Security Policy

1. Scope

This policy applies to all systems, devices, networks, applications and personnel involved in the collection, transmission, processing and storage of user data, including brainwave recordings, account information and related metadata.

2. Data classification

• Brainwave recordings: held in EDF, containing no personally identifiable information.
• Account data: user profile details, authentication credentials and consent records.
• Derived outputs: personalised soundscapes generated from EDF recordings.

3. Collection and ownership

• The myWaves Pebble captures delta brainwave signals via wet-contact electrode pads on the forehead.
• EDF files conform to the international EDF standard, are fully owned by the user, and are free of personally identifiable information.
• Explicit consent is obtained before any data capture or processing.

4. Storage and encryption

• Encryption at rest: AES-256 is applied to all stored data, including EDF files and account information.
• Encryption in transit: TLS 1.2 or higher secures all communication between devices, users and servers.
• Key management: encryption keys are managed through AWS Key Management Service under strict access controls.
• Storage locations: for personal information collected by Sun Digital Health in Japan, see clause 10 of our Privacy Policy.

5. Access control and authentication

• Role-based access control: access is granted by job function and the principle of least privilege.
• Multi-factor authentication: enforced for all administrative and user accounts.
• Session management: secure session tokens with automatic expiration and revalidation.

6. Segregation and anonymity

• EDF files never contain personally identifiable information and are stored separately from user profile data.
• Users retain full ownership and control over their EDF recordings.
• EDF file transfers remain anonymised and unlinked to personal information.

7. Use and retention

• Brainwave data is used solely for the patented neuro-acoustic transduction process.
• EDF files and derived outputs are not shared, sold or distributed to third parties.
• Data is retained only as long as necessary to provide core services and satisfy legal obligations.

8. Monitoring and incident response

• Continuous logging, intrusion detection and anomaly tracking, 24 hours a day.
• An incident response plan covering identification, containment, eradication and recovery.
• Timely notification of affected users and authorities as regulations require.

9. Physical and environmental security

• AWS data centres are ISO 27001, SOC 1/2/3 and PCI DSS compliant.
• Controlled access through biometric authentication, surveillance and on-site security personnel.
• Backup power and redundant infrastructure maintain high availability.

10. Personnel and vendors

• Security and privacy awareness training is mandatory for all personnel.
• Confidentiality agreements are signed by employees, contractors and vendors.
• User accounts and privileges are audited quarterly.
• All vendors are subject to security assessment and contractual requirements.

11. Business continuity

• Regular encrypted backups.
• Defined recovery time and recovery point objectives to minimise downtime and data loss.
• Annual disaster recovery drills to validate readiness.

12. Compliance and contact

Personal information collected in Japan is managed in accordance with the Act on the Protection of Personal Information (APPI). The myWaves platform complies with GDPR and other regional privacy regulations. For security matters, contact info@sdh.co.jp.