Information Security at LOGEX

This page describes the security and privacy practices applied to LOGEX products and services and to the LOGEX legal entities involved in their development, delivery, support, hosting and operation.

The LOGEX ISMS is established and managed at group level. Applicable security and privacy requirements are implemented across the relevant legal entities, functions, processes, products and supporting services.

The precise contractual entity, service scope, processing role, hosting location and applicable assurance framework are defined in the relevant customer agreement, Data Processing Agreement, service description or certification scope. Details of the contracting LOGEX entity and the entities involved in processing or supporting customer data are provided in the applicable customer agreement and related privacy documentation.

LOGEX provides healthcare analytics and related services and may process personal data, including health-related information, on behalf of customers. The role of LOGEX as controller, joint controller or processor depends on the relevant processing activity and contractual arrangement.

Where LOGEX acts as a processor, personal data are processed only for agreed purposes, in accordance with documented customer instructions and the applicable Data Processing Agreement. Data processing is subject to principles including:

• lawfulness, fairness and transparency;
• purpose limitation;
• data minimisation;
• accuracy and integrity;
• storage limitation;
• confidentiality and security;
• privacy by design and by default; and
• accountability.

Access to customer data is restricted to authorised personnel based on business need and the principles of least privilege and need to know. Appropriate confidentiality obligations, security awareness requirements and access controls apply to relevant personnel.

LOGEX maintains documented processes supporting privacy risk assessment, data-subject rights, retention, deletion, data return, personal-data-breach management and oversight of sub processors.

Questions about privacy or the processing of personal data may be directed through the contact details provided in the applicable LOGEX privacy statement or customer agreement.

LOGEX operates an ISMS designed to identify, assess, treat, monitor and continually improve the management of information-security risks.

The ISMS is independently audited against applicable standards and assurance programmes. Depending on the relevant legal entity, product, country and certification scope, these may include:

• ISO/IEC 27001:2022;
• NEN 7510-1:2024;
• ISAE 3402 Type II;
• BSI C5 Type 2;
• Cyber Essentials;
• Cyber Essentials Plus;
• NHS Data Security and Protection Toolkit;
• DigiD; and
• MedMij.

LOGEX also monitors relevant legal, regulatory, contractual and industry requirements, including the GDPR and applicable cybersecurity legislation.

Certifications and attestations apply only within their formally stated scopes. Customers should consult the applicable certificate, assurance report or contractual documentation to confirm whether a particular entity, product, service or location is covered.

Security certificates and selected assurance documentation may be made available to customers and authorised third parties upon request. Sensitive reports, including detailed audit and penetration-test reports, may require a confidentiality agreement or access through a controlled assurance process.

LOGEX’s ISMS includes independent internal audits, external audits, management reviews, risk assessments, security metrics, corrective-action management and periodic evaluation of control effectiveness.

LOGEX delivers healthcare analytics and related services using scalable, cloud-based technology. Security and privacy requirements are incorporated into the architecture and lifecycle of LOGEX products.

Our technology approach includes:

• separation of customer and operational environments;
• logical segregation of customer data;
• encryption of customer data in transit and at rest;
• secure configuration and hardening;
• identity and access controls;
• logging and security monitoring;
• vulnerability and patch management;
• backup and recovery capabilities;
• change management; and
• infrastructure automation where appropriate.

LOGEX uses established cloud and hosting providers selected according to security, availability, privacy, data-residency and contractual requirements. Relevant providers and data centres are required to maintain appropriate physical, environmental and infrastructure security controls.

Customer data are hosted in locations determined by the applicable product, agreement and regulatory or data-residency requirements. Specific hosting and sub processor information is provided through contractual documentation or the applicable sub processor notice.

LOGEX uses infrastructure automation and controlled configuration-management practices to improve deployment consistency, traceability, recoverability and security. Infrastructure and application changes are subject to access restrictions, version control, review, testing, approval and logging appropriate to the associated risk.

LOGEX products are delivered through supported web technologies designed for use with current, vendor-supported browsers and operating systems.

Customers should use:

• a vendor-supported operating system;
• a current version of a supported browser;
• a secure and maintained endpoint;
• an appropriately protected internet connection; and
• multi-factor authentication where available or required.

Product-specific technical requirements, browser support, endpoint specifications, integrations and accessibility requirements are maintained in the applicable product documentation.

LOGEX may discontinue support for operating systems, browsers, protocols or components that are no longer supported by their vendors or that do not meet current security requirements.

LOGEX applies a secure software development lifecycle to the design, development, testing, deployment and maintenance of its products.

Security activities are integrated into development and change-management processes through measures including:

• documented security and privacy requirements;
• role separation and controlled access to development systems;
• peer review and approval of changes;
• automated and manual testing;
• static application security testing;
• software composition and dependency analysis;
• vulnerability scanning;
• secure configuration and deployment controls;
• separation of development, test, acceptance and production environments;
• traceable release and change-management records; and
• security testing proportionate to product and change risk.

