BiteBoss
BiteBoss Privacy Policy
Coco Technologies, LLC d/b/a BiteBoss · 433 E Ogden Ave, Clarendon Hills, IL 60514
Last updated:
BiteBoss works with orthodontic practices to help patients stay on track with treatment. This policy explains what we do with personal information. Some of it applies no matter who you are; the rest depends on whether you use BiteBoss as a practice, a patient, or a parent or guardian. Choose your role below for the part specific to you.
Applies to everyone
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
BiteBoss does not sell personal information. Where BiteBoss handles patient information on behalf of a practice, it does so as a HIPAA Business Associate under a signed Business Associate Agreement. Account and messaging records are encrypted at rest, and BiteBoss's systems use TLS 1.2 or higher for the API and storage endpoints involved in sending a message. Text messages themselves are the one exception: SMS is not an encrypted channel, so BiteBoss limits SMS content to account activation links, password-reset links, and one-time verification codes, and never includes a patient's name, treatment information, clinical detail, or conversation content in a text message.
Who we share information with
| Microsoft Azure Communication Services | Sends our emails and text messages, under a Business Associate Agreement |
| Mobile carriers | Deliver text messages to your handset — a conduit under HIPAA, not a BiteBoss subprocessor |
| Azure OpenAI | Powers the Boss chat coach; minors' conversations are excluded from any model training |
| Azure AI Speech | Transcribes your voice if you use voice input with the Boss coach |
| Firebase Cloud Messaging | Delivers app push notifications — not text messages or email |
| Sentry | Monitors the BiteBoss API for application errors so we can fix them; never used for advertising |
| Stripe | Processes practice billing (practices only — never used for patient or parent data) |
| Apple App Store / Google Play | Processes in-app purchases of premium content packs or coaches (patients and parents only) |
| Your practice | The orthodontic practice you're a patient, parent, or staff member of |
Full detail on the messaging program itself — message types, frequency, opt-out, and carriers — is in the SMS Program Terms and the SMS & Messaging Privacy Notice. Those stay as their own pages; this policy links to them rather than repeating them, so the two never drift apart.
Cookies and how your session is kept secure
The BiteBoss dashboard uses a session cookie to keep practice staff signed in. It's required for the dashboard to work and isn't used for advertising or tracking across other sites. If BiteBoss adds analytics or usage-tracking cookies in the future, this section will say so before they go live.
Automated features
Your projected treatment-completion date, compliance score, and the Boss coach's replies are generated automatically from check-in history and, for chat, by an AI model. These are decision support and engagement tools, not a clinical judgment — they don't replace your orthodontist's own assessment of your treatment.
Your privacy rights
Depending on where you live, you may have the right to know what personal information BiteBoss holds about you, correct it, delete it, or receive a copy in a portable format, and to not be discriminated against for exercising these rights. BiteBoss does not sell personal information or share it for cross-context behavioral advertising, so there's no opt-out needed for that. To exercise any of these rights, email support@biteboss.com; we'll verify your identity — or your relationship to the patient, if you're asking on their behalf — before responding.
If something goes wrong
If a security incident affects your information, BiteBoss will notify the practices we work with as required by our Business Associate Agreements and applicable law. Your practice is responsible for notifying you directly, consistent with its own HIPAA obligations, unless BiteBoss is required to contact you itself.
How this relates to your practice's HIPAA notice
Your orthodontic practice is the HIPAA covered entity in this relationship, and gives you its own Notice of Privacy Practices describing your rights regarding your medical record directly. This policy doesn't replace that notice — it describes what BiteBoss, as your practice's business associate and technology provider, does with information on the practice's behalf.
Changes to this policy
BiteBoss may update this policy as the product or the law changes. The date at the top will change when we do, and we'll email affected account holders about any change that materially affects how information is used.
Choose your role
Who this covers
Practice owners, administrators, and staff who use the BiteBoss dashboard to manage patients, rewards, and billing.
What we collect
Your name, work email, role and permission level, and your practice's billing information (handled by Stripe — BiteBoss never stores full card numbers, only the card brand, last four digits, and expiration date). If you're the account owner who created the practice, we also have the phone number you gave at signup. Dashboard activity is logged for security and audit purposes.
Text messages you may receive
Account activation links and password resets, sent by BiteBoss when your practice is set up or when you request a reset. The rules that govern all BiteBoss messaging are in "Applies to everyone" above.
Your rights
You can review or correct your own staff account details in the dashboard, or reach us at support@biteboss.com. Changing a staff member's access is managed by your practice's account owner.