Cyberimpact maintains a comprehensive information security program designed to support the confidentiality, integrity, and availability of customer data.

Key components of our program include:

• Security governance and risk management
• Secure software development practices
• Vulnerability management
• Incident response procedures
• Business continuity and disaster recovery planning
• Third-party security assessments
• Continuous monitoring and logging
• Employee confidentiality obligations
• Periodic access reviews
• Security awareness and privacy training

Cyberimpact maintains documented procedures for identifying, investigating, managing, and responding to security and privacy incidents.

Our incident management processes include:

• Incident detection and monitoring
• Investigation and impact assessment
• Containment and remediation activities
• Internal escalation procedures
• Post-incident review and corrective actions

Where required by contract or applicable law, customers will be notified of incidents affecting their information.

Cyberimpact evaluates vendors and service providers that support the delivery of its services through security and risk assessment processes.

Where appropriate, service providers are subject to contractual, security, confidentiality, and privacy requirements designed to protect customer information and support Cyberimpact's security program.

Access to customer information is restricted to authorized personnel with a legitimate business need and governed by applicable security controls.

Protecting personal health information is a shared responsibility between Cyberimpact and its customers.

Cyberimpact provides safeguards and operational controls designed to support the protection of personal health information. Customers remain responsible for:

• Configuring and using the platform appropriately
• Managing user access and permissions
• Determining what information is collected, stored, or transmitted
• Establishing internal privacy and security policies
• Managing consent requirements where applicable
• Ensuring compliance with applicable legal and regulatory obligations
• Training their workforce on privacy and security requirements

To help protect personal health information and reduce privacy risks, Cyberimpact recommends that customers:

• Limit the collection and use of personal health information to what is necessary
• Avoid including unnecessary sensitive information in email content
• Apply least-privilege access principles
• Regularly review user access permissions
• Establish privacy and security training programs
• Use secure portals or controlled-access environments for highly sensitive information
• Implement internal breach response procedures
• Maintain appropriate retention and disposal practices for personal information

Upon request and subject to appropriate confidentiality protections, Cyberimpact may provide additional security and compliance documentation, including:

• SOC 2 Type II Report
• System Security Plan (SSP)
• Penetration Test Summary
• Security Questionnaires
• Additional Security and Compliance Documentation

Organizations seeking additional information may contact our team to discuss their security, privacy, and compliance requirements.

Cyberimpact is a Canadian company and operates its platform from infrastructure located in Canada.

Customer data is hosted in Canadian data centres, helping organizations address data residency considerations and supporting compliance with Canadian privacy requirements.

PHIPA does not provide a formal certification program.

Cyberimpact does not claim certification under PHIPA. Instead, Cyberimpact maintains administrative, technical, and organizational safeguards designed to support healthcare organizations in protecting personal health information and meeting their privacy obligations.

Compliance with PHIPA ultimately depends on how each organization configures, uses, and governs its own environment, processes, and data.