Vulnerability Disclosure Policy

Last updated: October 30, 2026

Lana Health builds software and devices used in hospitals, so we take the security of our products and the privacy of patient data seriously. If you believe you’ve found a security vulnerability, we want to hear from you and will work with you to fix it.

How to report

Email security@lana.health with:

• A description of the issue and its potential impact
• The affected product, URL, app version, or device
• Steps to reproduce, proof of concept, or screenshots
• Your name or handle, if you’d like to be credited

Please do not include patient data or other protected health information (PHI) in your report. Our contact details are also published at /.well-known/security.txt.

What to expect

Coordinated disclosure

Please keep vulnerability details confidential until we’ve released a fix, or until 90 days after your report, whichever comes first, unless we agree otherwise.

Once a fix is available, we publish a security advisory on this page and notify affected customers directly. Each advisory describes the affected products and versions, severity, and remediation steps, and credits the reporter if they wish. Where a CVE identifier is warranted, we request one through the CVE Program. Our process follows ISO/IEC 29147 (vulnerability disclosure) and ISO/IEC 30111 (vulnerability handling).

Scope

In scope:

• www.lana.health
• Lana Health web applications and APIs
• Lana Health mobile and tablet apps
• Software running on Lana Health devices

Out of scope:

• Denial-of-service or high-volume load testing
• Social engineering or phishing of our staff, hospital partners, or patients
• Physical attacks against offices, hospitals, or installed devices
• Third-party services we use (please report these to the vendor)
• Findings with no demonstrated security impact, such as missing headers, clickjacking on non-sensitive pages, or email SPF/DMARC settings

Rules of engagement

Because our products are used in patient care:

• Never test against systems or devices in active hospital use, or in any way that could disrupt patient care.
• Only use accounts you own or have explicit permission to use. Don’t access, modify, or delete other people’s data.
• If you encounter PHI or other personal data, stop, don’t keep or share it, and report it to us immediately.
• Do only what’s needed to demonstrate the issue.
• Don’t run high-volume automated scans.

Safe harbor

If you make a good-faith effort to follow this policy, we will consider your research authorized, we will not pursue or support legal action against you, and we will work with you to understand and resolve the issue quickly. If a third party brings legal action against you for activity that followed this policy, we will make it known that your research was authorized.

We do not currently run a paid bug bounty, but we’re happy to publicly credit researchers who report valid issues.

Security advisories

No advisories have been published yet.

‍