Security

Compliance, Legal and Privacy Policy

ClassificationPUBLIC
Owner and approverPaul Gardner
StandardISO/IEC 27001:2022, Annex A controls 5.31 to 5.37

Purpose

This policy sets out how we identify and meet the laws, regulations and contracts that apply to the information we hold, and how we check that our policies are followed.

Scope

This policy applies to all of medDigital's work and information, and to everyone who works for medDigital.

We keep an internal register of the laws, regulations and contractual terms that apply to us, and how we meet each one. It is reviewed every year, and whenever a requirement changes. It includes:

  • UK GDPR and the Data Protection Act 2018
  • The Privacy and Electronic Communications Regulations
  • The Computer Misuse Act 1990
  • HIPAA, for users of medCrowd in the United States
  • The ABPI Code of Practice, for the materials we produce for pharmaceutical clients
  • The security and confidentiality terms in our clients' contracts

Each client's terms are identified when the work is agreed, as set out in the Organisation, Roles and Risk Policy.

Privacy

  • We are registered with the Information Commission (ICO).
  • We process personal data lawfully, only for clear purposes, and keep no more than we need.
  • We tell people how we use their personal data, in our privacy policy and, for staff, our employee privacy notice.
  • When we process personal data on a client's behalf, we do so under a written agreement and only on their instructions.
  • Personal data breaches are handled under the Incident Management Policy.

Intellectual property

  • We use software, images, fonts, data and other third-party material only as their licences allow.
  • Third-party material is checked and, where needed, licensed before it is used in client work or in our products.
  • We respect our clients' intellectual property and use their materials only for the work they asked us to do.

Records

Records are protected against loss, destruction, falsification and unauthorised access, and kept for as long as the law, our contracts and the business require, as set out in the Asset Management and Information Handling Policy.

Encryption and the law

We use encryption in line with the laws of the countries where we work. Some countries restrict bringing encrypted devices in, which is one reason travel abroad with company equipment needs approval, as set out in the People Security Policy.

Checking compliance

  • Line managers check every quarter that work in their area follows our policies, and record what they find.
  • Our systems are checked continuously and by regular scans, as set out in the Operations Security Policy.
  • The ISMS owner audits the ISMS every year against a written programme and reports the results to the directors.
  • Anything found is recorded and tracked until it is put right.

Documented procedures

The procedures that put these policies into practice are written down, kept up to date and available to the people who need them.

How we check

The register of requirements and the results of compliance checks are reviewed at the yearly management review.

Exceptions, breaches and review follow the Information Security Policy.

History

DateChange
29th October 2026Rewritten for ISO/IEC 27001:2022 as Compliance, Legal and Privacy, replacing the Compliance Policy, and moved to www.meddigital.com
10th June 2025Periodic review
19th June 2023Periodic review
6th June 2022Periodic review
16th February 2021Periodic review
12th February 2020Periodic review
15th May 2018Updated for the move to the M: drive
5th December 2016Initial version