Privacy Policy

Last updated: September 2026

1. Information We Collect

Information you provide to us

When you complete our dental eligibility quiz, request a consultation, or otherwise communicate with us, we may collect:

• Contact information — such as your name, email address, and phone number.
• Quiz responses — the answers you provide to questions in the eligibility quiz (for example, your general dental situation, tooth-loss history, timing, and related preferences).
• Communications — the content of messages, emails, texts, or call notes when you contact us or respond to our follow-up.
• Consent selections — including whether you opted in to receive text messages.

Information collected automatically

When you visit the Website, certain information is collected automatically through cookies, pixels, and similar technologies, including:

• Your IP address and approximate location;
• Device and browser type, operating system, and screen information;
• Pages viewed, links clicked, referring pages, and time spent on the site;
• Interaction events used for analytics and advertising measurement.

2. How We Use Your Information

We use the information we collect to:

• Contact you about scheduling a consultation and respond to your inquiry;
• Evaluate general eligibility indicated by your quiz responses and prepare for a possible visit;
• Provide, and follow up regarding, dental services and appointments;
• Send you marketing and follow-up communications by phone, text message, and email (consistent with your consent and applicable law);
• Measure and improve the performance of our advertising and website;
• Maintain the security and proper functioning of the Website;
• Comply with legal, regulatory, and professional obligations.

3. HIPAA and Protected Health Information

MALO SMILE USA is a healthcare provider. The information you submit through the Website's eligibility quiz before you become a patient is general contact and interest information used for marketing and scheduling, and is handled as described in this Policy.

Once you establish a treatment relationship with the practice, health information we create, receive, or maintain in connection with your care is treated as Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA) and applicable state law. Our use and disclosure of PHI is governed by our separate Notice of Privacy Practices (NPP), not by this Website Privacy Policy.

You may request a copy of our Notice of Privacy Practices at any time by contacting the office at the address, phone number, or email listed at the end of this Policy. To the extent any portion of this Policy conflicts with the NPP or with HIPAA as applied to your PHI, the NPP and applicable law control.

4. How We Share Your Information

We do not sell your personal information. We share information only as described below:

• Service providers and business associates. We use trusted vendors to operate our business and Website. These include our customer relationship management (CRM) and communications platform (GoHighLevel), our website hosting provider (Vercel), and our video hosting provider (Bunny.net). Vendors that handle PHI on our behalf do so under written agreements, including HIPAA business associate agreements where required, and may use the information only to perform services for us.
• Advertising and measurement partners. We work with advertising platforms such as Meta (Facebook and Instagram) to measure and improve our ads using the Meta Pixel and the Conversions API. When we share contact data with Meta for measurement and matching, that data is hashed using SHA-256 before it is transmitted. See "Cookies and Tracking Technologies" below.
• Legal and safety. We may disclose information when required by law, subpoena, or legal process, or to protect the rights, property, or safety of the practice, our patients, or others.
• Business transfers. If the practice is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to applicable law.

We do not sell your personal information. We also do not share your personal information for cross-context behavioral advertising in a manner that would constitute a "sale" or "share" under applicable state privacy laws without providing you an opportunity to opt out where required.

5. Cookies and Tracking Technologies

The Website uses cookies, pixels, and similar technologies to operate the site, understand how visitors use it, and measure advertising. This includes the Meta Pixel and the Meta Conversions API, which help us understand which ads lead to consultations and improve our campaigns. As noted above, contact data shared with Meta for matching is SHA-256 hashed before transmission.

Most web browsers let you refuse or delete cookies through your browser settings. Some browsers also offer a "Do Not Track" or Global Privacy Control (GPC) signal; where required by law, we honor recognized opt-out preference signals. Disabling cookies may affect how parts of the Website function.

6. Text Messages (SMS) and Your Consent

If you check the SMS consent box on our form (for example, "I agree to receive text messages…"), you expressly consent to receive text messages from MALO SMILE USA at the phone number you provide, including messages sent using an automatic telephone dialing system or similar technology, for appointment scheduling, consultation follow-up, and marketing purposes, consistent with the Telephone Consumer Protection Act (TCPA) and applicable law.

• Consent is not a condition of purchase or of receiving dental services.
• Message frequency varies based on your interaction with us.
• Message and data rates may apply, depending on your mobile carrier and plan.
• Reply STOP at any time to opt out of text messages. Reply HELP for help.
• Carriers are not liable for delayed or undelivered messages.

Opting out of text messages does not remove you from email or phone follow-up unless you also opt out of those channels.

7. Email Communications

We may send you emails about consultations, appointments, and marketing offers. Every marketing email includes an unsubscribe link, and we honor opt-out requests as required by the CAN-SPAM Act. You may also ask us to stop sending marketing emails by contacting us using the information below. We may still send you non-marketing, transactional messages related to your care or an active request.

8. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect the information we collect. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. You share information with us at your own risk, and you are responsible for keeping any credentials you use confidential.

9. Your Rights and Choices

Depending on where you live and applicable law, you may have the right to:

• Request access to the personal information we hold about you;
• Request correction of inaccurate information;
• Request deletion of your information;
• Opt out of marketing texts, calls, or emails;
• Opt out of certain sharing for advertising, where applicable.

To exercise these choices, contact us using the details in the "Contact Us" section. We will respond consistent with applicable law. Please note that rights concerning your PHI as a patient are addressed through our HIPAA Notice of Privacy Practices rather than this Policy.

10. California and Other State Privacy Rights

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) may give you rights to know what personal information we collect, use, and disclose; to request deletion or correction of your personal information; and to opt out of the "sale" or "sharing" of personal information. We do not sell your personal information. We will not discriminate against you for exercising your privacy rights. Residents of other states with comprehensive privacy laws may have similar rights. To make a request, contact us using the information below; we may need to verify your identity before responding. Certain health information governed by HIPAA may be exempt from these state laws.

11. Children's Privacy

The Website is intended for adults and is not directed to children under 18. We do not knowingly collect personal information from anyone under 18 through the Website. If you believe a minor has provided us information through the Website, please contact us so we can take appropriate action.

12. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, to provide services and follow-up, to comply with our legal, tax, and recordkeeping obligations (including professional and healthcare recordkeeping requirements), to resolve disputes, and to enforce our agreements. When information is no longer needed, we take reasonable steps to delete or de-identify it.

13. Third-Party Links

The Website may contain links to third-party websites or services that we do not control. This Policy does not apply to those third parties, and we are not responsible for their content or privacy practices. We encourage you to review the privacy policies of any third-party site you visit.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. Material changes may be communicated through the Website. Your continued use of the Website after an update means you accept the revised Policy.

15. Contact Us

If you have questions about this Privacy Policy or would like to make a privacy request or request a copy of our HIPAA Notice of Privacy Practices, please contact us: