1. Introduction
MedFix is committed to applying appropriate security and technical controls to protect its systems and its customers' data against reasonable cyber risks.
2. Objectives
This policy aims to: protect the confidentiality of information, protect the integrity of data, ensure business continuity, and reduce cyber risks.
3. Data encryption
MedFix uses appropriate encryption to protect data in transit using secure protocols such as HTTPS/TLS. It may also use additional protection technologies for stored data according to the approved technical architecture.
4. Permission management
Access permissions are granted on the principle of least privilege needed to perform tasks. The Customer is responsible for managing its users' permissions within the system.
5. Data isolation
MedFix applies technical controls designed to isolate customers' data from one another and to prevent unauthorized access between different accounts.
6. Activity monitoring
The platform may keep technical and security activity logs for: auditing, security investigation, detecting suspicious activity, and regulatory compliance.
7. Vulnerability management
MedFix works to address discovered security vulnerabilities and risks according to technical priorities and available resources.
8. Incident reporting
If a confirmed security incident is discovered that may materially affect customer data, MedFix will take appropriate action to investigate, contain and notify in accordance with the applicable legal requirements.
9. Customer responsibilities
The Customer is responsible for: protecting sign-in details, managing users, protecting its devices and networks, and keeping its own systems up to date.
10. Limits of assurance
MedFix makes reasonable efforts to provide a secure environment; however, absolute protection against all risks or cyberattacks cannot be guaranteed.
11. Policy review
This policy may be updated when needed in line with operational and cybersecurity requirements.