ReadyMaxer Privacy Policy

This policy explains what personal data SmileMaxer LLC ("SmileMaxer", "we", "us"), a Maryland limited liability company, collects through ReadyMaxer (the readymaxer.com website, the ReadyMaxer cloud service, and the ReadyMaxer apps for iPhone, Apple Watch, Android, Wear OS, macOS, and Windows), how we use it, and the choices and rights you have.

The short version: ReadyMaxer is a team-signaling tool built to hold as little personal data as possible and no patient information at all. We collect what we need to run the service (admin account details, staff first names, device and push tokens, signal activity), we do not sell personal data, and the only trackers we use are on our public marketing pages, never inside the app: advertising tools load only with your consent, and Google Analytics runs with an easy opt-out (and, in the EEA, the UK, and Switzerland, only with your consent).

1. Our roles

• For practice team data (member names, rooms, signals, devices that a practice sets up), the practice is the data controller and SmileMaxer processes that data on the practice's behalf. Practices subject to the GDPR or similar laws are covered by our Data Processing Addendum. If you are a staff member with questions about data your practice entered about you, your practice is the first point of contact, and we will help them respond.
• For everything else (admin accounts, billing, website visits, sales inquiries), SmileMaxer is the data controller.

2. What we collect

Admin account data. Email address, a password (stored only as an argon2id hash, never in plain text), and your practice's name. Every new customer owner must confirm the email address before we activate the account and continue the signup to Stripe Checkout. The configured Site-admin address follows the same confirmation step before its Site-admin role is activated. The single-use confirmation token is stored only as a SHA-256 hash, expires in 24 hours, and is pruned automatically after it is used or expires. If you request a password reset, a single-use reset token (stored only as a SHA-256 hash, expiring in 1 hour) and the reset email we send you.

Team data entered by your practice. Member names (a first name or display name), department, on-shift status, and an interface color. We do not collect members' phone numbers, email addresses, or passwords: members sign in by scanning rotating QR codes or redeeming single-use pairing links. Rotating QR tokens are stored only as SHA-256 hashes. Pairing codes are stored only as versioned HMAC-SHA-256 digests keyed with a separate server secret, so a copied database does not provide an offline code verifier.

Device data. For each paired device: a device name (for example, "Front desk iMac"), hardware model, app version, platform, a hashed device token, notification preferences, and a last-seen timestamp. If you enable notifications, we store the push token that Apple or Google issues for your device.

Signal activity. Each ready signal records the room or position, the signal type, the sending and receiving members, timestamps, and an optional note. Notes are capped at 200 characters and labeled in every app: no patient names or info, this is not a medical record.

Activity log. An audit trail of administrative and signal events for your practice (who paired a device, who changed a setting), which includes member names, admin emails, and device names as labels.

Digital Line. If a practice runs a digital line and you join it as a visitor, the server creates a nonidentifying random queue alias for you. On the practice's behalf, we store that alias, a SHA-256 hash of the browser token for your spot, your queue status, and timestamps. The page does not request or accept your name, contact details, or an account.

Billing. Payments are processed by Stripe. We store only your Stripe customer and subscription identifiers and your plan status. We never see or store card numbers.

Sales inquiries. If you use the contact-sales form: your organization, name, email, and message.

Support tickets. If you write to support from the admin portal: the subject and messages you send, linked to your account so we can answer. The compose box carries the same rule as notes: no patient names or info.

App review workspaces. When an app-store reviewer or release tester uses our private reviewer page, we issue an essential browser credential (stored only as a SHA-256 hash) and create an isolated workspace containing synthetic staff and room names. If an app is paired, we store the same device, push-token, and signal activity described above. The workspace has no customer account, billing identity, email, support, marketing analytics, or external push delivery, and it is deleted automatically within 72 hours or immediately when the reviewer selects delete.

Crash reports (only if you choose to send one). If an app stops unexpectedly, it writes down what failed, on that device, and nothing else happens. The next time you open the app it shows you exactly what it captured and asks whether to send it. The app asks every time. You can send that one report or discard it, and either way the next crash asks again. Nothing is remembered: there is no "always", no "never", and no setting to change, so nothing is ever uploaded that the person holding the device did not agree to on the spot. A report holds only machine-generated diagnostics: the app version and release channel, the operating system version, the device model, the device's language, the error and the code path that failed, which screen was open (from a fixed list, never a title anyone typed), how long the app had been running, and whether memory was low. It is not designed to hold a note, a member name, a room name, your practice's name, a token, or anything else anyone typed. Every app removes the text of every note it is handling from the report before the report is written. If a note is too short to distinguish safely from ordinary diagnostic text, the app does not capture a report while that note is in its hands. The app and our server both strip anything that looks like an email address, a phone number, or a long number before it is stored. Reports go only to us, on our own servers; no third party receives them.

