Peppy Health

Security isn't a single yes/no, but Peppy Health is SOC 2 compliant and holds ISO 27001, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Peppy Health hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@peppy.health or via a /security page (Peppy Health lists a security contact).

Peppy Health lists 11 subprocessors on its trust center, including Google Cloud Platform, Mixpanel, Sentry, Customer.IO, Vanta. Buyers use this for fourth-party risk review.

Peppy Health hosts on GCP, and handles Customer personally identifiable information, Personal health information. Data residency details are on its trust center.

Peppy Health's trust center is at https://trust.peppy.health. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Yes, our data is stored within our Google Cloud instance and use AES-256 for our data encryption.

For our clinical product we don't support SSO. As the product is intended for personal use away from an employers system we have deliberately chosen the option for end users to select a personal email address and password for account creation.

We use cloud servers through Google Cloud to store our data. That data is located in their London, UK cluster.

Where your Order Form includes a link which brings you to Vanta, the Customer Subscription Terms, Data Protection Terms and the Information Security Terms apply regardless of the Peppy Service included in your Order Form. However, depending on the Peppy Services included in the Order Form, the following additional terms will also apply to your contract with us: - If your Order Form is for Peppy Clinical Services then you should also read the "Peppy Clinical Services - Service Specific Terms and Conditions" - If your Order Form is for Peppy Global Services then you should also read the "Peppy Global Services - Service Specific Terms and Conditions"

We strongly encourage no/minimal mark up to our terms and conditions as we feel that they already provide a very balanced document which has been agreed with numerous customers. However, if you require any changes to our terms and conditions, we ask that you include these as "Special Conditions" in the Order Form.

Peppy adheres to all applicable data protection legislation in its operating jurisdictions, including: - EU General Data Protection Regulation (GDPR); - UK Data Protection Act 2018; - Health Insurance Portability and Accountability Act (HIPPA); - California Consumer Privacy Act (CCPA); and - All other applicable US state privacy laws We have comprehensive policies and procedures in place to ensure ongoing compliance with these regulations, including regular audits and assessments. Full details regarding how and why we process personal data are available in our privacy policy on the company website.

Data Controller Peppy acts as a Data Controller (within the meaning of applicable data protection legislation in the UK/EU) when collecting data shared directly from end users. This means that Peppy determines the purposes and means of collecting personal data and takes ultimate legal responsibility for processing this data. Data Processor Peppy shall only act as a Data Processor (within the meaning of applicable data protection legislation in the UK/EU) when it has been specifically included within a legal contract between Peppy and a customer. But, this is not standard in our UK customer agreements. In this scenario, the customer is the Data Controller and Peppy is the Data Processor of such data and the relevant data processing clauses would be added to the contract between Peppy and the customer.

Personal data for end users who reside in North, South and Central America is hosted and stored in the USA by our hosting provider,Google Cloud Platform. Personal data for end users who reside anywhere else in the world (excluding North, South and Central America) is hosted and stored in the UK with our hosting provider, Google Cloud Platform, in its London datacentre. Peppy maintains strict data segregation and does not co-mingle end user data between its US and UK hosted locations.

End user personal data is transferred to a select number of trusted providers that are essential for service delivery. Peppy undertakes thorough risk or impact assessments as appropriate in connection with such transfers to third party vendors. We only use lawful mechanisms to transfer such data such as the Standard Contractual Clauses approved by the European Data Protection Board as in force from time to time, and the UK ICO addendum.

Peppy may process a variety of health data in order to provide the services. Health data is primarily processed on the basis of explicit consent. In some cases it may be necessary to process health data on the basis of necessity for the provision of medical care or safeguarding purposes, in accordance with UK GDPR. Peppy may also process ethnicity data for research purposes. Full details of Peppy’s data processing are set out in our Privacy Policy (https://peppy.health/privacy-policy/).

As a Data Controller: - We will notify affected individuals directly within 72 hours of becoming aware of a breach; - We will notify customers in accordance with any contractual specifications; and - We will notify relevant supervisory authorities as required by law. As a Data Processer: - We will notify the customer (as Data Controller) upon becoming aware of a breach; and - We will provide the customer with all necessary information to assist with their investigation and meet their regulatory obligations.

Peppy has insurance with first party cyber coverage as well as third party indemnity coverage. Further details on our policy coverage are available upon request.