Cybersecurity Information /
Security Policy

Last Updated: June 2, 2026

Applies to: AcuFlex mobile applications, AcuFlex measurement device, AcuFlex cloud services, and AcuFlex clinician/admin web interface.

AcuFlex is designed as a connected medical-device system that includes a Bluetooth-enabled measurement device, iOS and Android mobile applications, secure cloud backend services, and a clinician/admin web interface. Because AcuFlex handles clinical measurement data and patient information, cybersecurity is treated as part of product safety, clinical reliability, and patient trust.

This page provides user-facing cybersecurity information for clinicians, administrators, patients, customer IT/security teams, and support personnel. It is intended to help users deploy, configure, and use AcuFlex securely. It does not replace the AcuFlex Instructions for Use, User Manual, Privacy Policy, or organization-specific clinical and privacy obligations.

System overview

The AcuFlex measurement device captures biomechanical measurement data during assessment sessions. The device communicates with the AcuFlex mobile application using Bluetooth Low Energy. The mobile application is used to authenticate authorized users, pair with the device, conduct measurement sessions, and upload session data to AcuFlex cloud services for storage, processing, reporting, and authorized review.

The AcuFlex cloud environment is hosted on Amazon Web Services and is designed to support secure ingestion, processing, storage, reporting, audit logging, and administrative workflows. Authorized clinicians and administrators may access patient records, session histories, reports, and administrative tools according to their assigned roles.

Security-by-design approach

AcuFlex incorporates cybersecurity controls across the product lifecycle, including architecture review, risk assessment, secure development practices, software verification, vulnerability monitoring, and post-release security maintenance.

Security activities include:

• Threat modeling and cybersecurity risk assessment for the device, mobile application, cloud backend, web interface, and data flows.
• Security requirements for authentication, authorization, encryption, logging, updates, and secure data handling.
• Verification activities such as secure code review, software composition analysis, dynamic testing, mobile security testing, cloud configuration review, and risk-based penetration testing.
• Software Bill of Materials management for release baselines.
• Postmarket vulnerability monitoring using sources such as vendor advisories, vulnerability databases, CISA Known Exploited Vulnerabilities, supplier notifications, internal testing, and external reports.

Authentication and account security

AcuFlex uses centralized identity management to authenticate users and issue access tokens. The current architecture uses Amazon Cognito with OAuth2/OpenID Connect workflows.

AcuFlex supports individual user accounts and role-based access control. Users should not share accounts. Access is limited according to assigned role and organization.

Supported security controls include:

• Individual user login.
• Multi-factor authentication support, including time-based one-time passcode authenticator apps where enabled.
• Password reset and account recovery workflows using controlled email-based processes.
• Token-based authentication and session management.
• Token revocation and global sign-out mechanisms when required.
• User-existence protection to reduce account-enumeration risk.

Users are responsible for protecting their credentials, using strong passwords, enrolling in MFA when required, and logging out when finished, especially on shared or managed devices.

Role-based access control

AcuFlex is designed to limit access to the minimum necessary information for each role.

Typical access boundaries include:

• Patients: May access their own permitted information and session history through approved application workflows when patient access is enabled.
• Clinicians: May create and manage patient records, conduct measurement sessions, review session histories, and export patient reports for patients associated with their organization.
• Administrators: May manage users and organization-level settings within their assigned organization.
• Scientists/research users: May access authorized de-identified or anonymized datasets for research export workflows.
• Super administrators / AcuFlex operations: May manage system-level configuration, organizations, devices, and operational support functions under controlled access.

Patient-identifying information is not intended to be included in anonymized research exports.

Data protection

AcuFlex is designed to protect clinical data throughout collection, transmission, processing, storage, reporting, and export.

Data in transit

AcuFlex uses encrypted communication channels for data transfer:

• Device-to-mobile communication uses Bluetooth Low Energy security controls, including BLE LE Secure Connections, authenticated pairing, and encrypted link-layer communication.
• Mobile-app and web communication with AcuFlex cloud services uses HTTPS over TLS.
• Production operation should not use unencrypted HTTP.

