Information Security Policy
IN ACCORDANCE WITH THE ISO/IEC 27001 STANDARD
Biotechmed S.r.l. considers the information that users entrust to or process through the service it provides to be a valuable asset.For this reason, Biotechmed assumes responsibility for protecting and safeguarding this asset, committing to ensure that the information can be used with due assurance of accuracy and completeness and is adequately protected against misuse, unauthorized disclosure, and damage or loss.
This Information Security Policy therefore expresses the commitment to ensure the security of information, as well as the physical, logical, and organizational tools used to process information in all its activities, and to ensure the confidentiality, integrity, and availability of the critical or sensitive information entrusted to it, implementing appropriate controls to prevent breaches of these requirements.
The objectives of the Information Security Policy are:
- To strengthen the company’s reputation as a reliable and competent data manager To protect the company’s information assets and the services falling within the scope of this policy
- To gain a competitive advantage over other market players providing similar services by highlighting the value of information to Biotechmed
- To prevent, as much as possible, service disruptions for users of software services provided via SaaS
- To adopt measures designed to ensure employee retention and professionalism To fully comply with the provisions of current and binding regulations
- Increase staff awareness and expertise regarding security issues
For data on cloud-based platforms, the following activities are carried out to ensure information security:
- Continuous assessment of risks associated with privileged access by internal staff, ensuring that authorizations are relevant and limited to the purpose of the activity, and tracking of activities
- Guarantee, from the design phase, data isolation for each customer through specific logical segregation
- Implementation of control procedures for administrative access to cloud services Specific communications to cloud service customers sent via email and through alerts on the portal itself well in advance to facilitate change management
- Particular attention to virtualization security and to the access and protection of cloud service customers’ data
- Procedures in place for managing the lifecycle of cloud service customer accounts
Notifications of any security breaches are always provided, and guidelines for sharing information with the relevant authorities are followed
Last revision of this text: 10/10/2025
