Last updated: June 18, 2026
SPOCS Orthodontics (“SPOCS,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains what information we collect through our website, our web chat widget, and our SMS service; how we use that information; who we share it with; and your rights regarding your information.
1. Information we collect
1.1 Information you provide
- Contact details such as your first name, last name, phone number, and email address when you interact with our AI receptionist.
- Date of birth, if you identify yourself as an existing patient during a verification step.
- Content of your conversations with our AI receptionist, including questions you ask, preferences you share, and assessment responses (e.g., the Smile Assessment).
- Any other information you voluntarily share during a chat.
1.2 Information collected automatically
- SMS delivery metadata from our messaging provider (AWS) — including phone numbers, timestamps, delivery status, and carrier error codes — for messages you have consented to receive.
- A server-generated identifier for your chat session. The chat widget does not set advertising cookies, run third-party analytics, or collect your IP address, browser user-agent, or page URL. (We do log IP address and browser/device information for authenticated staff who sign in to our internal dashboard, for security and audit purposes.)
2. How we use your information
- To answer your questions about SPOCS Orthodontics, our services, pricing policies, and scheduling.
- To verify your identity when you contact us as an existing patient.
- To schedule or manage your appointments and send you confirmations.
- To respond to your inquiries and connect you with our staff when appropriate.
- To operate, maintain, secure, and improve our services.
- To comply with applicable laws and regulations.
3. Live chat handoff to staff
If you ask to speak to a person during a chat session, or if our AI receptionist determines that your question is better handled by a human, we may transfer the conversation to a member of our SPOCS staff. When this happens:
- The chat widget will display a banner indicating that the conversation is being transferred, followed by a system message identifying the staff member who joined the chat (for example, “A SPOCS team member joined the chat”).
- The staff member can read the full prior conversation between you and our AI receptionist, plus any messages exchanged during the handoff, until the chat session ends or the conversation is returned to the AI.
- Staff access to chats is restricted to authorized SPOCS personnel who have authenticated to our internal administrative dashboard with multi-factor authentication. Every action a staff member takes within a chat (joining, sending messages, leaving) is recorded in our audit log.
- The conversation transcript — including messages exchanged with staff — is stored alongside other chat content under the retention terms described in Section 7 of this policy.
- If you do not want a staff member to view the conversation, end the chat before requesting a handoff. Once you ask for a human (or our AI decides to escalate), the prior transcript becomes visible to the joining staff member.
You may always reach SPOCS staff directly by calling (727) 242-8000 instead of using the chat.
4. SMS messaging programs
SPOCS Orthodontics operates two separate SMS messaging programs: a patient transactional program and a staff authentication program. Each program uses a different sending phone number and serves a distinct audience.
4.1 Patient transactional SMS
Used for appointment confirmations and appointment-related follow-ups to patients. The following terms apply:
| Consent | You provide express consent to receive SMS when you give your phone number to our AI receptionist during a chat session for the purpose of receiving an appointment confirmation. Consent to receive these texts is not a condition of receiving care or any other service. |
|---|---|
| Message types | Transactional only — appointment confirmations and appointment-related follow-ups. We do not send marketing or promotional SMS. |
| Frequency | Message frequency varies and depends on your interactions with our service. Typically one confirmation message per booking. |
| Sample message | “Hi Alex, this is Marina from SPOCS Orthodontics. Your consultation with Dr. Mansour is confirmed for Tue, May 19 at 2:00 PM. Confirmation #ABC123. Reply STOP to opt out.” |
| Opt-out | Reply STOP to any message to unsubscribe. You will receive a final confirmation and no further messages from this program unless you opt back in. |
| Help | Reply HELP for support, or contact us using the information in Section 12. |
| Fees | Message and data rates may apply, according to your mobile carrier plan. SPOCS does not charge you directly for SMS. |