Data at rest

AcuFlex cloud data stores are designed to encrypt protected information at rest.

Current design controls include:

• Patient and session information stored in Amazon Aurora PostgreSQL with AWS KMS encryption.
• Reports, exports, and larger payloads stored in Amazon S3 using server-side encryption with AWS KMS.
• Restricted bucket access with no public access for protected storage.
• Backend services hosted in private or isolated cloud network segments where applicable.
• Secrets and service credentials managed through controlled cloud services and least-privilege access.

Mobile-device data handling

The AcuFlex mobile application is not intended to serve as the long-term system of record. Long-term clinical records are stored in backend cloud services.

The mobile application is designed to use minimal local storage. Measurement data may be held temporarily during session capture and upload. Temporary session data is intended to be cleared after successful upload, logout, application termination, or platform-specific data clearing, depending on operating system behavior and release configuration.

Sensitive mobile storage uses platform security mechanisms where applicable, such as iOS Keychain/Secure Enclave and Android secure storage mechanisms. The app should not be used on jailbroken, rooted, or otherwise compromised devices.

Bluetooth pairing and device security

AcuFlex uses Bluetooth Low Energy to connect the measurement device to the mobile application.

Recommended secure pairing practices:

1. Pair the device in a private environment.
2. Keep the AcuFlex device physically under your control during pairing.
3. Pair only from inside the AcuFlex mobile application.
4. Confirm that the device shown in the app matches the intended physical device.
5. Do not accept unexpected pairing requests.
6. Remove Bluetooth pairing from the mobile operating system settings if the phone, tablet, or AcuFlex device is transferred, retired, lost, or reassigned.

The AcuFlex app is designed to scan for and connect to AcuFlex peripherals using defined BLE service identifiers. Pairing failures are rejected or timed out.

Cloud architecture and monitoring

AcuFlex cloud services are designed using a layered AWS architecture. The current design includes edge protection and routing through services such as Route 53, AWS WAF, CloudFront, Application Load Balancer, containerized backend services, private network segments, Aurora PostgreSQL, S3, CloudWatch, CloudTrail, and related monitoring services.

Security-relevant monitoring includes cloud-native logging, operational telemetry, audit logging, and alerting. Logs are intended to support operational troubleshooting, security investigation, and auditability while avoiding unnecessary storage of sensitive information such as passwords, access tokens, or protected health information in logs.

Audit logging is designed to capture security- and compliance-relevant events such as user, hospital, patient, device, and session-related create/read/update/delete activity, role or configuration changes, authentication events, failed access attempts, upload events, and export events.

Secure setup recommendations

Users and organizations should follow these secure-use practices:

• Install AcuFlex applications only from manufacturer-authorized distribution channels.
• Keep mobile operating systems updated with current security updates.
• Enable device passcode, biometric unlock, or equivalent platform security.
• Do not use AcuFlex on jailbroken, rooted, or unmanaged devices that do not meet security requirements.
• Use organization-managed devices and Mobile Device Management where practical.
• Enable MFA for user accounts where required or available.
• Use unique individual accounts; do not share logins.
• Disable accounts promptly when personnel leave or no longer need access.
• Restrict administrative access to authorized personnel only.
• Use trusted Wi-Fi or cellular networks; avoid public or untrusted Wi-Fi when uploading data.
• Protect exported reports and files as clinical information.

Customer IT network requirements

AcuFlex mobile and web applications initiate outbound connections to AcuFlex cloud services. Routine operation does not require inbound internet connectivity into the customer network.

Typical requirements include:

• Outbound HTTPS/TLS traffic on TCP port 443.
• DNS resolution for approved AcuFlex and AWS service endpoints.
• Access to AcuFlex production API, authentication, storage, and web application endpoints.
• No bypassing of certificate warnings, expired certificates, hostname-validation errors, or invalid certificates.

Customer firewall, secure web gateway, proxy, VPN, or DNS filtering policies should allow required AcuFlex endpoints. Final production endpoint allow-listing should be based on the current AcuFlex deployment documentation or customer security implementation guide.

