Reporting
Send what you found to trust@neolung.io: what is affected, how to reproduce it, and what you could reach. Don't include patient data, even if you reached it: say that you did, and we will find it.
Testing
While Neolung holds invented data only, you may test against an individual practice you create yourself, with invented cases. Once any organisation is approved for patient data, test only in an environment we provide: ask first.
Our commitments
We confirm we received your report within 3 working days, and tell you within 10 working days what we think and what we will do. We fix critical issues within 48 hours, high within 7 days, medium within 30 days, low with the next routine update, from your report. We keep you informed, and credit you, if you wish, in the fix and in our Trust center.
Safe harbour
We won't pursue research done within this policy, or report it to law enforcement, including under the Computer Misuse Act 1990. We can't authorise testing of other companies' systems: Neolung's providers (Fly.io, Tigris, Auth0, Resend, AI providers) have their own policies.
Please don't
Access, change, delete or keep data that isn't yours (stop and report as soon as you reach someone else's); degrade the service (load testing, denial of service, automated scanning at volume); send spam through the invitation or email features; socially engineer our staff, users or providers; test physical security.
Scope
neolung.io, app.neolung.io and its API under /api, and the desktop app. Out of scope: findings with no security impact, and reports from automated tools without a demonstrated impact.