ARLYS Inc. (the "Company"), as a healthcare IT startup handling highly sensitive information assets including patient data, recognizes information security as one of the highest priorities in our business operations. This policy is designed to be practically and continuously applied across our cloud-native and generative AI-native development and operations environment.
Protection of Information Assets
We appropriately protect all information assets under our management — including patient data, system logs, personal information, and proprietary technical information — from the perspectives of Confidentiality, Integrity, and Availability (CIA). We continuously implement technical and organizational controls to prevent unauthorized access, leakage, tampering, and loss.
Compliance with Laws and Regulations
We establish and maintain an information management framework that complies with Japan's Act on the Protection of Personal Information, the Medical Care Act, the Guidelines for the Safe Management of Medical Information Systems (Three-Ministry Two-Guideline framework), and all applicable domestic and international laws, regulations, and industry standards. We ensure prompt responses to regulatory revisions and guideline updates.
Education and Training
We provide regular information security education and training to all officers and employees. Through practical training covering phishing countermeasures, incident response procedures, and secure coding practices, we foster a security-first culture across the entire organization.
Continuous Improvement
We regularly assess and review information security risks and maintain an incident response framework. We rapidly collect and analyze security incidents and vulnerability disclosures, driving continuous improvement of our policies, procedures, and technical controls.
Healthcare-Compliant Cloud Infrastructure
We select and configure cloud infrastructure (AWS, Azure, etc.) that meets Japan's medical information guidelines (Three-Ministry Two-Guideline framework) established by MHLW, MIC, and METI. We standardly implement encryption, access controls, and audit logging required for the safe storage, processing, and transmission of medical information, and strictly manage security under the shared responsibility model.
Data Non-Training Environments for Generative AI
When leveraging generative AI in development and operations, we exclusively use API-based access (non-training environments) to ensure patient data and personal information are never used as AI model training data. Before adopting any generative AI service, we require the execution and verification of a Data Processing Agreement (DPA), and organizationally prohibit the input of personal information into prompts.
Segregation of Patient Data and System Logs
We maintain logical and physical separation between patient data and system logs, enforcing Role-Based Access Control (RBAC) and the Principle of Least Privilege for strict access management. All access logs are preserved in a tamper-proof format and regularly audited to enable early detection and response to unauthorized access.
The Company shall communicate this policy throughout the organization and continuously implement and improve it under the leadership of our CEO.