This Information Security Policy sets out the framework under which Vidas Prime Healthcare, S.L. protects its information assets, in the context of Spain's National Security Framework (Esquema Nacional de Seguridad, Royal Decree 311/2022, medium category) and the ISO/IEC 27001:2022 standard.
Vidas Prime Healthcare, S.L. handles sensitive information on which its operations, sustainability, and capacity for growth depend. This information portfolio includes the business information required for its operations, its intellectual property and proprietary know-how, the information of its clients and the third parties it works with, the health information it processes on behalf of healthcare organizations, and the information of its own staff.
The purpose of this document is to establish the organization's Information Security Policy in order to protect information assets against the threats they face, build trust among its clients, and comply with applicable legal and regulatory frameworks.
This policy is the highest-ranking document of the Information Security Management System (ISMS) and provides the framework for preserving the availability, integrity, confidentiality, authenticity, and traceability of information. Management is committed to providing the resources necessary for its implementation.
This policy applies to the entire organization and all of its personnel, both employees and contractors.
The functional scope covers all information assets: information in electronic or paper format; the equipment and materials that support processes; software; network and communications components; the people involved in the information system; the organization's locations; and its own structure and processes.
The scope of the ISMS includes the information systems that support the design, development, operation, and maintenance of the digital health SaaS platform for the intelligent management of healthcare and administrative workflows, clinical data interoperability, and decision support through advanced information processing and anonymization systems, deployed on a cloud architecture, in accordance with the current Statement of Applicability.
The organization seeks conformity with the National Security Framework at the medium category as a qualification for providing services to public sector healthcare organizations.
This policy aims to ensure the availability, integrity, confidentiality, authenticity, and traceability of information and services, as well as of the technology and assets that support them. The objectives set by the organization are:
Management makes the following commitments regarding information security:
The legal and regulatory framework within which the organization conducts its activities includes, among others, the following regulations:
The complete and up-to-date list of applicable legislation and requirements is kept under version control in the register of applicable legislation and requirements, which is reviewed annually by the Security Officer.
The organization relies on its information systems to achieve its objectives. These systems are managed diligently and with appropriate measures to protect them against accidental or deliberate damage that could affect the availability, integrity, confidentiality, authenticity, or traceability of the information processed or the services provided.
6.1. Mission and Principles
The mission of Vidas Prime Healthcare, S.L. is to help its clients turn the complexity of data and digitalization processes into opportunities that enable them to make better decisions and deliver better services. In pursuing this mission, the organization applies the following principles:
6.2. Prevention
The organization applies the security measures required by the National Security Framework (Esquema Nacional de Seguridad) and integrates security into every stage of the system lifecycle. Security requirements and their funding needs are identified and included in planning, as well as in project proposals and tenders. The organization prepares itself to prevent, detect, respond to, and recover from incidents. To this end, it authorizes systems before they go into operation and undergoes periodic third-party reviews in order to obtain an independent assessment.
6.3. Detection
Operations are continuously monitored to detect anomalies in service delivery and act accordingly. Detection, analysis, and reporting mechanisms are established that reach those responsible on a regular basis and whenever there is a significant deviation from the parameters considered normal.
6.4. Response
The organization establishes mechanisms to respond effectively to security incidents, designates a point of contact for incident-related communications (section 7), and defines the protocols for exchanging information about them.
6.5. Recovery
To preserve the availability of critical services, the organization develops continuity and recovery plans proportionate to the level of availability required for each service.
Implementing this policy requires everyone in the organization to understand their obligations and responsibilities based on the position they hold. Security roles are defined as follows:
| Role | Responsibilities |
|---|---|
| Information Security Committee | Proposes this policy and any amendments to it for approval by Management, and approves all other documented information of the management system. Coordinates security, resolves disagreements between roles, and oversees the state of security. Holds regular meetings at least once a year and extraordinary meetings whenever required by a serious incident, a significant change, or the approval of documentation. |
| Information Owner | Determines the security requirements for the information processed and assesses its levels of confidentiality, integrity, traceability, and authenticity. Approves the classification of information and authorizes its uses and disclosures. Accepts the residual risk affecting the information under their responsibility. |
| Service Owner | Determines the security requirements for the services provided and assesses their level of availability. Sets recovery time objectives and maximum tolerable downtime. Authorizes the commissioning and decommissioning of services and accepts the residual risk affecting them. |
| Security Officer | Makes the decisions needed to meet the requirements set by the information and service owners. Oversees the implementation of measures and compliance with this policy and its standards and procedures. Authorizes privileged access and exceptions. Classifies incidents and reports to the Committee. |
| System Manager | Develops, operates, and maintains the information system in accordance with the decisions made by the Security Officer. Defines the security architecture, manages changes and configurations, and maintains the documented information of the management system. |
| All Staff | Complies with this policy and with the documented information of the management system in the performance of their duties, and reports any incidents and anomalous behavior they detect. |
The Information Security Committee is made up of the Security Officer, who chairs it; the System Officer, who serves as secretary; and the Information and Service Owner, who acts on behalf of Management. The systems operations lead (IT & Web Operations Lead) attends its meetings on a permanent basis, with a voice but no vote, and any other persons invited by the Committee may attend on the same terms. The Committee's minutes are signed by the chair, the secretary, and the member acting on behalf of Management.
