Vulnerability Disclosure Policy

Who we are & scope

The security of your data is important to us. This Vulnerability Disclosure Policy explains how to test and report security vulnerabilities in the Vire app, the Vire clip device, and our websites and landing pages, including virehealth.com. It is issued by Vire Health Oy (Business ID 3183533-4) (“Vire,” “we,” “us,” or “our”).

Vire Health Oy is the data controller for any personal data you send us in a vulnerability report, and we handle it in line with the EU General Data Protection Regulation (GDPR).

Vulnerabilities can never be fully eliminated, despite our best efforts. This policy describes which systems and types of tests are authorised and how to send us a report. By testing or reporting under this policy, you agree to follow it.

Authorisation

If you act in good faith to identify and report vulnerabilities in Vire Health systems and comply with this policy, we will work with you to understand and resolve the issues quickly. Vire Health will not pursue legal action against you for identifying vulnerabilities, as long as you follow the guidelines in this policy.

Scope

This policy applies to systems and products from Vire Health, including:

• virehealth.com and its subdomains
• The Vire Clip hardware and firmware (devices that you own)
• The Vire mobile app (iOS and Android)
• The backend APIs and services that the Vire Clip and its app connect to
• Any other software published by Vire Health

Any system not expressly listed above is excluded from scope and is not authorised for testing. Vulnerabilities in systems from vendors, such as mobile operating systems, cloud providers or chipset suppliers, are also excluded and should be reported directly to the vendor under its own disclosure policy.

Guidelines

While carrying out your activities, it is imperative that you

• Do not take advantage of the vulnerability or problem you have discovered, for example by downloading more data than necessary to demonstrate it, or by deleting or modifying other people’s data
• Only use harmless exploits to confirm that a vulnerability is present
• Test only on Vire Clip devices and accounts that you own
• Do not reveal any data obtained during discovery to the public or any other party
• Do not reveal the vulnerability to the public or other parties until we have resolved it or agreed a disclosure date with you; we ask for up to 90 days from your report
• Stop your tests when you discover any sensitive information (personal data, health data, financial or proprietary information, or trade secrets), notify us immediately, and do not disclose it to anyone else

Do not perform the following actions

• Place malware (virus, worm, Trojan horse, etc.) on any system or device
• Compromise any system using exploits to gain full or partial control
• Copy, modify or delete other people’s data, or make changes to our production systems
• Repeatedly access the system or share access with the public or other parties
• Use any access obtained to attempt to access other systems
• Change the access rights of other users
• Use “brute force” attacks to gain access
• Use denial-of-service attacks or social engineering (phishing, vishing, spam, etc.)
• Use attacks on physical security
• Test on a Vire Clip that someone else is wearing, or run tests that could harm the wearer

Reporting a vulnerability

What we would like to see from you

Email your findings as soon as you can to security@virehealth.com. We do not currently support PGP-encrypted email.

In your report, please also:

• Say whether you agree to your name or pseudonym being made public as the discoverer of the problem
• Identify the affected product: the Vire Clip hardware (with hardware revision and firmware version), the Vire App (with platform and version), or the URL or endpoint of the affected service
• Give us enough information to reproduce the problem, such as a description of the vulnerability, the steps taken, and any proof-of-concept code; do not include real users’ personal or health data
• Tell us at the start if the issue could affect the safe operation of the device or the accuracy of its health readings, so that we can treat it as urgent
• Write in English, preferably, or in any other official language of the European Union

What you can expect from us

In return, we promise that when you report a vulnerability we will:

• Respond to your report within three (3) business days with our evaluation
• Handle your report with strict confidentiality
• Keep you informed of progress and, where possible, tell you when the vulnerability has been remedied; we aim to fix critical and high-severity issues within 90 days, and will tell you if a hardware or firmware fix needs longer
• Process the personal data you provide (such as your email address and name) in accordance with applicable data protection legislation, and not pass on your personal details to third parties without your permission
• Publish your name as the discoverer of the problem, if you agreed to this in your initial email, when and if we disclose the problem publicly

No bug bounty

Vire Health does not run a bug bounty programme and does not pay rewards or compensation for vulnerability reports. We are grateful for every valid report, and we will credit you as the discoverer if you agreed to this in your report.