HealthBeacon Public CVD Policy

POL-0001136 Revision 1.0
Effective: 13-Nov-2026

Scope
HealthBeacon welcomes reports of suspected cybersecurity vulnerabilities affecting its Smart Sharps Bin and firmware, HB Companion App, and associated portals, APIs and cloud services, including third-party components and versions still in use.

Reporting
Email quality@healthbeacon.com with the affected product and version, issue description, safe reproduction steps, potential impact and a return contact. Mark suspected patient harm or active exploitation URGENT.
Do not send patient data, passwords or access tokens. Contact us first to arrange secure transfer of sensitive evidence.

Safe research
Test only where authorised. Obtain written permission before actively testing HealthBeacon-hosted services. Do not test devices in patient use, disrupt treatment or services, or access other people’s data. If personal data is encountered, stop testing and notify us.

Our response
We acknowledge reports within two business days, excluding weekends and Irish public holidays. We assess the risk, provide a contact, and keep the reporter informed of findings, planned actions and estimated timelines.
We prioritise remediation according to risk and validate fixes. Critical vulnerabilities that could cause uncontrolled risks receive updates or patches as soon as possible, outside the normal release cycle.

Coordinated disclosure
We work with reporters and affected suppliers to agree a reasonable disclosure date. Where action is needed, we inform affected users of the relevant products and versions, risks, protective measures and update instructions through direct communications or public advisories. This also covers vulnerabilities identified internally or by suppliers.

Coordination will not delay necessary safety actions or legally required notifications. We use report and contact details to investigate and respond, limit sharing to what is necessary, and handle personal data in accordance with our Privacy Notice.