Website visits. Our public marketing pages can use analytics and advertising tools (see Section 4). Our servers process IP addresses transiently in memory for rate limiting, abuse prevention, and to derive an approximate (city-level) location for our own aggregate usage statistics. The location lookup runs on our own server against a local copy of a public IP-location database (DB-IP); the IP is never sent to a third party for this and is never written to our database. What we store is only anonymous aggregate statistics: daily counts, for example "3 website visits from Baltimore, Maryland, US on this day", and a fixed-size statistical summary (a HyperLogLog sketch) used to estimate how many distinct visitors there were over a day or a week. Neither holds IP addresses, hashes, or any per-visitor record, and nothing links them to a person, account, or device.

3. What we deliberately do not collect

ReadyMaxer stores no patient information. Signals are fixed labels plus a short optional note that every app labels as off-limits for patient names or identifying details, and our Terms of Service prohibit entering protected health information anywhere in the service. We do not want it, we do not knowingly hold it, and we may delete it if we find it.

We also collect no precise location, no contacts, no photos, and no advertising identifiers in the apps. The apps use the camera only to scan a ReadyMaxer QR code. Scanning runs on the device, nothing the camera sees is stored, and no image ever leaves the device. The signed-in apps and portal contain no third-party analytics or tracking of any kind; their use is counted only in the anonymous aggregate usage statistics described in Section 2.

4. Cookies and marketing analytics

Signed-in service (no tracking). The service uses only essential cookies: rmx_session keeps an admin signed in (30 days), rmx_member keeps a signed-in member's browser paired (up to 1 year), and rmx_review opens one isolated app-review workspace (up to 72 hours). All are httpOnly and used solely for authentication.

Marketing pages. On our public pages (home, pricing, sign-up, and similar) we use Google Analytics to understand how visitors use the site. Outside the European Economic Area, the United Kingdom, and Switzerland it runs by default; you can opt out at any time via the cookie banner, the "Privacy choices" link in the footer, or a Global Privacy Control signal, which we honor. In the EEA, the UK, and Switzerland it does not load at all until you accept, based on the region we derive from your IP address on our own server; before you accept there is no analytics, no cookie, and no identifier. Our advertising and session tools, Meta Pixel, Google Ads, and Microsoft Clarity, load only if you accept, everywhere; these set third-party cookies and, in Clarity's case, record anonymized session interactions. If you decline, or if your browser sends a Global Privacy Control signal, none of these tools load and the site works fully without them. You can change your choice anytime via the "Privacy choices" link in the footer.

5. How we use personal data

We do not use personal data to train AI models, and we do not sell personal data.

6. Who we share data with

Only service providers that help us run ReadyMaxer, under contracts limiting their use of the data: Google Cloud (hosting, United States), Stripe (payments), Apple and Google (push notification delivery: by default a push carries the room name, the signal label, and the sender's first name, and no note; in discreet mode it carries only "New signal" and a line asking the person to open the app; if the practice turns on the note in push notifications, the note is handed over word for word), Resend (transactional email delivery: new admin account confirmations, password reset links, and support notifications), and Cloudflare (bot protection on web sign-in), subject to Cloudflare's Turnstile Privacy Addendum. The current list, including the consent-based marketing tools, is always at readymaxer.com/subprocessors.

How much a push says is the practice's choice, not the recipient's. Every practice starts in the default mode, which never hands a note to Apple or Google, and only a practice admin can change it in the admin portal's Settings page. A staff member can take the note out of their own device's alerts, but no device setting can put it back in. A reminder about a call nobody has answered adds "Still waiting" in front of any of these, and changes nothing else.

We may also disclose data if the law requires it, to protect the rights and safety of users or the public, or as part of a merger or acquisition (in which case this policy continues to apply until changed under Section 12).

We do not sell personal data. The consent-based advertising pixels on our marketing pages may count as "sharing" for targeted advertising under California law; you can opt out via the cookie banner, the "Privacy choices" footer link, or a Global Privacy Control signal, which we honor. The same opt-outs also disable Google Analytics, which otherwise runs by default outside the EEA, the UK, and Switzerland (Section 4).

7. International transfers

We are based in the United States and host data there on Google Cloud. If you use the service from the EEA, UK, or Switzerland, your data is transferred to the US. For practices, our DPA incorporates the EU Standard Contractual Clauses and the UK Addendum. Our subprocessors are large providers that maintain their own recognized transfer mechanisms.

