Trust Center · Responsible Disclosure
Found something? Tell us, safely.
We would rather hear about a weakness from a researcher than from an incident. Reports are reviewed by a person, and good-faith reporters will not be threatened with legal action for the act of reporting.
What to include
- A description of the suspected issue and its impact.
- The steps or request needed to reproduce it.
- Affected URLs, endpoints, or components.
- Your contact information and whether you want acknowledgment.
What we commit to
- Acknowledge reports within a reasonable window and keep the reporter informed of progress.
- Work on fixes in priority order — issues affecting patient data first.
- Not pursue action against good-faith research conducted without endangering real patient data, degrading service, or violating privacy law.
What we ask
- Do not access, modify, or exfiltrate real patient data — if your testing touches live records, stop and tell us instead.
- Do not disrupt service or degrade availability.
- Give us a reasonable window to fix before public disclosure.
Report a security concern
Use the contact form and mark your message as a security report — it will reach the team that can act on it.