Data Handling Policy

An assessment may require temporary credentials, test accounts, access tokens, approved repository access, configuration details, architecture information, or other material identified in the Engagement Documents.

Evidence may include limited screenshots, HTTP requests and responses, affected URLs or parameters, version details, sanitized logs, proof-of-concept output, and notes needed to reproduce or remediate a finding.

Evidence collection is limited to what is needed. Partial, redacted, or synthetic examples are used when sufficient. Patient records and unrelated sensitive information are not intentionally collected.

Engagement information is used to perform the authorized assessment, validate findings, communicate urgent issues, deliver the report, complete an agreed retest, administer the engagement, and protect the service.

If patient information, personal information, credentials, or confidential records appear unexpectedly, unnecessary access stops. Only the minimum evidence is preserved, disclosure is restricted, and the designated client contact is notified.

Access is limited to people and providers assigned to testing, verification, reporting, delivery, retesting, security, or necessary administration. Access controls and storage match the sensitivity of the information. Access is removed when no longer needed.

Temporary credentials are used only for the authorized engagement. Reports are delivered through the agreed channel, and the client controls access to copies after delivery.

Engagement information is shared only with the client's designated recipients, providers assigned to an approved function, professional advisers with confidentiality duties, or authorities making a binding and applicable legal request.

Providers receive only the information needed for their function. Client evidence is not placed in public artificial intelligence systems, public repositories, or unrestricted collaboration spaces. Findings are not published without permission.

Unless the Engagement Documents require a different period:

• raw evidence is deleted within 30 days after final report delivery;
• temporary credentials and tokens are removed as soon as they are no longer needed;
• delivery copies of final reports are removed within 90 days after completion; and
• signed agreements, testing authorizations, invoices, and records relevant to legal duties or disputes may be retained for the required period.

Clients may request earlier deletion, subject to legal, contractual, payment, dispute, and backup limits. Deleted information may remain temporarily in protected backups until the applicable backup cycle expires and is not restored for ordinary use.

The client is responsible for:

• providing only systems and information it is authorized to share;
• using synthetic data and dedicated least-privilege test accounts where practical;
• using the approved secure exchange method for credentials and sensitive material;
• rotating or disabling temporary credentials after testing;
• identifying handling, location, access, or deletion restrictions before work begins; and
• protecting reports and evidence after delivery and limiting them to trusted recipients.

Unauthorized access to controlled client evidence is investigated and contained. Relevant information is preserved, and the affected client is notified without undue delay.

The client decides whether an event requires notice to regulators, affected people, insurers, or other parties. Available incident information will be provided to support that decision.