Security and Data Protection

1. Security and Data Protection – our approach

CPAPAnalyzer.pl is a platform for analyzing data related to PAP therapy.

Such data may include health-related information. For this reason, the Service is designed around limiting access and processing only the information needed to perform a specific function.

The measures used are developed together with the Service and should be adapted to the nature, scope and risks associated with data processing.

2. What information requires special protection

CPAPAnalyzer may process several different categories of information.

Data related to PAP therapy may constitute health data and is treated as information requiring enhanced protection.

3. Server infrastructure – LH.pl

CPAPAnalyzer.pl's primary infrastructure uses the hosting services of LH.pl.

LH.pl publicly states that its hosting infrastructure is located in Poland and operates in data centers in Warsaw.

The infrastructure provider also states that it uses, among other things:

• 24/7 infrastructure monitoring,
• protection against DDoS attacks,
• protection against brute-force attacks,
• Web Application Firewall mechanisms,
• a backup system,
• regular infrastructure scans.

LH.pl states that it holds ISO 27001 and ISO 9001 certifications.

4. Security and Data Protection – access control

Security and data protection require Therapy Data not to be intended for public disclosure.

Access to private Service functions requires an appropriate Account and authentication.

The access model provides for separation of:

• User Accounts,
• Professional Accounts,
• Facility Accounts,
• personnel roles and permissions,
• assignments of specific Patients to specific persons or Facilities.

A Professional User should have access only to properly assigned Patients and only within the scope of the permissions granted.

5. Registration and login protection

CPAPAnalyzer uses WordPress mechanisms and its own application code to handle registration and login.

The mechanisms used may include:

• login using an email address,
• email address confirmation,
• single-use confirmation tokens,
• nonces protecting forms,
• limiting the number of failed attempts,
• rate-limiting mechanisms,
• a honeypot limiting automated abuse,
• session mechanisms,
• password reset,
• blocking access before the email address is confirmed where required by the registration process.

The User is also responsible for keeping their password and Account access credentials confidential.

6. Data minimization

One of CPAPAnalyzer's core principles is limiting the scope of data transferred between individual system components.

In particular, this means that a given function should receive only the information needed to perform it.

For example:

• the advertising system does not need individual therapy results,
• the AI provider does not need a Patient's home address or telephone number to describe an AHI value,
• a physician should not have access to a Patient who has not been properly assigned to them,
• the public pages of the Service do not require access to a user's private Reports.

7. Security and Data Protection in the AI layer

CPAPAnalyzer may use OpenAI API to create descriptive Interpretation of results.

The adopted model is to limit the data sent to AI.

The following should not be sent to the model when they are not needed:

• first and last name,
• home address,
• telephone number,
• email address,
• the user's entire Account,
• unnecessary information unrelated to the analysis.

Limited therapy results needed to prepare the Interpretation may, however, be sent to the model.

Such information may still constitute health data.

Detailed information about OpenAI's data processing rules can be found in our Privacy Policy.

8. Backups

CPAPAnalyzer backups are handled within the LH.pl infrastructure.

Backups may include, among other things:

• Service files,
• the database,
• WordPress configuration,
• data stored in the Service database.

LH.pl publicly states that it creates backups of its hosting services and stores backups in a separate location.

Deleted data may remain in backups for a limited period until those backups are replaced during the normal backup cycle.

9. Physicians, clinics and Facilities

Professional access requires an additional level of permission control.

The security model provides for:

• individual Accounts for personnel members,
• no sharing of a single password by multiple people,
• the ability to assign Patients,
• the ability to grant and revoke permissions,
• access only to data covered by the relevant authorization,
• revocation of access for a person who has lost authorization.

If a Facility is the data controller and CPAPAnalyzer processes data on its behalf, the cooperation rules also include an appropriate data processing agreement where required.

10. Separation of health data from advertising

Advertising in CPAPAnalyzer may be contextual, meaning that it depends on where it is displayed in the Service.

Advertising should not be selected on the basis of an individual's:

• AHI,
• type of events,
• leak level,
• pressure,
• diagnosis,
• Mask Test result.

A partner may receive aggregate campaign information such as the number of impressions, clicks and CTR.

11. Logs, diagnostics and problem detection

The server and application may record technical information needed to:

• diagnose errors,
• protect Accounts,
• detect abuse,
• limit automated attacks,
• maintain operation of the Service.

Logs may include, for example:

• IP address,
• date and time of the operation,
• technical information about the request,
• error information,
• status of a specific operation.

The scope of logging should be limited to information needed to achieve a specific technical or security purpose.

12. Security and Data Protection – deleting and downloading data

CPAPAnalyzer provides for Users to manage their own data.

The “My Data and Privacy” panel may enable:

• downloading your own data,
• deleting Therapy Data,
• deleting the Account together with its data to the extent permitted by law.

If a given operation is not available automatically, the User may contact the Controller.

More information about rights related to personal data can also be found on the official website of the Polish Personal Data Protection Office (UODO).

Deleting data from the active database does not always mean that it is immediately removed from all existing backups.

13. Incident response

A suspected security breach, unauthorized access or disclosure of data should be analyzed without undue delay.

Depending on the nature of the event, actions may include:

• securing the Account,
• changing or invalidating access credentials,
• revoking unauthorized access,
• analyzing logs,
• fixing code,
• restoring data from a backup,
• informing the appropriate persons where required by the circumstances,
• fulfilling obligations arising from the GDPR where the event constitutes a personal data breach.

14. What we do not currently claim

Transparency also means clearly identifying security measures and certifications that CPAPAnalyzer should not claim without confirmation.

15. What the User can do for security

Account security also depends on how the User uses it.

We recommend:

• using a unique password,
• not sharing login credentials,
• securing your own computer and phone,
• keeping your browser and operating system up to date,
• logging out after using the Account on a shared device,
• changing the password if unauthorized access is suspected,
• not sending therapy data to unauthorized persons.

16. Reporting security issues and vulnerabilities

If you notice an issue that may affect CPAPAnalyzer security or User data, please report it responsibly.

A report may concern:

• unauthorized access,
• incorrect Patient assignment,
• the ability to view another person's data,
• an authorization issue,
• suspected Account takeover,
• a vulnerability in form security,
• other behavior that could lead to data disclosure.

17. Controller and contact

CPAPAnalyzer.pl is operated by: