Sub-millimetric, patient-specific brain targeting for functional neurosurgery and real-world outcomes in Parkinson’s Disease and Essential Tremor.

Security vulnerability disclosure policy

Introduction

Rebrain develops and operates software used in neurosurgical planning. We are committed to the security of our products and to the protection of the data they process. This policy explains how to report potential security vulnerabilities to us, what we ask of reporters, and what reporters can expect from us.

We welcome reports from security researchers, customers, users, suppliers, and any other party.

Scope

You can report vulnerabilities affecting:

  • OptiMATE and OptimMRI, our medical device software;
  • the data exchange platform used by healthcare professionals to send and receive data;
  • third-party components used in these products.

Vulnerabilities in the systems or software of our suppliers should preferably be reported directly to the supplier, according to its own disclosure policy. You may also report them to us, and we will coordinate with the supplier.

To report an incident that has affected or could affect a patient, please follow the incident reporting instructions in the user documentation rather than this policy.

No testing authorization

This policy does not authorize active testing of Rebrain systems. Our systems process patient data. If you discover a vulnerability, for example while using our services in the normal course of your activity, please report it to us as described below. Please note that it is imperative that you:

  • do not access, modify or delete data that does not belong to you; if you encounter patient or other sensitive data, stop immediately, notify us and do not disclose this data to anyone else;
  • do not use an exploit beyond what is strictly necessary to observe the vulnerability, and do not use it to exfiltrate data, establish persistent access or reach other systems;
  • do not perform denial of service, physical or social engineering attacks, and do not use credentials or accounts that do not belong to you.

Good faith

Rebrain will not recommend or pursue legal action against persons who report a vulnerability in good faith and in accordance with this policy.

Reporting a vulnerability

Please send your report to it@rebrain.eu with the subject “Security vulnerability report”. Reports may be submitted anonymously; contact information is optional, but it allows us to keep you informed.

Information submitted under this policy is used for defensive purposes only, to mitigate or remediate vulnerabilities. If your findings affect other organizations or users of a product beyond Rebrain’s scope of action, we may share your report with a coordinating authority such as CISA or CERT-FR. We will not share your name or contact information without your express permission.

Please do not include patient data or other personal data in your report. If your report contains sensitive technical details, you may first send a short notification without them; we will agree with you on a secure way to share them.

What we would like to see from you

To help us triage and prioritize reports, we recommend that your reports:

  • describe the affected product or service, where the vulnerability was observed, and its potential impact, including any potential impact on patient safety;
  • describe the steps needed to reproduce the vulnerability, where known;
  • are written in English or French, if possible.

Reports that contain only automated scanner output may receive a lower priority.

What you can expect from us

When you share your contact information, we commit to coordinating with you as openly and as quickly as possible:

  • within 2 business days, we will acknowledge that your report has been received;
  • to the best of our ability, we will confirm the existence of the vulnerability and be transparent about the steps we are taking during remediation, including issues that may delay resolution;
  • we will maintain an open dialogue to discuss issues;
  • with your agreement, we will acknowledge your contribution once the vulnerability is resolved.

If communication breaks down, we may involve a neutral coordinating authority, such as CISA or CERT-FR, to help determine how to proceed.

How we disclose vulnerabilities

When a vulnerability affects our products and internal investigation confirms that it poses a non-negligible risk to patient safety and/or information security, we inform the affected customers of the issue, its potential impact, any interim measures and the remediation. When a newly discovered vulnerability may affect parties other than our customers, we publish an advisory and request a CVE identifier, in coordination with the reporter and, where applicable, with the supplier concerned or the competent authorities.

We ask that you do not disclose the vulnerability publicly before it has been resolved, or before 90 calendar days after your report, whichever comes first, unless agreed otherwise with Rebrain.

Questions

Questions regarding this policy may be sent to support@rebrain.eu. We also invite you to contact us with suggestions for improving this policy.

Rebrain does not offer financial rewards for vulnerability reports. Personal data provided in a report is processed in accordance with our privacy policy.