Effective 1/1/24

Student health data is extremely sensitive and must be protected. Ensuring the security and privacy of student health information is paramount to Vervet. Vervet is built with HIPPA guidelines in mind. Storing student health information digitally is far more secure than paper documents. Vervet manages access on a user by user basis to ensure the highest level of security and privacy. Student health information is confidential and only shared by the parent to the schools admin and chaperones with parental permission. Chaperones will cease to have access to student information on the last day of the trip. School administration will continue to have access unless otherwise instructed by the parent. There are no official medical records transferred to Vervet at any point nor does Vervet handle any official medical records. 

In an effort to comply with HIPPA guidelines, Vervet has the following procedures in place to ensure the security of sensitive information: 

1. Ensure the confidentiality, integrity, and availability of all e-PHI we create, receive, maintain or transmit; 

To uphold the highest standards of data security and compliance, our company is committed to ensuring the confidentiality, integrity, and availability of all electronic Protected Health Information (e-PHI) that we create, receive, maintain, or transmit. Through the implementation of robust information security policies, encrypted communication channels, access controls, and ongoing staff training, we strive to safeguard e-PHI against unauthorized access, maintain the accuracy and completeness of the information, and ensure its uninterrupted availability to authorized users. 

2. Identify and protect against reasonably anticipated threats to the security or integrity of the information; 

As part of our comprehensive information security strategy, our company is devoted to the identification and mitigation of reasonably anticipated threats to the security and integrity of information within our purview. Through industry best practices, we proactively identify potential risks and vulnerabilities that could compromise the confidentiality, integrity, or availability of our information assets. Once identified, we implement a multifaceted approach to protection, incorporating advanced security measures, access controls and encryption technologies. This proactive stance ensures that we are resilient against emerging threats, adapt to evolving 

security landscapes, and maintain the trust of our users by safeguarding sensitive information with the utmost diligence and precision. 

3. Protect against reasonably anticipated, impermissible uses or disclosures;

In steadfast commitment to privacy and data protection, our company rigorously safeguards against reasonably anticipated, impermissible uses or disclosures of private information. Employing a combination of stringent access controls, encryption protocols, and comprehensive employee training programs, we establish a robust defense mechanism. Additionally, our policies align with the industry, ensuring a proactive and adaptable approach to addressing emerging threats. This holistic strategy reinforces our dedication to maintaining the confidentiality of private information, preventing any unauthorized uses or disclosures, and upholding the trust placed in us by our users. 

4. Ensure compliance by our workforce. 

To ensure unwavering compliance with the highest standards of safeguarding private information, our company prioritizes a culture of awareness, and accountability among our workforce. We have implemented a policy that clearly articulates the expectations and responsibilities of every employee regarding the protection of private information. 

Access controls and permissions are meticulously managed to restrict information access only to authorized personnel. We foster a sense of ownership among employees by emphasizing the critical role each individual plays in upholding our commitment to privacy. 

This document outlines the security measures used to protect customers data based on software that we provide and hosting services. Vervet uses an Amazon Workspace database based in the United States. 

Data Transmission All data transmission between browser/mobile app (In-flight) is transmitted via https/256 bit encryption. So in the event of any access to this data via packet listening on unsecured networks the data transmitted would not be readable or provide any third-party with any relevant information that would represent a security breach.

Data storage (at rest) Any data received into the servers, is firstly decrypted, using a secure encryption key (256 bit) and then, depending on the nature of the data stored in a relational database is plaintext or encrypted. Sensitive data is Re-encrypted, and stored in an encrypted format, so any form of access by staff, both of Vervet and our data centers would not reveal this data in a readable format. Non-sensitive data is stored in plaintext within the relational database, where is accessed only by the system. 

Vervet’s classification of sensitive data We classify data as sensitive that is not in the public domain, so, for example, a customer’s address would not be considered sensitive as this information is readily available on numerous resources. Data such as passwords, medical information, passport information, etc., would be considered sensitive and stored encrypted because this information is not readily available elsewhere and potentially could cause the user distress/harm, if it became compromised. 

Software security Any area of the website or mobile application that has any form of input such as a form is automatically protected from code injections. This prevents anyone from uploading a remotely controlled applications or injecting code into the system that could potentially reveal the data. Typically, this is to prevent what is known as SQL injection. 

Server Security The servers are protected by hardware and software firewalls, which control unauthorized access as well as potential denial of service type activity. Any form of access that provides access to the server and files other than typical browser/app activity is IP restricted. This means we have to grant access to an IP address before any form of access is available to the server. Irrespective of whether someone has a username and password if their IP address is not granted on both firewalls, then access would be prevented. We also extend this security to customers admin areas if required. All potential access ports that are not in use and could provide malicious access are also locked down either by IP address or disabled completely Root access to both servers and firewall are strictly controlled to the owner of the company only. 

Additional server security: Brute force protection Automated software that prevents repeated false, password imports, this will automatically block the user.

Virus scanning. Server runs automated scanning to detect viruses. 

Suspicious activity monitoring An automated service that warns if any suspicious activity is detected on from our customers’ accounts, such as email spamming, potential unauthorized access, attempts to upload executable files.

Staff security policy. Staff are only given access to the websites/mobile apps and they are working on the current time in. This is also controlled by IP restriction allowing us to revoke an access once the work is completed. In the event of any staff member, leaving our employment all access is revoked and reinstated on a 1 to 1 basis to ensure that only the remaining staff have access to our systems and any data. Any potentially vulnerable, usernames and passwords to our systems and external systems are also updated on a regular basis, and at the point of any staff member, leaving our unemployment. 

Multi-Factor Authentication to ensure only authorized users can gain access including “Forgot Password” option. 

Summary

This document is designed to provide an overview of the security measures taken to secure our customers data, if you have additional requirements outside of these, please contact us, and we will put together an individual security policy tailored to your exact requirements 

FAQ’s 

Are there APIs to import / export data? If not, what tools do you have to do this?

Not at this time. We use Excel/CSV to upload information to the application. We are reviewing Blackbaud now. 

Where is the data center located?

The server is an AWS platform located in the United States.

Is it a modular app? Could we use one section without another?

The app is a single, holistic application. Everything is included when downloaded or accessed online. 

Does it allow an SSO?

There is no SSO at this time 

Encrypted data: 

Date of Birth, Passport Number, Allergies Dietary Requirements, Current Medications Medical Conditions