Last Updated: November 29, 2025

‍

1. Our Security Commitment

‍

OxyZen Medical Technology LLC is committed to protecting the confidentiality, integrity, and availability of your personal and health data. We implement industry-leading security practices and comply with applicable data protection regulations including:

‍

• HIPAA: Health Insurance Portability and Accountability Act (where applicable)
• GDPR: General Data Protection Regulation (EU)
• CCPA: California Consumer Privacy Act
• ISO 27001: Information Security Management Standards
• SOC 2 Type II: Security and Availability Controls (in progress)

‍

2. Data Encryption

‍

2.1 Data in Transit

‍

✓ All data transmitted between your device and our servers is encrypted using industry-standard protocols.

‍

• TLS 1.3: Transport Layer Security with forward secrecy
• AES-256 encryption: Advanced Encryption Standard for data transmission
• Certificate pinning: Prevents man-in-the-middle attacks in mobile app
• HTTPS only: All web communications encrypted by default
• Bluetooth encryption: Secure pairing between ring and mobile device

‍

2.2 Data at Rest

‍

✓ Your stored data is encrypted using military-grade encryption standards.

• AES-256 encryption: All health data encrypted in our databases
• Encrypted backups: All backup copies are encrypted
• Encrypted file storage: Documents and files encrypted at rest
• Database encryption: Full database encryption enabled
• Key management: Encryption keys stored separately using AWS KMS or Azure Key Vault

‍

2.3 End-to-End Encryption

• Certain sensitive communications use end-to-end encryption
• Health data synced between devices is encrypted locally before transmission
• Only you have access to decrypt certain personal data

‍

3. Data Storage & Infrastructure

‍

3.1 Secure Cloud Infrastructure

‍

OxyZen uses industry-leading cloud providers with robust security certifications:

‍

ServiceProviderSecurity FeaturesData HostingAWS / AzureSOC 2, ISO 27001, HIPAA compliantDatabaseAWS RDS / Azure SQLEncrypted, automated backups, multi-regionFile StorageAWS S3 / Azure BlobEncrypted, versioned, access-controlledCDNCloudFlareDDoS protection, WAF, SSL/TLS

‍

3.2 Data Centers

‍

• Geographic redundancy: Data replicated across multiple regions
• Physical security: 24/7 monitoring, biometric access controls
• Environmental controls: Climate control, fire suppression, backup power
• Compliance certifications: SOC 2, ISO 27001, PCI DSS certified facilities

‍

3.3 Data Residency

‍

• Primary location: United States (US-East region)
• EU data: Stored within EU data centers for GDPR compliance
• Data sovereignty: Compliance with local data residency requirements
• Cross-border transfers: Use of Standard Contractual Clauses where required

‍

4. Access Controls

‍

4.1 User Authentication

‍

✓ Multiple layers of authentication protect your account.

‍

• Strong password requirements: Minimum 8 characters with complexity requirements
• Multi-factor authentication (MFA): Optional 2FA via SMS or authenticator app
• Biometric authentication: Fingerprint/Face ID for mobile app access
• Session management: Automatic logout after inactivity
• Password hashing: Bcrypt with salt for password storage (never plain text)
• Account lockout: Temporary lockout after failed login attempts

‍

4.2 Employee Access

‍

• Least privilege principle: Employees only have access to data necessary for their role
• Role-based access control (RBAC): Strict permission levels
• Access logging: All data access is logged and audited
• Background checks: All employees undergo security screening
• Confidentiality agreements: All staff sign NDAs and security policies
• Access reviews: Quarterly reviews of employee access rights

‍

4.3 API Security

‍

• OAuth 2.0: Secure authorization framework for third-party integrations
• API keys: Unique keys for each integration with rate limiting
• Token expiration: Access tokens expire and require renewal
• IP whitelisting: Restrict API access to approved IP addresses
• API monitoring: Real-time monitoring for suspicious activity

‍

5. Network Security

‍

5.1 Perimeter Security

‍

• Web Application Firewall (WAF): Protection against common web attacks
• DDoS protection: CloudFlare protection against distributed denial of service
• Intrusion Detection System (IDS): Real-time threat detection
• Intrusion Prevention System (IPS): Automatic blocking of suspicious traffic
• VPN access: Secure VPN required for administrative access

‍

5.2 Network Segmentation

‍

• Production, staging, and development environments are isolated
• Database servers are on private subnets with no direct internet access
• Microservices architecture with isolated network zones
• Zero-trust network model implementation

‍

6. Application Security

‍

6.1 Secure Development Practices

‍

Security by Design: Security is built into every stage of development, not added as an afterthought.

