1. Who we are
SmileSiri is provided by Verve Automation Singapore Pte. Ltd. ("we", "us"). This disclosure explains what data the App accesses when connected to a healthcare organization's Epic system, and how we use and protect it. When we act on behalf of a healthcare organization, that organization's privacy notice also applies.
2. Data we access
We access only the data needed for the features your healthcare organization enables:
| Data | Source | Purpose |
|---|---|---|
| Patient demographics (name, date of birth, medical record number) | Epic, via FHIR | Link scans and check-ins to the right patient |
| Appointment and encounter details | Epic, via FHIR | Find today's appointment; link products to a procedure |
| Product identifiers (GTIN, UDI, lot, serial, expiry) | Barcode and RFID scans | Record product, supply and implant use |
| Device and implant records | Epic, via FHIR | Match scanned implants to the patient record |
| QR check-in code | Code issued to the patient | Identify the patient at check-in |
| Facial images and face templates (optional) | Check-in assistant camera, with consent | Identify the patient at check-in (see section 6) |
| Staff user ID, timestamps, device logs | The App | Security, audit trails and troubleshooting |
3. How we use data
We use data only to provide and secure the App's features for the healthcare organization, keep required audit records, troubleshoot and improve reliability, and meet legal obligations. We do not use patient data for advertising or marketing.
4. How we share data
We share data only:
- With the healthcare organization you receive care from or work for, including writing usage records back to its Epic system;
- With service providers that host or support the App (such as cloud hosting), under contracts requiring confidentiality and HIPAA-compliant safeguards;
- When required by law, or to protect the safety of patients, staff or the public.
5. We do not sell data
We do not sell, rent or trade patient data, product usage data or biometric data, and we do not share it with data brokers.
6. Biometric data (facial recognition)
Facial recognition is optional. QR code check-in or check-in with staff is always available instead.
- Consent first
- we collect a facial image or face template only after you give written (including electronic) consent at enrollment.
- Purpose
- used only to recognize you at check-in at your healthcare organization. Never for advertising, and never sold or shared for any other purpose.
- Storage
- we store an encrypted face template, not a gallery of photos, and keep it separate from your medical record.
- Retention and deletion
- we delete your biometric data when you withdraw consent, when its check-in purpose ends, or within 1 year of your last check-in, whichever comes first, and in any case within the period required by applicable law.
- Withdraw any time
- tell staff at check-in or email info@verveautomation.com, and we will delete your biometric data within 30 days.
7. How we protect data
We use administrative, technical and physical safeguards consistent with HIPAA, including encryption in transit and at rest, role-based access, audit logging, and regular security reviews. No system is completely secure; we will notify affected healthcare organizations and individuals of a breach as required by law.
8. How long we keep data
We keep data only as long as needed for the purposes above, as required by our agreement with the healthcare organization, or as required by law. Audit logs are kept for 6 years. When no longer needed, data is securely deleted.
9. Your choices
- Revoke access
- you can revoke the App's access through your healthcare organization's patient portal (where available), by contacting your healthcare organization, or by emailing us. Revoking stops new access; it does not erase records already in your medical record.
- Access and correction
- requests to see or correct your health record should go to your healthcare organization. We will help them respond.
- Opt out of facial recognition
- use QR or staff check-in at any time.
10. Children
The App is not directed at children. Patients under 18 use check-in features only with a parent or legal guardian, and we do not collect biometric data from minors without a parent's or guardian's consent.
11. Changes to this disclosure
We will post updates on this page with a new effective date. For material changes, especially to biometric data use, we will ask for consent again where required.