Security

Information Security Policy

ClassificationPUBLIC
Owner and approverPaul Gardner
StandardISO/IEC 27001:2022, Annex A control 5.1

Purpose

This policy sets out how medDigital protects the information it holds for itself, its clients, the people who use its services and its staff. It is the top-level policy of our information security management system (ISMS). The other policies listed on the Security page support it, and together they form the ISMS.

Scope

This policy applies to:

  • All information medDigital creates, receives, stores or sends, in any form
  • The applications and services medDigital develops and runs, and the systems that host and support them
  • Company devices
  • Everyone who works for medDigital, as an employee or a contractor, and suppliers who handle our information

It covers information throughout its life, from creation to deletion.

Our commitments

medDigital will:

  • Protect information against unauthorised access and keep it confidential
  • Protect information against unauthorised change
  • Keep information available to the people allowed to use it, when they need it
  • Meet our legal, regulatory and contractual obligations, including UK GDPR, the Data Protection Act 2018 and, for US users of medCrowd, HIPAA
  • Assess information security risks and treat them to an acceptable level
  • Give everyone who works for us the training they need
  • Report and investigate every security incident and weakness, and learn from it
  • Keep improving the ISMS

Standard

Our ISMS follows ISO/IEC 27001:2022.

Objectives

We set measurable information security objectives and review them every year. They cover how quickly we fix vulnerabilities, whether backups can be restored, training, access reviews and incident handling.

Responsibilities

  • The directors, Paul Gardner and Felix Jackson-McGill, lead the ISMS together. They set this policy and the objectives, provide the resources the ISMS needs, accept residual risk and review the ISMS every year.
  • Paul Gardner is the ISMS owner. He writes and approves the policies and manages information security day to day.
  • Managers make sure the people they manage complete their training and have only the access they need.
  • Everyone who works for medDigital follows the policies and reports security events and weaknesses to security@meddigital.com as soon as they notice them.

Exceptions

If you cannot meet a requirement of any ISMS policy, ask the ISMS owner at security@meddigital.com before you act. The ISMS owner decides, records the exception and the reason for it, and sets a date to review it.

Breaches

A breach of the ISMS by an employee is dealt with under the disciplinary process. A breach by a contractor or supplier is dealt with under their contract.

How we check

The ISMS owner audits the ISMS every year and reports the results, with progress against the objectives, to the yearly management review.

Review

This policy and every other ISMS policy are reviewed every June at the management review, and sooner when there is a significant change. Each review is recorded in the policy's history.

History

DateChange
29th October 2026Rewritten for ISO/IEC 27001:2022 and moved to www.meddigital.com
10th June 2025Periodic review
19th June 2023Periodic review
6th June 2022Periodic review
16th February 2021Periodic review
12th February 2020Periodic review
2nd May 2018Periodic review
14th November 2016Moved to the web. Periodic review
17th May 2016Change of location
31st July 2015Periodic review
8th September 2014Rebranding
3rd July 2014Initial version