Reports and exports

AcuFlex may generate reports and exports such as PDF reports for clinical documentation and CSV exports for authorized research workflows.

Once a user downloads, exports, shares, or saves a file outside AcuFlex, that file is under the control of the user, endpoint, browser, mobile operating system, or customer organization. Exported files that contain patient information should be treated as protected clinical information.

Recommended practices:

• Store exported reports only in approved secure locations.
• Avoid saving exports to unmanaged personal devices or personal cloud storage.
• Restrict access to authorized personnel.
• Follow organizational retention and secure-disposal policies.
• Confirm that research exports are de-identified or anonymized before external use.

Software and firmware updates

AcuFlex software updates should be obtained only through manufacturer-authorized channels.

• Mobile application updates are delivered through approved mobile distribution channels.
• Web and cloud service updates are maintained by AcuFlex and do not require customer installation.
• Firmware updates, when applicable, should be performed only according to AcuFlex-authorized instructions.

Security-related updates should be installed promptly. AcuFlex evaluates cybersecurity vulnerabilities, assesses affected versions, validates fixes, and communicates relevant security information through appropriate support, release, or advisory channels.

Backup, recovery, and decommissioning

The AcuFlex mobile application is not intended to provide an end-user backup or restore function. Backend cloud services are the authoritative system of record for clinical records and system data.

Backend recovery is managed through infrastructure-level controls, cloud backups, service monitoring, and operational recovery procedures. End users do not directly restore backend-hosted data.

When retiring, transferring, or replacing a device or mobile endpoint:

1. Sign out of the AcuFlex application.
2. Remove Bluetooth pairing from the mobile operating system settings.
3. Clear local application data or uninstall the application.
4. Disable or remove the affected user account through the authorized administrative workflow.
5. Revoke active sessions when needed.
6. Reset passwords and MFA enrollment if credentials may have been exposed.
7. Mark retired AcuFlex sensor devices inactive through the authorized administrative workflow.

If a phone, tablet, or AcuFlex device is lost or stolen, contact the organization administrator or AcuFlex support promptly so accounts, sessions, and device associations can be reviewed and revoked where appropriate.

Responding to suspected cybersecurity incidents

If you suspect a cybersecurity issue involving AcuFlex:

1. Stop using the affected system if continued use could compromise patient safety, data integrity, or protected information.
2. Disconnect affected endpoints from untrusted networks if appropriate and permitted by your organization’s incident-response process.
3. Follow your organization’s cybersecurity and privacy incident-response procedures.
4. Contact AcuFlex support or security using the reporting channel below.
5. Preserve relevant details, including the date/time, user account, device identifier, app version, screenshots, error messages, and a description of the event.

Vulnerability reporting

AcuFlex supports responsible reporting of suspected cybersecurity vulnerabilities.

Please report suspected vulnerabilities to:

Security contact: [security@acuflex.io]
Support contact: [support@acuflex.io]
Emergency/safety escalation: [618.525.3505]

Please include:

• Product or application affected.
• App version, firmware version, device identifier, or web URL where applicable.
• Steps to reproduce.
• Potential impact.
• Whether patient data, credentials, or clinical workflow integrity may be affected.
• Your contact information for follow-up.

AcuFlex will review reports, assess risk, investigate affected versions, coordinate remediation, and communicate appropriate mitigations or updates.

Additional security documentation

Upon request and when appropriate, AcuFlex may provide additional security documentation to customers, regulators, or authorized partners, such as:

• Security architecture summary.
• Software Bill of Materials.
• Customer security implementation guidance.
• Manufacturer Disclosure Statement for Medical Device Security.
• Security update or advisory information.
• Relevant release notes.

Availability of specific documents may depend on customer relationship, regulatory status, confidentiality requirements, and release version.

Important note

No connected system can guarantee complete protection against every cybersecurity risk. AcuFlex uses a defense-in-depth approach that combines secure design, encryption, access controls, monitoring, vulnerability management, user guidance, and lifecycle maintenance to reduce risk and support safe, effective use.