| Supported carriers | US mobile carriers — AT&T, T-Mobile, Verizon, and their MVNO resellers. Carriers are not liable for delayed or undelivered messages. |
| Sender | Sent via AWS End User Messaging from a separate, dedicated SPOCS patient-messaging number. This number is distinct from the SPOCS practice line and from the number used to deliver staff sign-in codes. |
4.2 Staff multi-factor authentication (MFA) SMS
Used to deliver one-time verification codes (“passcodes”) to authorized SPOCS staff when they sign in to the internal administrative dashboard. Patients and the general public are never enrolled in this program. The following terms apply:
| Program name | SPOCS Orthodontics — “Marina Admin verification codes.” |
|---|---|
| Audience | SPOCS Orthodontics workforce members (the practice owner and authorized administrative staff) who have been granted access to the SPOCS administrative dashboard. Patients and other members of the public are not eligible. |
| How you opt in (express consent) | Consent is collected as a separate, explicit opt-in — it is not granted by agreeing to our Terms of Service or by using the Service. When a staff member chooses to add a mobile number as a verification method in their account, they are first shown this program’s terms (purpose, message frequency, “message and data rates may apply,” the STOP and HELP instructions, and links to this Privacy Policy and our Terms) and must affirmatively check a consent box before any text message is sent. Submitting the mobile number at that step is the staff member’s express consent to receive verification-code SMS. |
| Optional — never required | Receiving these text messages is optional and is never required to access the dashboard or as a condition of employment. Staff may instead use a time-based authenticator app (TOTP) as their second factor. |
| Message types | One-time sign-in verification codes only. No marketing, no promotional content, and no third-party content of any kind. |
| Frequency | Sent only when a staff member signs in or re-verifies — typically zero to three messages per staff member per day. |
| Sample message | “Your Marina Admin verification code is 123456. It expires in 10 minutes. Reply STOP to opt out, HELP for help. Msg & data rates may apply.” |
| How you opt out | Reply STOP to the verification number at any time to stop all messages — for our toll-free number, opt-out is processed at the carrier level via the STOP keyword. Staff may also remove the mobile number or disable SMS verification in their account at any time, in which case TOTP becomes the required second factor. Opt-out requests are honored immediately. |
| Help | Reply HELP for support, or contact us using the information in Section 12. |
| Fees | Message and data rates may apply, according to the staff member’s mobile carrier plan. SPOCS does not charge for these messages. |
| Supported carriers | US mobile carriers — AT&T, T-Mobile, Verizon, and their MVNO resellers. Carriers are not liable for delayed or undelivered messages. |
| Sender | Sent via AWS End User Messaging from a SPOCS-owned toll-free number dedicated to staff authentication. This number is used exclusively to deliver sign-in codes; it never sends messages to patients or customers. |
| No third-party sharing | Mobile numbers enrolled for verification are stored in Amazon Cognito and are used solely to deliver sign-in codes. They are never shared or sold to any third party for marketing or any unrelated purpose. |
5. How we share your information
We do not sell your personal information. We share information with the following categories of service providers, only to the extent necessary to operate our services:
| Provider | Purpose |
|---|---|
| Amazon Web Services, Inc. | Application hosting and database (Amazon ECS, RDS), the Claude large language model accessed through Amazon Bedrock, encryption key management (KMS), secrets storage, audit logging (CloudWatch), staff authentication (Cognito), and SMS delivery via AWS End User Messaging for both patient appointment confirmations and staff sign-in codes. The language model is accessed entirely within AWS; Anthropic is not a separate data processor for SPOCS. |
Each service provider processes your information under a written agreement with us and is contractually bound to protect it. For healthcare data subject to HIPAA, our sole business associate for this Service is Amazon Web Services, Inc., with which SPOCS maintains a signed Business Associate Agreement (BAA) covering hosting, the database, encryption, logging, staff authentication, the Claude language model accessed through Amazon Bedrock, and SMS delivery. We do not transmit your protected health information to any other third party for processing except as permitted by HIPAA or with your authorization.
