Vulnerability Disclosure Policy

Last updated: 26 October 2026

Vermillion Health Technologies (UK) Limited takes the security of our products and the data they protect seriously. If you believe you have found a security vulnerability in any of our products or services, we want to hear from you, and we will work with you to resolve it.

Scope

This policy covers:

  • the Alevia and Alevia Pro apps (iOS, Android and Windows)
  • the Connect clinician portal and Nucleus administration portal
  • the APIs and cloud services that support them
  • our website, vermillionhealth.com

The Alevia headset hardware and firmware are in scope where a vulnerability can be exploited through the app or our services.

How to report

Email security@vermillionhealth.com with:

  • the product or service affected, and the version if known
  • a description of the vulnerability and its potential impact
  • the steps needed to reproduce it, including any proof-of-concept
  • how you would like to be credited, if at all

Please do not include real patient data in your report.

What we ask of you

  • Report the vulnerability to us as soon as possible after you find it, and give us reasonable time to fix it before disclosing it publicly.
  • Only test against accounts and data you own or have permission to use. Do not access, change or delete other people’s data, and stop as soon as you encounter personal or health information.
  • Do not carry out denial-of-service testing, social engineering, phishing or physical attacks against our staff, offices or customers.
  • Do not use automated scanning that could degrade our services.

What you can expect from us

  • We will acknowledge your report within 5 working days.
  • We will assess it, keep you informed of our progress, and tell you when it has been fixed.
  • We will fix vulnerabilities in line with our security policy timescales, which are based on severity.
  • With your agreement, we will credit you once the fix has been released.

If you act in good faith and follow this policy, we will not take legal action against you in relation to your research.

This policy does not offer payment for reports.

Healthcare organisations using our products

If you are a customer organisation and suspect a security incident affecting your service, contact us at security@vermillionhealth.com and your usual support contact straight away so that we can respond under our incident response plan.

Our machine-readable security contact details are published at vermillionhealth.com/.well-known/security.txt.

Shopping Cart