Because every patient deserves the most careful protection.
BrightHeart uses technical and organizational safeguards to help protect personal data against unauthorized access, disclosure, alteration and loss.
Data encryption
Encryption of personal data forms part of our security measures.
Controlled access
Access controls and authentication help restrict access to authorized users.
Activity traceability
Connection and action logs support traceability within the platform.
Ongoing review
We regularly evaluate and improve our systems and data handling practices.
Certified, cleared and compliant.
FDA cleared
CE marked
ISO 13485 certified
Data security certification
HIPAA compliant
Clear responsibilities. Defined data use.
For patient data processed through the platform, BrightHeart acts as a data processor on behalf of the healthcare organization.
Our privacy policy explains what data we process, why we process it, how long we retain it and the safeguards that apply. Personal data is not shared for commercial or advertising purposes.
Email format
Subject:
[Product Name] – [Model Number] [Software Version (leave blank if not available)] - [Vulnerability Name or Class]
Body:
- What is the suspected vulnerability and why do you think this is a security vulnerability?
- How did you find the suspected vulnerability, what is the potential resultant effect of the findings, and what is an applicable remediation?
- What are potential threats from this suspected vulnerability, as applicable?
- Is the suspected vulnerability known to other parties or is it assigned a CVE?
- Describe steps to reproduce the issue proof of concept, exploit code, screenshots, video etc.
- Optional: Contact information so we can follow up with you. Please include name(s), organization name, email address, and phone number. We will not share your contact information externally or use it for any other purpose.
How our team will respond
- Within ten business days BrightHeart will confirm we have received your submission and provide a point of contact.
- We will notify the appropriate security team members who may want to follow up with you to better understand what you’ve found, or to confirm technical details.
- We will investigate the potential vulnerability.
- We will conduct a risk analysis to determine appropriate action.
- Once determined, we will provide you with a summary of our findings.
- We may publicly acknowledge your contribution to improve the security of our products and services, subject to your agreement.
- We reserve the right to change any aspect of our coordinated disclosure program at any time without notice, as well as for case-by-case exceptions. No particular level of response is guaranteed.