‍

• Secure coding standards: OWASP Top 10 compliance
• Code reviews: Mandatory peer review before deployment
• Static code analysis: Automated scanning for vulnerabilities
• Dependency scanning: Regular checks for vulnerable third-party libraries
• Security testing: Penetration testing and vulnerability assessments

‍

6.2 Input Validation & Sanitization

‍

• All user inputs are validated and sanitized
• Protection against SQL injection, XSS, and CSRF attacks
• Parameterized queries for all database operations
• Content Security Policy (CSP) headers implemented

‍

6.3 Regular Updates & Patching

‍

• Critical security patches applied within 24 hours
• Regular updates to all software dependencies
• Automated vulnerability scanning
• Patch management process with testing and rollback procedures

‍

7. Mobile App Security

‍

7.1 App Security Features

‍

• App sandboxing: Isolated app environment on your device
• Secure storage: Keychain (iOS) and Keystore (Android) for sensitive data
• Code obfuscation: Protection against reverse engineering
• Certificate pinning: Prevents man-in-the-middle attacks
• Jailbreak/root detection: App refuses to run on compromised devices
• Screen capture prevention: Sensitive screens cannot be screenshotted

‍

7.2 Device Security

‍

• Biometric authentication support (Face ID, Touch ID, fingerprint)
• Automatic data wipe after multiple failed authentication attempts
• Remote device wipe capability through account settings
• Device encryption required (enforced by iOS/Android)

‍

‍

8. OxyZen Ring Device Security

‍

8.1 Hardware Security

‍

• Secure element: Dedicated security chip for sensitive operations
• Encrypted firmware: Device firmware is digitally signed and encrypted
• Secure boot: Prevents unauthorized firmware modifications
• Tamper detection: Hardware designed to detect physical tampering

‍

8.2 Bluetooth Security

‍

• Bluetooth Low Energy (BLE) with encryption
• Secure pairing process with PIN/passkey
• Connection only to authorized devices
• Automatic disconnect on suspicious activity

‍

8.3 Firmware Updates

‍

• Encrypted over-the-air (OTA) updates
• Digitally signed updates to prevent tampering
• Automatic security patches
• Rollback capability in case of update issues

‍

9. Data Backup & Recovery

‍

9.1 Backup Procedures

‍

• Automated backups: Daily incremental, weekly full backups
• Encrypted backups: All backups encrypted at rest
• Geographic redundancy: Backups stored in multiple geographic locations
• Retention policy: Backups retained for 90 days
• Backup testing: Regular restoration tests to ensure data integrity

‍

9.2 Disaster Recovery

‍

• Recovery Time Objective (RTO): 4 hours maximum downtime
• Recovery Point Objective (RPO): Maximum 1 hour of data loss
• Failover systems: Automatic failover to backup systems
• Business continuity plan: Documented procedures for disaster scenarios
• Annual testing: Full disaster recovery drills

‍

10. Monitoring & Incident Response

‍

10.1 Security Monitoring

‍

✓ 24/7 automated monitoring and alerting for security threats.

‍

• Real-time monitoring: Continuous monitoring of all systems
• Security Information and Event Management (SIEM): Centralized log analysis
• Anomaly detection: AI-powered detection of unusual activity
• Alert escalation: Automatic escalation of critical security events
• Audit logging: Comprehensive logs of all system activities

‍

10.2 Incident Response

‍

In the event of a security incident, we follow a structured response process:

‍

1. Detection & Analysis: Identify and assess the security incident
2. Containment: Isolate affected systems to prevent further damage
3. Eradication: Remove the threat and close vulnerabilities
4. Recovery: Restore systems and verify normal operation
5. Post-Incident Review: Analyze incident and improve security measures
6. Notification: Inform affected users as required by law (within 72 hours for GDPR)

‍

10.3 Security Incident Notification

‍

If a security breach affects your data, we will:

• Notify you within 72 hours of discovering the breach (GDPR requirement)
• Provide details about what data was affected
• Explain the steps we're taking to address the breach
• Offer guidance on protecting yourself
• Notify relevant regulatory authorities as required

‍

11. Third-Party Security

‍

11.1 Vendor Management

‍

• Due diligence: Security assessments before engaging vendors
• Contracts: Data processing agreements with security requirements
• Regular audits: Annual security reviews of key vendors
• SOC 2 compliance: Preference for SOC 2 certified vendors
• Limited access: Vendors only access data necessary for services

‍

11.2 Third-Party Integrations

‍

• All integrations reviewed for security before approval
• OAuth 2.0 authorization with limited scopes
• User consent required for data sharing
• Regular security reviews of active integrations
• Ability to revoke access at any time