8. Retention

Retention is enforced automatically by the service, not just by policy:

• Admin sessions: 30 days, or deleted at logout.
• Admin account-confirmation tokens: 24 hours, single use; used and expired tokens are pruned automatically.
• Setup pairing codes and rotating QR sign-in tokens: minutes; expired tokens are pruned automatically.
• Member activation links: single use and expire within 7 days; expired tokens are pruned automatically.
• Password reset tokens: 1 hour, single use; expired tokens are pruned automatically.
• App review workspaces and their essential browser credentials: deleted automatically within 72 hours, or immediately when the reviewer selects delete.
• IP addresses: in memory only, never written to the database. The statistics derived from them are stored only as anonymous aggregates: daily counts (day, city, count) and a fixed-size distinct-visitor estimate, with no identifier of any kind.
• Ready signals, including notes: deleted 90 days after they are cleared or expire. Active signals are kept until handled.
• Digital-line entries (server-generated random alias, queue status, and timestamps): deleted 90 days after joining.
• Activity log: entries are deleted after 12 months.
• Removed members: deactivated and signed out of all devices immediately; their name is automatically replaced with "Removed member" after 60 days, or sooner on request.
• Team, room, and device records: retained while the practice's account is active, so the practice keeps its own configuration.
• Support tickets: retained while the practice's account is active; deleted with the account.
• Account closure: a practice can delete its own account at any time with the "Delete this office" button in the admin portal, which erases its data immediately; if you instead ask us to close it, we delete its data within 60 days. Minimal billing records we are legally required to keep are the only exception.
• Disaster-recovery backups: encrypted daily backups in Google Cloud are retained for no more than 30 days. Access is limited to disaster recovery, and backups are never used for ordinary operations. Data deleted from the live service, including after an account closure or deletion request, may remain in a backup until that backup expires. If a backup is restored, we reapply all deletion and account-closure obligations that arose after the backup was created.
• Crash reports: deleted 90 days after the last time the same crash happened. A report waiting for an answer sits on the device, never on our servers, for at most 7 days and no more than five at a time; past that the app drops it unsent.
• Sales inquiries: deleted after 2 years, automatically.

Practices can ask us at any time to erase specific members, notes, or history sooner: email legal@readymaxer.com.

9. Security

Passwords are hashed with argon2id; admin account-confirmation, session, reviewer, device, and QR tokens are stored only as SHA-256 hashes; pairing codes are stored only as versioned, keyed HMAC-SHA-256 digests; admin account-confirmation tokens are single-use and expire in 24 hours; all transport is HTTPS; setup pairing codes and rotating QR sign-in tokens expire in minutes, while member activation links are single-use and expire within 7 days; sensitive unauthenticated endpoints can require platform attestation (Apple App Attest, Google Play Integrity, Cloudflare Turnstile). No system is perfectly secure, but the most effective protection is architectural: the data we never collect is data that cannot leak. See readymaxer.com/security.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict processing, to withdraw consent, and to not be discriminated against for exercising these rights. Email legal@readymaxer.com and we will respond within the time the law requires (and usually much faster). No forms, no fees. If we deny a request, you may appeal by replying to our decision.

• EEA/UK/Switzerland: you may also lodge a complaint with your local supervisory authority. Where we act as processor, we will refer your request to your practice and help them respond.
• California: you have the rights to know, delete, correct, and to opt out of "sharing" for cross-context behavioral advertising (Section 6). We honor Global Privacy Control. We do not knowingly sell or share the personal information of anyone under 16. Authorized agents may submit requests on your behalf with proof of authorization.
• Other US states (Virginia, Colorado, Connecticut, Texas, and others): you have similar rights of access, deletion, correction, portability, and opt-out of targeted advertising, with a right of appeal.

We may need to verify your identity before acting on a request.

11. Children and younger staff

ReadyMaxer is a workplace tool and is not directed to children. A practice may authorize staff members of any age it lawfully employs; what we hold about a member is limited to a first name, department, and work activity, and for minor staff the practice is responsible for any consent the law requires. We do not knowingly collect personal data from children under 13. If you believe a child has provided us data, email legal@readymaxer.com and we will delete it.

12. Changes to this policy

We will post updates on this page and update the effective date above. For material changes, we will notify practice admins by email or in the service before the changes take effect. Prior versions are archived in our public changelog.

13. Contact

SmileMaxer LLC 11 S Eutaw St, Apt 915 Baltimore, MD 21201, USA legal@readymaxer.com

If you are in the EEA or UK and we are required to appoint a local representative under Article 27 GDPR, their details will be listed here once appointed.