We may also disclose information where required by law, to protect our rights, or in connection with a merger or acquisition. You may consent to additional sharing at your discretion.
6. Healthcare privacy
SPOCS Orthodontics is a HIPAA-covered healthcare provider. If you share protected health information (PHI) during a chat, we handle it consistent with the Health Insurance Portability and Accountability Act (“HIPAA”) and our Notice of Privacy Practices (“NPP”). A copy of our NPP is available on request and at our front desk; it explains your rights and how we may use and disclose PHI. We apply the HIPAA minimum-necessary standard: staff and the AI receptionist access only the information needed to answer your question, schedule your visit, or verify your identity.
We share PHI only with vendors who host or process it on our behalf under a signed Business Associate Agreement (BAA). Our AI receptionist runs on Amazon Web Services: the underlying large-language model is accessed through Amazon Bedrock, and all HIPAA-covered infrastructure (hosting, database, encryption, logging, authentication, and SMS delivery) is provided by Amazon under a single BAA between SPOCS and Amazon Web Services, Inc. We do not have a direct business-associate relationship with the model developer; the model is consumed only through AWS.
Under HIPAA you have the right to access and obtain a copy of your records (45 CFR § 164.524), request an amendment (§ 164.526), and receive an accounting of certain disclosures (§ 164.528); to exercise these rights, contact us using Section 12. In the event of a breach of unsecured PHI, we will notify affected individuals as required by the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414). The AI receptionist is not a substitute for clinical consultation and must not be used for medical emergencies; call 911 or (727) 242-8000.
7. Data retention
We retain conversation content and related metadata only as long as needed for the purposes described in this policy and as required by law. Appointment, booking, and patient-record data are retained in accordance with Florida dental record-retention requirements (which generally require multi-year retention, and longer for records of minors). Audit and disclosure logs are retained as required for HIPAA accountability.
Because much of this information forms part of your medical record, we cannot always delete it on request where the law requires us to keep it; in that case we will explain what we can and cannot remove. To request access to, correction of, or deletion of your information, contact us using Section 12. We respond within the timeframes required by applicable law (for HIPAA right-of-access requests, generally within 30 days).
8. Security
We use reasonable technical and organizational measures to protect your information, including encryption in transit (TLS 1.2 or higher), access controls, and logging. No system is perfectly secure; we cannot guarantee absolute security.
9. Your rights
Depending on where you live and the nature of your information, you may have the right to access, correct, or delete your personal information, obtain a copy of it, and opt out of the sale or sharing of personal information and of targeted advertising — though we do not sell personal information or engage in targeted advertising. For health information, your rights under HIPAA are described in Section 6 and in our Notice of Privacy Practices.
To exercise any right, email info@spocsorthodontics.com or call (727) 242-8000; we will verify your identity before acting and respond within the time required by applicable law. If we deny a request, you may appeal by replying to our decision. You may also file a HIPAA complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, and Florida residents may have additional rights under Florida law. We will not retaliate against you for exercising these rights.
10. Children
Our Service is intended for adults (18 or older). A parent or legal guardian may use the Service on behalf of a minor patient and, by doing so, confirms they are authorized to provide that minor’s information. We do not knowingly collect personal information directly from children under 13 without parental involvement. We do not sell personal information and we do not use it for targeted advertising. Consistent with the minors protections of the Florida Digital Bill of Rights (Fla. Stat. §§ 501.701–501.719), we do not knowingly process a minor’s personal information to sell it or for targeted advertising. If you believe a child under 13 has provided us information without a parent or guardian’s involvement, contact us using the information in Section 12 and we will delete it.
11. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top. Material changes will be announced on this page. Continued use of our services after a change constitutes acceptance of the updated policy.
12. Contact us
SPOCS Orthodontics
3200 4th St N, St. Petersburg, FL 33704
Phone: (727) 242-8000
Email: info@spocsorthodontics.com