Acceptable Use Policy
| Classification | PUBLIC |
|---|---|
| Owner and approver | Paul Gardner |
| Standard | ISO/IEC 27001:2022, Annex A controls 5.10, 7.7 and 8.12 |
Purpose
This policy sets out how everyone who works for medDigital may use our equipment, accounts and services, so that client materials and company information stay protected in everyday work.
Scope
This policy applies to everyone who works for medDigital, as an employee or a contractor, and to all company equipment, accounts and services.
Company equipment and accounts
- Company equipment and accounts are provided for work. Occasional personal use is fine, as long as it is legal, does not get in the way of work and does not put company information at risk.
- Company information is used only on company-owned devices and company accounts, never on personal ones.
- Only IT installs software. Browser extensions are limited to an approved list.
- Do not try to get around a security control. If one stops you doing your job, ask IT.
- Look after the equipment you are given, and report any loss, theft or damage at once.
Email and messages
- Use your company email and Teams account for all work. Do not forward work email to a personal account.
- Check who you are sending to before you send client materials.
- Be wary of unexpected links, attachments and requests, especially ones asking for passwords or payments. Report anything suspicious to security@meddigital.com.
External services and AI tools
Never put CONTROLLED, RESTRICTED or PERSCONF information into an AI tool or any other external service, such as personal file storage or a free online converter, unless the ISMS owner has approved that service for that use and, for client materials, the client has agreed.
The classifications are set out in the Asset Management and Information Handling Policy.
Clear desk and clear screen
- Lock your screen whenever you leave your computer.
- Print client materials only when you need to. Collect printing straight away, lock it away when you are not using it, and shred it when you have finished.
- Make sure nobody can see or overhear client materials when you work in public places or on calls.
Social media and public comment
Never share client materials or confidential company information on social media or anywhere public, or name a client in connection with their work without their permission.
Monitoring
We monitor the use of our systems to keep them and the information on them secure, in line with the law and our employee privacy notice.
How we check
Everyone confirms they have read this policy when they join and every January with their training. The yearly internal audit checks a sample of approved external services against their approvals.
Exceptions, breaches and review follow the Information Security Policy.
History
| Date | Change |
|---|---|
| 29th October 2026 | Initial version |