Report a security problem

What to send

• What you found, and where: the page or address, and the account type you used (patient or care team).
• The steps to make it happen again.
• What someone could do with it.

Please don’t send patient information. If you saw some, tell us that you did, not what it was.

What this covers

• The patient app at app.dev.myndfulpal.com.
• The care-team portal at care.dev.myndfulpal.com.
• This website, dev.myndfulpal.com, and its demo request form.

While you look

• Use only accounts and data that are yours. Never open, change or keep anyone else’s. If you reach a patient’s or a clinic’s information by accident, stop there, don’t keep a copy, and tell us.
• Don’t try to slow down or stop the service, and don’t send spam.
• Don’t try to trick clinic staff, patients or our team, and don’t test physical security.
• Give us a reasonable time to fix the problem before you tell anyone else about it.

What we do

• Aim to reply within 3 business days to say we have your report, and keep you posted until it’s fixed.
• Tell you when it’s fixed, and thank you by name if you’d like.
• Treat research done in good faith that follows this page as help, and work with you on it.