behalf, we will make PHI available for inspection or amendment within fifteen (15) days of your request, as required under 45 C.F.R. §§ 164.524 and 164.526.

Accounting of disclosures (BAA §2.8)

We will provide an accounting of disclosures of PHI within thirty (30) days of your request, in accordance with 45 C.F.R. § 164.528.

Data that cannot be immediately deleted

Some data may be retained beyond your deletion request due to legal requirements:

• Financial transaction records — 7 years, for tax and legal compliance
• Audit logs related to your data access — 1 year, for security compliance
• Data subject to active legal holds or investigations

Storage & Security

Where your data is stored

All BiteBot and SmileGen data is stored with:

• Supabase — US-based data centers (PostgreSQL database and file storage). SOC 2 Type II certified. BAA in place.
• HighLevel (GoHighLevel) — CRM platform, when connected by the practice. Handles contacts, conversations, call recordings, and messaging. HIPAA add-on enabled; BAA available.
• Vercel — US-based edge network (application hosting; server logs only, no PHI). SOC 2 Type II certified.

Security measures

• Encryption in transit: TLS 1.2+ (HTTPS) for all data transmission
• Encryption at rest: AES-256 for database and file storage
• Access controls: Role-based access, audit logging enabled
• Compliance: SOC 2 Type II certified infrastructure

Third-Party Data Sharing

Patient images are temporarily shared with:

• Replicate (AI image processing) — images are processed and not retained after transformation.

Patient contact information may be shared with:

• HighLevel / GoHighLevel (CRM) — only when configured by the practice.

BiteBot requires each subcontractor that creates, maintains, receives, or transmits PHI to execute a Business Associate Agreement imposing the same restrictions that apply to BiteBot (BAA §2.9).

Breach Notification

In the event of a breach involving Protected Health Information, BiteBot will:

• Notify affected practices within 72 hours of discovery (our voluntary commitment; see our Privacy Policy)
• Under our Business Associate Agreement, notification is provided no later than 30 calendar days from discovery (BAA §2.5.2)
• Assist practices with patient notification as required by HIPAA
• Document the breach and remediation steps
• Report to HHS if required (breaches affecting 500+ individuals)

Policy Updates

This policy may be updated periodically. Significant changes will be communicated to active subscribers via email.

Contact

For data deletion requests, HIPAA inquiries, or questions about this policy, email [email protected].