1. Purpose and scope

This policy tells everyone who works for Zebrold Private Limited, or for Consult Your Doctor as a doctor or contractor, how to use technology safely. It supports the Information Security and Access Control Policy (CYD-SEC-01).

2. Devices and accounts

• Use only company-approved devices and accounts for work. Keep devices locked, encrypted and updated.
• Personal devices may be used only if they are enrolled in company device management and meet the security standard.
• Never share a password or a login. Report a lost device or a suspected compromise at once.
• Do not install unapproved software or connect unknown storage devices.

3. Email and messaging

• Use company email and approved messaging tools for company business, and never personal accounts.
• Do not send patient information by ordinary email, by public messaging apps or by text message, except through approved secure channels.
• Be careful with links and attachments. Report suspicious messages to the technical lead.

4. Patient and company data

• Open only the records that you need for your work.
• Do not copy, photograph, print or download patient information except as your role requires and the policy allows.
• Do not discuss patients in public places or on social media.

5. Use of AI tools

• Use only AI tools that are on the company's approved register (CYD-AI-01).
• Never enter patient information, passwords or confidential company material into a public or unapproved AI tool.
• You remain responsible for any work that you produce with AI; check it before you use it.

6. Remote work and travel

Work from a private place, on a secure network, with a company VPN where required. Do not leave devices unattended, and do not work on patient data in public places.

7. Monitoring

The company may monitor the use of its systems, as the law allows, to keep them secure and to find misuse. Access to patient records is logged.

8. Breaches of this policy

A breach may lead to withdrawal of access, disciplinary action, termination of a contract and, where the law is broken, referral to the authorities.

9. Passwords and authentication

• Use a long, unique password or passphrase for each account, and a password manager approved by the company.
• Use multi-factor authentication wherever it is offered and always for company systems.
• Never write down or reveal a password, even to the technical team; the team will never ask for it.

10. Software and licences

Only software that the company has approved and licensed may be installed. Free tools, browser extensions and online services may be used for company work only after the technical lead has approved them, because they may copy or expose data. Software must be kept up to date and must not be copied or shared in breach of its licence.

11. Social media and public statements

Staff must not post patient information, internal documents, screenshots of the platform or confidential plans on social media or in public forums. Views posted in a personal capacity must not suggest that they are the views of the company. Staff must not respond to media enquiries on behalf of the company unless authorised by a director.

12. Personal use

Limited personal use of company equipment is allowed if it does not interfere with work, cost the company, expose data or break the law. Illegal, offensive or discriminatory material must never be accessed, stored or shared on company systems.

13. Reporting

Anyone who loses a device, receives a suspicious message, clicks a suspicious link, notices unusual activity or sees a breach of this policy must report it at once to the technical lead. Reports made in good faith are never punished.

1. Purpose and scope

This policy tells everyone who works for Zebrold Private Limited, or for Consult Your Doctor as a doctor or contractor, how to use technology safely. It supports the Information Security and Access Control Policy (CYD-SEC-01).

2. Devices and accounts

• Use only company-approved devices and accounts for work. Keep devices locked, encrypted and updated.
• Personal devices may be used only if they are enrolled in company device management and meet the security standard.
• Never share a password or a login. Report a lost device or a suspected compromise at once.
• Do not install unapproved software or connect unknown storage devices.

3. Email and messaging

• Use company email and approved messaging tools for company business, and never personal accounts.
• Do not send patient information by ordinary email, by public messaging apps or by text message, except through approved secure channels.
• Be careful with links and attachments. Report suspicious messages to the technical lead.

4. Patient and company data

• Open only the records that you need for your work.
• Do not copy, photograph, print or download patient information except as your role requires and the policy allows.
• Do not discuss patients in public places or on social media.

5. Use of AI tools

• Use only AI tools that are on the company's approved register (CYD-AI-01).
• Never enter patient information, passwords or confidential company material into a public or unapproved AI tool.
• You remain responsible for any work that you produce with AI; check it before you use it.

6. Remote work and travel

Work from a private place, on a secure network, with a company VPN where required. Do not leave devices unattended, and do not work on patient data in public places.

7. Monitoring

The company may monitor the use of its systems, as the law allows, to keep them secure and to find misuse. Access to patient records is logged.

8. Breaches of this policy

A breach may lead to withdrawal of access, disciplinary action, termination of a contract and, where the law is broken, referral to the authorities.

9. Passwords and authentication

• Use a long, unique password or passphrase for each account, and a password manager approved by the company.
• Use multi-factor authentication wherever it is offered and always for company systems.
• Never write down or reveal a password, even to the technical team; the team will never ask for it.

10. Software and licences

Only software that the company has approved and licensed may be installed. Free tools, browser extensions and online services may be used for company work only after the technical lead has approved them, because they may copy or expose data. Software must be kept up to date and must not be copied or shared in breach of its licence.

11. Social media and public statements

Staff must not post patient information, internal documents, screenshots of the platform or confidential plans on social media or in public forums. Views posted in a personal capacity must not suggest that they are the views of the company. Staff must not respond to media enquiries on behalf of the company unless authorised by a director.

12. Personal use

Limited personal use of company equipment is allowed if it does not interfere with work, cost the company, expose data or break the law. Illegal, offensive or discriminatory material must never be accessed, stored or shared on company systems.

13. Reporting

Anyone who loses a device, receives a suspicious message, clicks a suspicious link, notices unusual activity or sees a breach of this policy must report it at once to the technical lead. Reports made in good faith are never punished.