Responsible Disclosure Policy

Version 2.0 last revised October 8, 2026

Introduction

At Smile Digital Health (Smile CDR Inc), we are committed to protecting the privacy and security of all our product and service offerings, including open-source projects like HAPI FHIR.

Security researchers, customers, and members of the public play an important role in identifying and helping us address potential vulnerabilities.  Therefore, we welcome good-faith reports of suspected vulnerabilities in our products, services, and publicly accessible systems.

This Policy describes our preferences and general approach for receiving and handling vulnerability reports. It is intended to facilitate responsible reporting and coordinated remediation.

This Policy does not constitute a contract, offer, acceptance, authorization, permission, consent, waiver, license or grant of rights to conduct security testing or other activities against our products, services or systems. Nothing in this Policy limits any rights, remedies, defense or obligations available to us under applicable law, contract or other applicable terms. We may modify, suspend, or withdraw this Policy at any time and without prior notice.

Safe Harbor

Generally, if you conduct your security research in full compliance with this Policy and act in good faith, we do not intend to:

• Pursue civil or legal action against you regarding your research.

• Report your compliant activities to law enforcement or regulatory authorities.

• Terminate or restrict your access to our public products or services solely because of your research.

Limitations of Safe Harbor

This Policy does not give you permission to act or perform activities that contravene the law, or which might cause Smile Digital Health, its customers, partners, vendors or staff to be in breach of any contractual, statutory, or regulatory obligations. Nor does it indemnify or defend you against any action taken by law enforcement, regulatory authorities, or any other third party.

We reserve all legal rights to take action against any individual or entity whose activities exceed the scope of this Policy, cause disruption, or compromise any data under our control or custody.

If you are unsure whether planned research is consistent with this Policy, contact us at security@smiledigitalhealth.com before proceeding.

Scope

In Scope

This Policy applies to:

• All supported versions of the Smile Omni product family (OmniVera, OmniCompli, OmniQ)

• All supported versions of HAPI FHIR (https://github.com/hapifhir/hapi-fhir) and other open source projects maintained by Smile Digital Health

• Publicly-accessible services and environments hosted and operated by Smile Digital Health.

• Websites and domains owned by Smile Digital Health.

Out of Scope

The following are outside the scope of this Policy:

• Distributed Denial of Service attacks.

• Attacks which require administrative access to the software.

• Attacks which require physical access to hardware running the Smile software suite.

• Physical testing of offices and data centers.

• Social engineering, or other methods to trick or deceive end users or staff

Researcher Guidelines

Under this Policy, “research” or “security research” refers to any activities in which you make a good-faith effort to identify, report, and/or help remediate potential vulnerabilities while respecting our products, services, customers and users.

General Conduct & Expectations

• Notify us as soon as possible after discovering a real or potential security issue. Share all relevant findings, technical details, and reproduction steps in your report.

• Perform research within the bounds of applicable laws in your jurisdiction and where our products or services reside or operate.

• Provide us a reasonable amount of time to resolve the issue before publishing or sharing details publicly.

• Avoid submitting automated scanner dumps or a high volume of low-quality reports.
  
  

System Integrity & Testing Limits

• Never violate privacy, degrade system performance, disrupt production systems, or modify, corrupt, or destroy data.

• Use exploits only to the extent necessary to confirm the presence of a vulnerability. Do not use an exploit to compromise or exfiltrate data, establish persistent command-line access, pivot to internal systems, or generate artificial/fraudulent requests and transactions.

 

Encountering Sensitive Data

Once you have established that a vulnerability exists or if you encounter sensitive data, including Personal/Protected Health Information (PHI), Personally Identifiable Information (PII), financial records, or proprietary trade secrets, you must:

• Stop all discovery, scanning, or exploitation activities at once.

• Report the issue immediately to security@smiledigitalhealth.com.

• Stop accessing the data, avoid copying or exfiltrating further information, and do not disclose or share it with any third party.

• Securely delete any locally cached or stored sensitive data once the vulnerability report is acknowledged.

Reporting a Vulnerability

How to Submit

• Send all vulnerability disclosures to security@smiledigitalhealth.com.

• Reports should be submitted in English where possible.

• Reports may be submitted anonymously, provided sufficient technical details are supplied to allow verification. 
  
  

What to Provide

To help us in reviewing your submission, please provide:

• The affected product name, software version, URL, host, or service component.

• Category/type of vulnerability and relevant Common Weakness Enumeration (CWE) category (if known).

• Clear, step-by-step reproduction instructions (including non-destructive proof-of-concept scripts or screenshots).

• Potential impact assessment and scope of exploitation.

• Your preferred name or alias if you wish to be considered for public acknowledgement.
  
  

What you can expect from us

We make reasonable, best-effort efforts to review vulnerability reports. Where practical, we aim to:

• Acknowledge receipt of your report within 3 business days.

• Investigate and validate reported findings within 10 business days of acknowledgement.

• Communicate with you as appropriate regarding the status of the validated vulnerability. 
  
  

We target a 120-day coordinated disclosure window. However, the actual timing of the public disclosure may vary depending on:

• The severity and complexity of the vulnerability;

• The availability and readiness of a remediation;

• Dependencies on third parties or open source projects;

• The potential impact on customers and end users;
• The time reasonably required for customers to apply available mitigations or updates; and/or
• Other security, legal, regulatory, or operational considerations.
  
  

In cases where additional remediation time is required, we may ask you to extend the disclosure embargo window beyond 120 days.

Where mandated by law, we may report vulnerabilities or incidents directly to the relevant regulatory authorities prior to public disclosure. In such cases, we will not share your identity with regulatory authorities or third parties without your express consent unless legally mandated to do so.

CVE Numbering Authority (CNA)

Smile Digital Health is an authorized CVE Numbering Authority (CNA) under the CVE Program for all Smile products and HAPI-FHIR.

• All CVE IDs associated with our services and products will be initiated and managed exclusively by Smile Digital Health.

• The timing of CVE reporting may be dependent on the ability of Smile Digital Health to provide remediation.

• Researchers must coordinate directly with us prior to requesting external CVE assignments for covered products. 
  
  

Rewards & Recognition

Smile Digital Health does not operate a paid monetary bug bounty program and does not provide any financial compensation for vulnerability submissions.

At our sole discretion, and subject to our explicitly prior written consent, researchers who discover verified vulnerabilities while fully adhering to this Policy may be publicly acknowledged in our security advisories upon full remediation of the issue.