In accordance with Article 13.3 of Royal Decree 311/2022, the Security Officer is a different person from the System Officer. Given the size of the organization, there is a hierarchical relationship between the two, a circumstance provided for in that article for cases of justified lack of resources. As compensating measures, the Security Officer has direct access to the Security Committee and to Management without going through the System Officer, relevant decisions are made collectively by the Committee, and the organization undergoes independent third-party review.
For the same reason of proportionality, the roles of Information Owner and Service Owner are held by a single person, who is different from the Security Officer and the System Officer, so that the four roles are distributed among three people.
In accordance with Article 13.5 of Royal Decree 311/2022, the Security Officer acts as the security point of contact for the public sector entities receiving the services, through the mailbox seguridad@vidasprime.com.
Regulation (EU) 2016/679 and Organic Law 3/2018 set out the conditions under which personal data may be processed and grant data subjects the rights established therein. The organization processes health data, which constitute a special category of data under Article 9 of the Regulation, and applies to them the enhanced safeguards their nature requires.
Vidas Prime Healthcare, S.L. has appointed a data protection officer, a role performed by an external service, with the following contact details:
The data protection officer monitors compliance with data protection regulations, advises the organization, and acts as the point of contact with the supervisory authority and with data subjects. The officer must be consulted prior to any processing involving health data, any anonymization processes, and any international data transfers. The officer's appointment has been reported to the Spanish Data Protection Agency (AEPD), in accordance with Article 37.7 of the GDPR and Article 34.3 of the LOPDGDD.
The organization collects personal data only when they are adequate, relevant, and limited to the purposes for which they are obtained, and adopts the technical and organizational measures necessary to comply with the regulations. The risks that the processing of personal data poses to the rights and freedoms of individuals are analyzed in accordance with Articles 24, 32, and 35 of the GDPR, with the advice of the data protection officer, and are integrated into the risk analysis described in Section 9. Where the processing so requires, a data protection impact assessment is carried out before it begins.
The systems subject to this policy undergo a risk analysis that assesses the threats and risks to which they are exposed. The analysis is repeated annually and also whenever the information handled changes, the services provided change, a serious security incident occurs, or serious vulnerabilities are reported.
The assessment of the security levels of the information and services is the responsibility of the information and service owners, and the determination of the system category is the responsibility of the Security Officer, in accordance with Article 41 of Royal Decree 311/2022. The Security Committee harmonizes the assessment criteria and promotes the availability of the resources needed to meet security requirements.
When the organization uses third-party services or shares information with third parties, it will make them aware of this policy and of the security regulations applicable to those services or that information. The third party is bound by the obligations set out in those regulations and may develop its own operating procedures to fulfill them.
When a third party cannot comply with any aspect of the policy, a report from the Security Officer will be required specifying the risks incurred and how they will be addressed. That report must be approved by the affected information and service owners before proceeding.
Security training and awareness activities are carried out annually, in accordance with the current training and awareness plan. Their purpose is twofold: to keep personnel who handle information and systems informed about existing procedures, risks, and protective measures, and to raise awareness across the entire organization about the importance of security and about basic practices for handling and exchanging information. The effectiveness of training activities is evaluated and documented.
The Security Committee is responsible for reviewing this policy annually and proposing whether it should be amended or maintained. The policy is approved by Management and communicated to all affected parties. An extraordinary review is also required when applicable regulations change, when the scope of the management system changes, when a serious incident occurs, or when an audit identifies deficiencies related to its content.
This policy is implemented through a set of security regulations that address specific aspects and are available to the people who use, operate, or administer the information systems.
Version 2, approved by Management on October 23, 2026.