Skip to content
Introducing the next phase of Sovica: the architecture for agentic care
Log inBook a demoStart for free

Vulnerability Disclosure Policy

Clinics trust Sovica with patient data. If you find a weakness in our security, we want to hear about it, and we want you to feel safe telling us.

Draft: pending legal review

This policy explains how to report a security vulnerability to us, and what you can expect in return.

Guidelines

When you research or report a vulnerability, please:

  • test only against accounts you own, or a test environment we have agreed with you;
  • never access, change, download or keep patient data or anything belonging to another customer. If you come across any, stop, tell us straight away and delete your copy;
  • avoid anything that could disrupt care, such as denial of service, spam, or social engineering of clinics or staff;
  • give us reasonable time to fix the issue before telling anyone else about it.

Safe harbour

If you act in good faith and follow this policy, we will treat your research as authorised, we won’t take legal action against you for it, and we will say so if anyone else asks. We can’t bind third parties, so check with us first if you’re unsure whether something is covered.

Within scope

  • The Sovica product and its APIs.
  • This website and our other public sites.
  • [Further domains to be confirmed.]

Outside of scope

  • Third-party services we use, which you should report to their owners.
  • Findings from automated scanners with no demonstrated impact.
  • Missing headers or best practices with no route to exploitation.
  • Physical attacks, or attacks on our staff or our customers’ staff.

How to report a security vulnerability

Use our Vulnerability Disclosure Form, or email security@sovica.ai. Tell us what you found, where it is and how to reproduce it. We aim to acknowledge reports within [2] working days and will keep you posted until the issue is fixed. Please don’t include patient data in your report.