6.1 Our Commitment to Protecting Your Information

At EasyHealth: Vitals Tracker (“EasyHealth,” “we,” “us,” or “our”), safeguarding your personal and health information is a core operational priority. We implement multi-layered security controls designed to prevent unauthorized access, disclosure, alteration, or destruction of your data.

Our infrastructure, internal policies, and third-party integrations are built to exceed standard consumer security expectations and align with globally recognized frameworks, including ISO 27001, SOC 2, GDPR, and HIPAA security principles.

We continuously assess and upgrade our defenses to adapt to new threats and maintain user trust.

6.2 Encryption and Data Protection

To protect data confidentiality and integrity, EasyHealth uses industry-leading encryption protocols across all transmission and storage layers:

• In Transit: All data transmitted between your device and our servers is protected using Transport Layer Security (TLS 1.2+), ensuring end-to-end HTTPS encryption and preventing interception or tampering.

• At Rest: Sensitive data, including health metrics and personal identifiers, are encrypted using AES-256 encryption — the same standard used by banks and government systems.

• Password Protection: User passwords are securely hashed and salted using strong cryptographic algorithms.

• Key Management: Encryption keys are stored and rotated securely through managed infrastructure, with restricted administrative access.

We never store plaintext passwords, credit card numbers, or unencrypted health metrics on any system.

6.3 Infrastructure Security

Our servers and databases are hosted on certified cloud infrastructure providers compliant with ISO 27001, SOC 2 Type II, and GDPR-aligned controls. These data centers include:

• 24/7 physical security monitoring and biometric access controls;

• Fire suppression systems, power redundancy, and disaster recovery protocols;

• Segmented networks with advanced firewalls and intrusion detection systems;

• Automated patching, system hardening, and continuous vulnerability scans.

  
  

EasyHealth partners with Supabase as its primary database and hosting provider, leveraging built-in security controls, encrypted connections, and role-based access layers.

6.4 Application-Level Security

At the application level, EasyHealth enforces strict security policies, including:

• Authentication Controls: Secure login with session tokens and timed expirations;

• Access Management: Role-based permissions for authorized personnel, enforced through identity verification and least-privilege access models;

• Input Validation: Protection against SQL injection, cross-site scripting (XSS), and other common vulnerabilities;

• Continuous Testing: Routine penetration testing and static code analysis during development cycles.

Our security engineers regularly audit code and infrastructure to identify and mitigate potential vulnerabilities before release.

6.5 Continuous Monitoring and Incident Detection

EasyHealth operates continuous system logging and anomaly detection to identify unusual patterns that may indicate security incidents.
We monitor:

• API access attempts and authentication logs;

• Suspicious network behavior;

• Administrative access activity; and

• System health and uptime metrics.

Detected anomalies are automatically flagged for human review by our security team.

6.6 Breach Prevention and Response Protocol

While no platform can guarantee absolute security, EasyHealth maintains a documented incident response plan to handle potential data breaches swiftly and responsibly.

If a breach affecting your personal or health information occurs, we will:

1. Immediately isolate affected systems and investigate the incident;

2. Notify relevant authorities (if required by law);

3. Inform impacted users within the time period required under applicable regulations (e.g., within 72 hours under GDPR);

4. Provide clear guidance on protective measures you can take; and

5. Implement corrective security updates to prevent recurrence.

6.7 Staff Access and Confidentiality

Access to personal or Health Data is strictly limited to authorized employees and contractors who require it to perform their duties.
All such individuals are bound by confidentiality agreements and undergo security training to ensure proper handling of sensitive data.
Any violation of our internal security or privacy standards results in disciplinary action or termination.

6.8 Third-Party Security Compliance

Before integrating with any third-party service provider (e.g., Supabase, Stripe, RevenueCat), EasyHealth conducts due diligence to ensure they meet or exceed our security and privacy expectations.
We require all vendors to:

• Comply with industry security certifications (ISO 27001, SOC 2, PCI DSS, or equivalent);

• Encrypt user data and maintain strict access controls;

• Promptly disclose any security incidents affecting user data.

We review vendor compliance regularly through contractual audits and re-certification cycles.

6.9 User Responsibilities

While EasyHealth implements robust security controls, user actions also play an important role in protecting data.
We strongly encourage you to:

• Use strong, unique passwords for your EasyHealth account;

• Keep your device software updated;

• Avoid sharing login credentials or screenshots of private data;

• Log out when using shared devices.

Your awareness and safe digital practices help maintain the security of your data and our community.

6.10 Continuous Improvement

EasyHealth treats data security as a living process. We continuously test, audit, and enhance our systems to align with evolving cybersecurity standards and emerging privacy regulations.

We partner with independent security professionals and maintain proactive vulnerability disclosure channels to strengthen our defenses.