# Business continuity policy

**Draft for review.** Not approved. Owner: `{{SECURITY_OWNER}}`. Last reviewed: `{{REVIEW_DATE}}`.

## Objectives

| Measure | Target |
|---|---|
| Recovery point objective (data that may be lost) | `{{RPO}}` |
| Recovery time objective (time to restore service) | `{{RTO}}` |

## Rules

1. Backups follow `{{BACKUP_POLICY}}`, agreed with `{{DATABASE_PROVIDER}}`: frequency, retention,
   encryption and the region they are kept in. Encrypted objects are backed up with the key id they
   need; the data key is backed up separately from the data.
2. A restore is tested at least every six months into an isolated environment, and the result is
   recorded. Live clinic data restored for a test never reaches development.
3. Recording on the clinic's device keeps working without the network and uploads when it returns
   (chunked, resumable uploads), so a short outage does not lose a visit.
4. If the AI provider is unavailable, clinics keep reading, editing and signing by hand; nothing
   clinical depends on the model.
5. This plan is exercised once a year with a written review.

## Evidence

Backup configuration, restore test records, exercise reviews.