Smile PreVue

Smile PreVue is three codebases we run ourselves: a FastAPI backend on Google Cloud Run with async SQLAlchemy and Cloud SQL Postgres, a Next.js dashboard on Vercel, and a marketing site. The iOS app is a Capacitor shell that loads the live dashboard, so a feature reaches the web and the App Store build from the same push. Push to main is the deploy on every surface, and database migrations run when the container starts.

Patient photos upload straight to Cloud Storage on signed URLs rather than through the API, and the backend strips EXIF metadata before the bytes reach any model. An intake check rejects a photo that cannot produce a usable preview before the render runs.

We chose Google Vertex AI because the decisive constraint was a signed BAA covering patient photos, not a benchmark. Every model call goes through Vertex under the Google Cloud BAA, and swapping the image model to its GA release waited on an A/B test against real patient photos, because a model that reframes the face would break the before and after.

Tenant isolation is enforced twice. Every query filters by clinic, and Postgres row-level security enforces the same boundary on the patient, simulation, consent, and share tables, so a bug in one layer does not expose another clinic’s patients. Share links expire after three days instead of living forever in an inbox.

Payments run on Stripe Connect Express destination charges. The clinic is the merchant of record and Smile PreVue never holds patient money. Financing through Affirm, Klarna, and Sunbit is surfaced by Stripe, subject to the lender’s approval, and the lender carries the credit risk while the practice is paid in full upfront. Patient health information never enters Stripe or the lenders; only opaque IDs, the amount, and a receipt email do. The practice-facing side of that is laid out on the dental payment processing page.

Row-level security had a trap that is easy to miss. Postgres resets a transaction-scoped setting on commit, several handlers commit partway through a request, and the next transaction ran with no clinic set and could see nothing. The fix replays the clinic context onto the connection at the start of every transaction.

Texting a patient took four rounds of carrier review before the A2P 10DLC campaign was verified. What shipped is a double opt-in: verbal consent at the chair, an attestation in the app, and a reply from the patient before any link is sent.

In September 2026 we added AI Clinical Notes. The provider dictates or types raw notes chairside, and the platform drafts the note in that provider’s own writing style, learned from a few past notes. Anything not stated becomes a placeholder to confirm, it never diagnoses or plans treatment, and the dentist reviews and signs every note before copying it into their practice software. It runs on Vertex AI under the same BAA, and the full walkthrough is on AI clinical notes for dentists.