Bomi Health, Inc. Vulnerability Disclosure Policy

1. Purpose and Scope

Bomi Health, Inc. (“Bomi,” “we,” “us,” or “our”) values the work of good-faith security researchers. This Vulnerability Disclosure Policy (the “Policy”) describes how to report a suspected security vulnerability to Bomi, what testing is and is not authorized, and the protections Bomi extends to researchers who follow it. This Policy is the written security-testing policy referenced by the acceptable-use provisions of Bomi’s Terms of Service and Client Portal Terms of Service.

This Policy covers the Bomi-operated, internet-facing services and applications on billwithbomi.com domains. It does not cover services operated by third parties, a Provider’s own systems, or physical premises. Testing a third-party service that Bomi integrates with is governed by that third party’s own policy, not this one.

2. How to Report a Vulnerability

Report suspected vulnerabilities to [email protected]. A useful report includes: a description of the issue and its potential impact; the affected URL, endpoint, or component; step-by-step reproduction instructions; any proof-of-concept material; the date and time of your testing; and contact information for follow-up questions. Bomi will acknowledge a report within three business days and will keep you reasonably informed of remediation status.

For a vulnerability you believe is being actively exploited or poses an immediate risk to patient information, include “URGENT” in the subject line. If an urgent report is not acknowledged within twenty-four hours, follow up through [email protected] referencing your original report so it can be escalated.

3. Authorized Testing

You are authorized to perform good-faith security research within the scope above only against accounts, profiles, and data that you own or are expressly authorized to use, such as test accounts you create with your own information. You must make a good-faith effort to avoid privacy violations, degradation of service, and destruction or modification of data, and you must stop testing and report immediately once you have enough information to demonstrate a vulnerability.

No access to real patient data. Bomi’s systems process Protected Health Information. You must not access, download, retain, share, or further use PHI or another person’s personal information. If you inadvertently encounter such information, immediately stop the activity that exposed it, do not save, copy, or transmit it, delete anything already captured, and describe the exposure in your report.

4. Prohibited Testing

You are not authorized to:

• test against another person’s account, profile, or data, or otherwise interact with real patient or Provider information;
• perform denial-of-service, volumetric, or resource-exhaustion testing, or automated scanning at a rate that degrades the service;
• use social engineering, phishing, or physical intrusion against Bomi, its personnel, Providers, or portal users;
• destroy, modify, or encrypt data, install persistent access, pivot to other systems, or exceed the minimum access needed to demonstrate the vulnerability;
• publicly disclose a vulnerability before remediation or an agreed disclosure date, or condition nondisclosure on payment or another demand.

5. Good-Faith Safe Harbor

Research conducted in material compliance with this Policy is authorized. Bomi will not initiate or support a civil action or criminal complaint against you for that research under anti-hacking or anti-circumvention laws, and will consider it authorized access for purposes of those laws. If a third party initiates legal action against you for research conducted in material compliance with this Policy, Bomi will, on request, make that authorization known. This safe harbor does not apply to activity outside this Policy, including any access, retention, or disclosure of PHI beyond the minimum inadvertent exposure described in Section 3.

6. Coordinated Disclosure

Bomi follows coordinated disclosure. Bomi will work with you toward prompt remediation and, where appropriate, an agreed public disclosure date; please allow a reasonable remediation period before any disclosure. Do not disclose a vulnerability, proof of concept, or affected data publicly or to a third party before remediation or an agreed date. A demand for payment or other consideration as a condition of reporting, remaining silent about, or not exploiting a vulnerability is extortion, not good-faith research, and is outside this Policy. Bomi does not currently operate a paid bug-bounty program and does not compensate reports, but will credit researchers who request acknowledgment where disclosure is appropriate.