Vulnerability Disclosure Policy

Optomed Vulnerability Disclosure Policy (VDP)

1. Purpose

This policy describes how Optomed handles reports concerning cybersecurity vulnerabilities affecting its medical devices and related software. The purpose is to support patient and device safety and regulatory compliance throughout the product lifecycle.

The policy is intended for reporters and Optomed’s internal stakeholders. It describes the reporting channel, required information, handling principles, coordinated disclosure, and safe harbor protection offered to reporters.

2. Scope

This policy applies to Optomed’s products, systems, and stakeholders as follows:

• All medical devices manufactured by Optomed
• Related software, mobile applications, cloud services, and firmware
• Internal and external stakeholders, including researchers, customers, and authorities
• All employees, subcontractors, suppliers, and external parties who interact with the company’s systems, products, or data

In this policy, vulnerability means a weakness in a product, software, service, or related system that may compromise cybersecurity, data protection, performance, or patient safety. A reporter is an individual or organization that reports a potential or suspected vulnerability to Optomed.

3. Reporting Channels

Vulnerabilities may be identified from various sources, such as internal testing, supplier or customer reports, third-party assessments, post-market surveillance, threat intelligence, or other external reports.

Potential or suspected vulnerabilities must be reported through the following channel:

• Optomed website vulnerability reporting form

4. What to Include in a Report

The report should include the following information, where available:

• Device name and model
• Software or component information
• Description of the vulnerability and its impact
• Steps to reproduce or other supporting evidence
• Potential impact on information security, performance, or patient safety
• Any workaround or proposed remediation
• Possible contact details for further communication

5. Our Commitment

• We will acknowledge receipt of the report within 5 business days
• We will assess vulnerabilities in accordance with a documented risk-based process
• We will determine and implement necessary corrective or mitigating actions
• We will use relevant findings in applicable PMS, risk management, CAPA, and documentation processes
• We will assess any reporting, communication, and escalation obligations
• We will cooperate with reporters as appropriate
• We will publicly acknowledge researchers only with their prior consent

6. Coordinated Disclosure

Optomed coordinates the disclosure of vulnerabilities with the reporter. The target timeline is 90 days from receipt of the report, unless the severity of the vulnerability, patient safety considerations, or remediation measures require otherwise.

• The reporter is expected to keep the information confidential for 90 days, unless otherwise agreed in writing.
• Earlier disclosure may be possible to address a material risk or pursuant to law or an authority requirement.

7. Legal Safe Harbor

Optomed does not generally take legal action against individuals who meet the following conditions:

• Act in good faith
• Avoid causing harm to patients or systems
• Do not exploit, disseminate, or disclose the vulnerability except to the extent necessary to report it to Optomed

8. Governance and Integration

This policy is part of Optomed’s quality and information security framework. Relevant vulnerability information is assessed and integrated, as applicable, into post-market surveillance, risk management, corrective and preventive action processes, software maintenance activities, and information security vulnerability management practices.

Questions and improvement suggestions regarding this policy may be sent to: ithelpdesk@optomed.com.

Content last reviewed on 16 June 2026 Version 1.0