Asset Management and Information Handling Policy

Classification	PUBLIC
Owner and approver	Paul Gardner
Standard	ISO/IEC 27001:2022, Annex A controls 5.9, 5.11 to 5.14, 7.10 and 8.10

Purpose

This policy sets out how we identify the information and equipment we are responsible for, how sensitive each kind of information is, and how it must be stored, shared, kept and disposed of. It matters most for the materials our clients entrust to us.

Scope

This policy applies to all information medDigital holds, in any form, and to all company equipment. It applies to everyone who works for medDigital, as an employee or a contractor.

Knowing what we have

Company equipment is recorded in our user management system, with who holds it. Line managers record when it moves.
We keep an internal register of our information assets, each with an owner and a classification.

Classification

All information has one of four classifications. Information that has not been classified is CONTROLLED. Where information of different classifications is combined, the highest applies to all of it.

Classification	What it covers	Who may see it
PUBLIC	Information marked as public, or already in the public domain	Anyone
CONTROLLED	All client materials, including those the client marks confidential, and company information	Staff and contractors who need it for their work, and people outside medDigital as set out under Sending and sharing information
RESTRICTED	Our own sensitive information, such as strategic plans or disciplinary records	Only the people who need it for their role
PERSCONF	Confidential information about an identifiable patient, such as a patient discussed in a medCrowd conversation	The healthcare professionals in that conversation, and medDigital staff whose role requires it, such as safety reviewers

Material about a patient made with their consent for use in our work, such as a patient story, is CONTROLLED, or PUBLIC once published.

Classification does not replace our duties under data protection law, which apply to all personal information.

Handling information

Client materials are kept on M:\ and worked on only on company-owned devices. Anyone working on a device the client provides keeps that client's materials on the client's systems.
Where a client's contract limits who may see their materials, we follow the contract.
A confidentiality agreement must be in place before client materials are shared with anyone other than the client they belong to, unless the client has asked us to share them.
Company information is shared outside medDigital only as the business needs, for example proposals to prospective clients or papers for our professional advisers.
PERSCONF information is processed only within medCrowd. It must never be copied out of medCrowd, downloaded, printed or captured in a screenshot, except where the law requires it, such as reporting an adverse event, and then only the minimum needed, through our approved safety reporting route.

You may only send information to people its classification allows. A client's materials may go only to that client, to anyone the client asks us to send them to, or to a supplier or partner working on that client's work under a confidentiality agreement. Personal information is sent only when it is needed, and only to people entitled to receive it.

The table shows how information may be sent:

Method	PUBLIC	CONTROLLED	RESTRICTED	PERSCONF
M:\	Yes	Yes	Yes	No
Our secure file transfer service	Yes	Yes	Yes	No
Email within medDigital	Yes	Yes	Yes	No
Email outside medDigital	Yes	Yes	No	No
Microsoft Teams messages and files	Yes	Yes	Yes	No
The client's own systems, such as their review platform, file sharing or meeting tools	Yes	Yes	No	No
Encrypted removable media	Yes	Yes	Yes	No
Courier (tracked and signed for)	Yes	Yes	Yes	No
Post	Yes	No	No	No
medCrowd	Yes	Yes	Yes	Yes

Before sending client materials, check the recipients. A message sent to the wrong person is an incident and must be reported under the Incident Management Policy.

Removable media

Our laptops and desktops can write only to removable media that is encrypted. This is enforced technically.
When encrypted media is sent to someone, the key or password is sent separately, never with the media.

Keeping and deleting information

Client materials are deleted seven years after the project ends, the time limit for contract claims, or sooner if the client's contract requires. They are kept longer only while a legal claim requires it. We do not return client materials. We delete them.
Other information is kept only as long as the law, a contract or the business requires.
Deleted information remains in backups until they expire, as set out in the Backup Policy.

Returning and disposing of equipment

When someone leaves, their line manager makes sure all company equipment is returned, and records it.
Equipment that is no longer needed goes back to IT, which erases it securely before it is reused or disposed of.
Anyone who loses company equipment, or has it stolen, reports it at once as an incident.

How we check

The information asset register and the equipment records are reviewed at the yearly management review. The yearly internal audit checks a sample of client materials for correct storage and classification, and checks that equipment from leavers was returned.

Exceptions, breaches and review follow the Information Security Policy.

History

Date	Change
29th October 2026	Rewritten for ISO/IEC 27001:2022 as Asset Management and Information Handling, combining the Asset Management, Information Classification and Media Handling policies, and moved to www.meddigital.com
10th June 2025	Periodic review
19th June 2023	Periodic review
6th June 2022	Periodic review
16th February 2021	Periodic review
27th February 2020	Microsoft Teams replaces Skype for Business
12th February 2020	Periodic review
5th July 2019	Email to approved partners added
20th March 2019	Transfer tool renamed medDigital Secure File Transfer
6th December 2018	Documents are CONTROLLED by default. The secure file transfer service may carry up to RESTRICTED
15th May 2018	Periodic review. Physical assets recorded in the user management system
13th December 2016	PERSCONF added for patient-identifying information
5th December 2016	Asset Management and Media Handling policies created
14th November 2016	Moved to the web
17th May 2016	Initial version