Incident Response & Data Breach Policy

An incident is any event that threatens the confidentiality, integrity or availability of member data or the platform — for example unauthorised access, accidental disclosure, a lost device, a compromised account, or a service failure that risks data.

Incidents are detected through automated monitoring, reports from members, and reports from partners. Every suspected incident is logged and triaged within 24 hours, and assigned a severity level.

Any incident that may involve a minor's data or safety is treated as high severity and escalated immediately to the safeguarding lead.

The first priority is to stop the harm: revoking access, isolating affected systems, and preserving evidence. We then establish what happened, what data was involved, and who is affected.

Where a personal data breach is likely to risk people's rights and freedoms, we notify the relevant regulator within 72 hours of becoming aware, as required by GDPR/UK GDPR and equivalent laws such as POPIA.

Where a breach is likely to result in a high risk to members, we notify affected members without undue delay. Our notices are written in plain language and always include:

• What happened and when we found out.
• What information was involved.
• What we have done to contain it.
• What you should do (for example reset a password).
• Where to get help.

Where an incident affects a member under 18, we notify the registered parent or guardian as well as the member, in age-appropriate language for the child.

After containment, every incident gets a post-incident review: root cause, what worked, what must change. Changes are tracked to completion and the policy is reviewed annually or after any major incident.

If you believe your account or data has been compromised — or you have found a security issue — email info@myrhythm.io with the subject line "Security incident". We acknowledge reports within 24 hours.