Information Security & Privacy-by-Design Policy

This policy establishes baseline security expectations for protecting MyRhythm accounts, personal information and Minor Content.

It is an internal governance document. It describes how we work, and it does not replace or override the public Privacy Policy, which explains your rights over your data.

Every design and engineering decision is measured against these principles:

• Least privilege — access only to what a role genuinely requires.
• Defence in depth — multiple independent layers of protection.
• Secure defaults and privacy by design.
• Data minimisation — collect only what is needed, keep it only as long as needed.
• Strong authentication, encryption, logging and monitoring.
• Secure development and incident preparedness.

Access to personal information and Minor Content must be role- and need-based. Administrative access is authenticated, authorised, logged, periodically reviewed and revoked when it is no longer needed.

Photographs, videos and audio of minors are stored privately. We use application-layer authorisation and, where practical, short-lived signed URLs.

We do not expose direct public object-storage URLs for private content.

Controls include secure credential handling, mobile verification, rate limiting, session protection and suspicious-activity monitoring.

One-time passcodes are never logged or stored in recoverable plaintext.

Personal information is encrypted in transit and at rest where appropriate to the risk. Backups are protected to the same standard as primary systems.

Our security testing programme includes:

• Dependency scanning and vulnerability management.
• Penetration testing or equivalent independent assurance.
• Access-control testing.
• Media authorisation tests.
• Authentication-abuse tests.

Security and privacy requirements are considered during design, development, code review, testing, deployment and whenever a material change is made to the platform.

Logs are designed to support investigation without unnecessarily recording sensitive information or secret values. One-time passcode values and authentication secrets must never be written to normal application logs.

This policy is reviewed annually, and immediately following any major architectural, regulatory or threat-landscape change. The current version and effective date are shown at the top of this document.