Responsible Disclosure Policy
Responsible Disclosure Policy
At Curavista B.V., we take the security of our systems and our users' data extremely seriously. Have you discovered a vulnerability? We would appreciate it if you would report this responsibly to us so that we can ensure security together.
How do you report a vulnerability?
Send a detailed report to security@curavista.nl.
Please state clearly:
- Which system/app has been compromised?
How can we reproduce the vulnerability? (steps, screenshots, or code examples)
- Your contact details (for follow-up).
What do we ask of you?
- Do not exploit vulnerabilities (e.g. view, modify or download data).
- Do not publicly share findings until we have resolved the vulnerability.
- Only test on systems that are from Curavista (no third parties).
- Do not use intrusive techniques (e.g. DDoS, social engineering).
What do we promise?
- We will respond to your report within 5 working days.
- We will resolve the vulnerability within 60 days, unless we agree on a different timeframe.
- We'll keep you updated on the progress.
If you abide by these agreements, we will not take legal action.
What does this policy cover?
All domains and apps managed by Curavista, including the webpages and apps of:
- gezonheidsmeter.nl
- urincontrol.online
- vertigotraining.nl
- i-file.app
- prostaatonline.nl
Mobile apps (iOS/Android)
- health meter
- Urinary incontinence
- vertigo training
- abcctool
- Spirogram
- grip.health
- Physiomat
What's falling outside?
- Vulnerabilities in third-party systems (e.g. cloud providers).
- Phishing or social engineering.
Recognition
- As a token of appreciation, we will include your name (if desired) in our Hall of Fame on this page, unless you prefer anonymity.
Questions?
Contact us via security@curavista.nl.
Copyright
The copyright of www.curavista.nl and the underlying software platform belongs to Curavista b.v. Nothing from this site may be copied or used for other purposes without permission.