LOGEX evaluates third-party and open-source components for known security weaknesses and addresses identified vulnerabilities according to risk-based remediation processes.

Production customer data are not used in non-production environments as a standard practice.

Applications and infrastructure are subject to independent penetration testing at least annually or more frequently where justified by product criticality, material changes, contractual requirements or identified risk. Identified findings are assessed, tracked, remediated and verified according to their severity.

LOGEX manages access according to the principles of least privilege, need to know, role-based access control and segregation of duties.

Access controls include, where applicable:

• unique user identities;
• role-based permissions;
• multi-factor authentication;
• single sign-on and federation;
• controlled privileged access;
• approval requirements for elevated permissions;
• periodic access reviews;
• prompt adjustment or revocation following role changes or termination;
• secure management of credentials and secrets;
• protection against repeated or suspicious authentication attempts; and
• logging and monitoring of security-relevant access activity.

LOGEX supports integration with customer identity providers where available and appropriate. Where customer-managed federation is used, responsibilities for identity lifecycle management, authentication policies and user access are defined between LOGEX and the customer.

Privileged access to production environments is restricted, monitored and subject to additional controls. Emergency access is governed through documented procedures and subsequent review.

Customers remain responsible for:

• maintaining accurate user information;
• promptly removing access that is no longer required;
• protecting authentication credentials;
• configuring their identity provider securely; and
• periodically reviewing the access assigned to their users.

LOGEX protects customer data through layered technical and organisational controls.

Customer data are encrypted in transit and at rest using industry-recognised cryptographic methods appropriate to the relevant system and processing risk. Cryptographic keys and secrets are subject to controlled access, lifecycle management, separation from protected data where appropriate, and logging or monitoring.

LOGEX applies data-minimisation and privacy-enhancing techniques where appropriate. These may include masking, pseudonymisation, tokenisation, hashing, field suppression, date transformation, aggregation and irreversible anonymisation.

Security-relevant events are logged and monitored to support security operations, incident investigation, accountability, service management and compliance.

Logging may include authentication events, authorisation failures, administrative activity, configuration changes, deployments, access to sensitive functions and other events relevant to security or service integrity.

Logs are protected against unauthorised access and modification, retained according to legal, contractual, operational and security requirements, and reviewed or analysed according to risk.

LOGEX maintains processes for identifying, assessing, prioritising and remediating vulnerabilities affecting applications, infrastructure, endpoints and relevant third-party components.

The programme combines automated security testing, vulnerability scanning, threat and vulnerability information, patch management, independent penetration testing and risk-based remediation.

LOGEX maintains a documented security-incident management process covering:

1. detection and reporting;
2. assessment and classification;
3. containment;
4. investigation and evidence preservation;
5. remediation and recovery;
6. communication and notification where required;
7. root-cause analysis; and
8. corrective action and lessons learned.

Potential personal-data breaches are assessed under applicable data-protection requirements and relevant contractual notification obligations.

LOGEX uses security monitoring and specialist support to assist with the detection and investigation of security events. Service-support availability and security-monitoring arrangements are not necessarily identical and are defined by the applicable service agreement.

LOGEX maintains business-continuity, backup, recovery and disaster-recovery arrangements appropriate to its products and customer commitments.

These arrangements include, where applicable:

• redundant cloud infrastructure;
• protected and encrypted backups;
• monitoring of backup success and failure;
• defined recovery procedures;
• infrastructure automation supporting consistent rebuilding or redeployment;
• restoration testing;
• recovery and continuity exercises;
• post-restoration integrity checks; and
• documented recovery objectives aligned with business and contractual requirements.

Recovery Point Objectives, Recovery Time Objectives, retention periods, service availability and support arrangements are product-specific and are defined in the applicable agreement, service description or Service Level Agreement.

Business-continuity and disaster-recovery arrangements are periodically exercised and reviewed. Backup restoration is tested to provide assurance that protected information and services can be recovered when required.

At the end of the applicable retention period or customer relationship, customer data are returned, securely deleted or irreversibly anonymised in accordance with contractual instructions, legal requirements and documented retention and deletion processes. Where immediate deletion from protected backup media is not technically feasible, data are placed beyond active use and removed through the controlled backup lifecycle.

LOGEX uses professional cloud and data-centre providers for hosting customer-facing environments. Appropriate physical and environmental protections are provided by these infrastructure providers under the applicable shared-responsibility model.

LOGEX assesses relevant supplier assurance, including data-centre certifications, access controls, resilience, utility protection and environmental safeguards.

Customers and prospective customers may request additional information to support security, privacy, procurement and regulatory assessments.

Subject to appropriate confidentiality and access controls, available materials may include:

• certification documents;
• assurance reports;
• responses to security questionnaires;
• high-level technical and organisational measures;
• data-processing and sub processor information;
• business-continuity and disaster-recovery summaries;
• penetration-testing assurance statements;
• vulnerability-management summaries; and
• relevant policies or policy summaries.

Detailed architecture diagrams, vulnerability information, complete penetration-test reports, internal procedures, security configurations and other sensitive materials are not published publicly.