Purpose
This SOP establishes the technical, administrative, organizational, and operational safeguards implemented by SiriON to protect personal data, clinical information, academic records, and system infrastructure. It supports compliance with the Digital Personal Data Protection Act, 2023 and Rule 6 of the Digital Personal Data Protection Rules, 2025, and is intended to protect confidentiality, integrity, availability, and reduce risk of unauthorized access, disclosure, alteration, destruction, or loss of data.
Scope
This SOP applies to mobile applications, web applications, SQLite local databases, Supabase infrastructure, PostgreSQL databases, storage buckets, AWS backup repositories, synchronization services, notification systems, authentication services, clinical media repositories, and internal administration systems, as well as founders, employees, contractors, consultants, service providers, and authorized vendors.
Principles
SiriON implements security safeguards based on confidentiality, integrity, availability, accountability, least privilege, and privacy by design.
Data Classification
Information is classified into Public, Internal, Confidential, and Restricted Clinical Data. Restricted Clinical Data includes patient records, clinical notes, clinical photographs, radiographs, consent records, and appointment information and receives the highest level of protection.
Access Control
SiriON implements Role-Based Access Control. Access rights are granted only where operationally necessary, users are assigned the minimum privileges required, administrative privileges are restricted to authorized personnel, and access rights are reviewed periodically.
Authentication
The platform maintains secure authentication mechanisms, password complexity requirements, session management controls, token expiration controls, OTP verification mechanisms, and device authentication safeguards. Default credentials and credential sharing are prohibited.
Encryption
All communications involving personal data use encrypted transport protocols, with TLS 1.2 or higher as the minimum standard and TLS 1.3 as the target standard. Sensitive information such as clinical media, local databases, cloud storage, and backup archives is encrypted where technically feasible, and locally stored clinical information uses device-level and application-level protections.
Database Security
SiriON implements Row-Level Security, access segregation, query restrictions, secure API controls, database audit logging, and change monitoring. Patient records shall not be accessible across unrelated practitioner accounts.
Consent Security
Consent records are time stamped, version controlled, audit logged, and protected from unauthorized modification. Consent logs are maintained as immutable records, and updates or deletion are restricted.
Clinical Media Security
Clinical photographs, radiographs, videos, and attachments are protected through access controls, storage restrictions, encryption mechanisms, audit logging, and export controls. Where technically feasible, metadata stripping is applied to reduce privacy risks.
Application Security
The development team implements input validation, output encoding, secure session management, secure API authentication, dependency monitoring, and vulnerability remediation. Known critical vulnerabilities are prioritized for remediation.
Logging
The platform maintains logs relating to authentication events, access events, synchronization events, export events, consent events, administrative actions, and security events. Logs are protected from unauthorized modification.
Log Retention
Technical system logs are retained for a minimum period of one year. Retention may be extended where required for investigations, legal proceedings, or regulatory compliance.
Telemetry
Where third-party monitoring services are utilized, personal data is minimized, patient identifiers are masked or removed where possible, device identifiers are restricted where possible, and cross-border data transfer risks are assessed. Telemetry providers shall not receive unnecessary clinical information.
Backups
Backups are encrypted, access restricted, periodically tested, and controlled in accordance with applicable requirements. Backup restoration requires authorized approval.
Vendors
Third-party providers undergo security assessment prior to onboarding, with evaluation of data processing practices, security controls, geographic hosting locations, contractual protections, and incident response capabilities.
Detection
Security monitoring identifies unauthorized access attempts, credential abuse, suspicious exports, excessive API activity, unusual synchronization activity, and potential data exfiltration events. Detected events are escalated under the Incident Response Policy.
Incident Response
Security incidents are handled in accordance with the SiriON Incident Response Policy. The response process includes detection, containment, investigation, remediation, recovery, and post-incident review.
Breach Management
Where a personal data breach is identified, SiriON performs impact assessment, preserves evidence, evaluates notifications, assesses regulatory obligations, and implements corrective measures. Affected individuals are notified where required by applicable law.
Change Management
Security-sensitive changes undergo review, testing, approval, and documentation. Changes affecting authentication, consent management, data retention, or security controls receive elevated review.
Business Continuity and Disaster Recovery
SiriON maintains backup systems, recovery procedures, data restoration processes, and service continuity measures so critical systems can be recovered within reasonable operational timelines.
Training
Personnel with access to systems or data receive periodic training covering data protection obligations, security awareness, incident reporting, access control requirements, and confidentiality obligations.
Reviews
The Security & Compliance Team periodically reviews access rights, security logs, vendor controls, encryption controls, backup effectiveness, and incident records. Findings are documented.
Exceptions
Any exception to this SOP must be documented, risk assessed, receive management approval, and include compensating controls where appropriate.
Policy Review
This SOP is reviewed at least annually, following major infrastructure changes, significant incidents, or regulatory updates.
Responsibilities
Security Officer: Overall security governance. Compliance Officer: DPDP compliance oversight. Engineering Team: Implementation of technical controls. Product Team: Privacy-by-design implementation. All Personnel: Compliance with security requirements.
Approval
This SOP forms part of SiriON Health's Information Security Management Framework and is binding upon personnel, contractors, and authorized service providers.