# Incident response policy

**Draft for review.** Not approved. Owner: `{{SECURITY_OWNER}}`. Last reviewed: `{{REVIEW_DATE}}`.
This draft is not legal advice; notification duties depend on the law that applies to each clinic.

## What counts

Any event that may affect the confidentiality, integrity or availability of clinic data or of the
service: unauthorized access, data sent to the wrong party, lost credentials, a sub-processor
incident, a vulnerability report, or an outage.

## Steps

1. **Report** at once to `{{SECURITY_CONTACT_EMAIL}}` (outside reporters use the trust page).
2. **Triage** within 4 hours: severity, data and clinics affected, whether personal data is involved.
3. **Contain**: revoke sessions and tokens, rotate keys, disable the affected feature.
4. **Record** the incident in the breach register (Settings, Privacy; Phase 8 Part A), which shows
   the 72-hour clock from detection.
5. **Notify** affected clinics without undue delay so they, as controllers, can meet their own duties
   (GDPR, UAE PDPL). Veteros helps them with facts: what happened, which data, which records.
6. **Recover and review**: fix the cause, restore service, write a post-incident review within
   10 working days, and update the risk assessment and this policy.

## Evidence

Breach register entries, the audit log (sessions revoked, tokens rotated), post-incident reviews.