‍

12. Compliance & Certifications

‍

12.1 Current Compliance

‍

Standard/RegulationStatusDescriptionGDPR✓ CompliantEU data protection regulationCCPA✓ CompliantCalifornia consumer privacy rightsHIPAA✓ AlignedHealth data security standardsSOC 2 Type IIIn ProgressSecurity controls audit (expected Q2 2026)ISO 27001PlannedInformation security management (target 2026)

‍

12.2 Regular Audits

‍

• Internal audits: Quarterly security audits by internal team
• External audits: Annual third-party security assessments
• Penetration testing: Semi-annual ethical hacking tests
• Compliance audits: Regular GDPR and CCPA compliance reviews

‍

13. User Security Best Practices

‍

Your Role in Security: While we implement robust security measures, your security also depends on your actions. Follow these best practices:

‍

13.1 Account Security

‍

• Use a strong, unique password: At least 12 characters with mix of letters, numbers, symbols
• Enable two-factor authentication: Add an extra layer of security
• Don't share your password: Keep credentials confidential
• Use a password manager: Securely store and generate strong passwords
• Change password if compromised: Update immediately if you suspect unauthorized access

‍

13.2 Device Security

‍

• Keep devices updated: Install OS and app updates promptly
• Enable device encryption: Use built-in encryption features
• Use screen lock: PIN, pattern, or biometric lock
• Install from official sources: Only download apps from App Store/Google Play
• Don't jailbreak/root: Compromises device security

‍

13.3 Recognize Phishing

‍

Warning: OxyZen will NEVER ask for your password via email, text, or phone. Be wary of suspicious messages claiming to be from OxyZen.

• Verify sender email addresses carefully
• Don't click links in suspicious emails
• Verify requests by contacting us directly
• Report suspicious communications to hello@oxyzen.ai

‍

13.4 Public Wi-Fi

• Avoid accessing sensitive information on public Wi-Fi
• Use a VPN when on public networks
• Ensure HTTPS is enabled (look for padlock icon)
• Disable auto-connect to Wi-Fi networks

‍

14. Data Retention & Deletion

‍

14.1 Data Retention

• Active accounts: Data retained while account is active
• Inactive accounts: Accounts inactive for 3+ years may be deleted
• Health data: Retained according to user preferences (can be deleted anytime)
• Transaction records: Retained for 7 years for tax/legal compliance
• Logs: Security logs retained for 1 year

‍

14.2 Secure Data Deletion

• User-initiated deletion: You can delete your data anytime via app settings
• Account deletion: Full account deletion within 30 days of request
• Secure erasure: Data securely overwritten, not just marked for deletion
• Backup deletion: Data removed from backups within 90 days
• Deletion confirmation: Email confirmation when deletion is complete

‍

15. Privacy by Design

‍

OxyZen incorporates privacy and security into every aspect of our product:

• Data minimization: We only collect data necessary for our services
• Purpose limitation: Data used only for stated purposes
• User control: You control your data and privacy settings
• Transparency: Clear communication about data practices
• Default privacy: Strictest privacy settings by default

‍

16. Vulnerability Disclosure

‍

16.1 Responsible Disclosure Program

‍

We welcome reports of security vulnerabilities from security researchers and users.

‍

Report Security Issues: If you discover a security vulnerability, please report it to security@oxyzen.ai

‍

When reporting, please include:

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact assessment
• Your contact information

‍

Our commitment:

• We will acknowledge your report within 48 hours
• We will investigate and respond with our findings
• We will not pursue legal action against researchers who follow responsible disclosure
• We may offer recognition for significant findings (with your permission)

‍

16.2 Bug Bounty Program

‍

We are planning to launch a bug bounty program in 2026 to reward security researchers for discovering vulnerabilities.

‍

17. Updates to Security Practices

‍

We continuously improve our security measures. Updates to this document will be posted with a new "Last Updated" date. Significant changes will be communicated via:

‍

• Email notification to all users
• In-app notification
• Website announcement

‍

18. Contact Our Security Team

‍

For security-related questions or to report a security issue:

‍

OxyZen Medical Technology LLC
PA 15238
United States

‍

Security Email: security@oxyzen.ai
Privacy Email: privacy@oxyzen.ai
General Inquiries: hello@oxyzen.ai
Phone: +1 646 989 3331

‍

Security Incident Reporting: security@oxyzen.ai (monitored 24/7)

‍

For PGP-encrypted communications: PGP key available upon request

‍

Your Security is Our Priority: We are committed to maintaining the highest standards of security and data protection. If you have any questions or concerns about how we protect your data, please don't hesitate to contact us.

‍