Data Security & Incident Response Policy

1. Purpose and scope

This Data Security & Incident Response Policy ("Policy") describes how MEDCONS protects the personal and health information held on DocGini, and what we do if something goes wrong. It covers the website, mobile application, portals and dashboards, the systems behind them, and everyone who works on them, including staff, contractors and vendors. It supports our Privacy Policy and Terms of Service.

2. Principles

• Confidentiality: information is seen only by people with a genuine need.
• Integrity: records are accurate and changed only by authorised people.
• Availability: patients and Providers can reach their information when they need it.
• Least privilege: every person and system gets the minimum access needed for the job.

3. Access control

• Access is role-based. Patients see their own records and those of family members on their account. Providers and facility staff see only the Patients and functions their role and facility allow.
• Every User has their own login. Shared accounts are not allowed.
• Passwords are stored only as secure one-way hashes, never in readable form.
• Two-factor authentication is available for doctors, and we are extending it to other roles. Two-factor secrets and recovery codes are stored encrypted.
• Sign-in attempts and sensitive actions are rate-limited to slow down guessing and abuse.
• Facilities must remove access for staff who leave or change role, and we review administrator access regularly.

4. Protecting data

• In transit: all traffic to DocGini is encrypted with HTTPS (TLS).
• At rest: data is held on access-controlled servers. Especially sensitive items, such as two-factor secrets and gateway credentials, are additionally encrypted.
• Minimisation: we collect only what the service needs. Message logs do not store message bodies, because they may contain one-time codes.
• Uploads: uploaded files are checked, and images such as SVG logos are rejected if they could carry scripts.
• Backups: data is backed up regularly and backups are protected like live data, in line with our Business Continuity & Disaster Recovery Plan.

5. Secure operations

• Changes to DocGini are reviewed and deployed through a controlled process, with production credentials kept out of source code.
• Servers, frameworks and libraries are kept up to date, and security fixes are applied promptly.
• Test and staging systems use demonstration data, not real patient records.
• Activity on the platform is logged so that misuse can be detected and investigated.
• Vendors that process data for us are chosen and overseen under our Vendor & Third-Party Risk Management Policy.

6. People

• Everyone with access to DocGini systems signs confidentiality obligations and receives security and privacy guidance.
• Staff access production data only when needed to support Users or run the service, and never out of curiosity.
• Breaches of this Policy are disciplinary matters and may be reported to the authorities.

7. What counts as an incident

A security incident is any event that puts the confidentiality, integrity or availability of DocGini data at risk, for example: unauthorised access to an account or record; data sent to the wrong person; a lost or stolen device holding DocGini data; malware; or an outage that makes records unavailable.

8. How we respond

1. Report. Anyone who suspects an incident reports it at once to support@docgini.com. Staff must report internally without delay.
2. Contain. We act to stop further harm, for example by locking accounts, revoking access or taking a system offline.
3. Assess. We work out what happened, what data and which people are affected, and the risk to them.
4. Notify. Where an incident seriously affects personal data, we notify affected Users without undue delay, and aim to do so within 72 hours of confirming it. We also notify the competent authorities where the law requires it.
5. Recover. We restore systems and data safely, from backups where needed.
6. Learn. We record every incident and review serious ones, so the cause is fixed and not repeated.

Notifications explain what happened, what information was involved, what we are doing, and what you can do to protect yourself.

9. What you can do

• Use a strong password that you do not use elsewhere, and turn on two-factor authentication where offered.
• Never share your password or one-time codes. DocGini will never ask for them.
• Sign out on shared devices, and keep your email and mobile number up to date.
• Tell us straight away if you notice anything unusual in your account.

10. Reporting a vulnerability

If you believe you have found a security weakness in DocGini, please report it privately to support@docgini.com with enough detail for us to reproduce it. Do not access other people's data, disrupt the service or share the weakness publicly while we fix it. We will not take action against anyone who reports in good faith and follows these rules.

11. Changes to this Policy

We review this Policy at least once a year and after any serious incident. Material changes will be notified in the same way as changes to the Terms of Service.

Contact Us