Security & Compliance

01 — Security & Compliance Overview

Jerome's Digital Shop (jeromesdigitalshop.com) is an e-commerce platform offering premium digital products including ebooks, educational guides, trading resources, and professional development materials. We are founded by a Registered Nurse (RN-BSN) and Pharmacy Technician with deep understanding of data protection in both healthcare and digital commerce.

Our security practices are aligned with three internationally recognized frameworks:

• ISO 27001:2022 — The international standard for Information Security Management Systems (ISMS), providing the governance backbone for our security program.
• SOC 2 (Trust Services Criteria) — Verifying that our controls for security, availability, processing integrity, confidentiality, and privacy meet rigorous standards.
• HIPAA (Health Insurance Portability and Accountability Act) — Ensuring compliance with U.S. federal requirements for protecting health information, given our healthcare-adjacent product offerings.

02 — What Data We Collect

We collect only the minimum data necessary to provide our services and fulfill your orders:

03 — How We Use Your Data

Your data is used strictly for the following purposes:

• Order Fulfillment — Delivering your purchased digital products and processing transactions.
• Customer Support — Responding to inquiries, troubleshooting issues, and managing your account.
• Service Improvement — Analyzing usage patterns to improve our website, products, and user experience.
• Security Monitoring — Detecting and preventing unauthorized access, fraud, and security threats.
• Legal Compliance — Meeting our obligations under applicable laws, including tax reporting and fraud prevention.
• Communications — Sending order confirmations, product updates, and (with your consent) promotional materials. You may opt out of marketing communications at any time.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

04 — How We Protect Your Data

We implement multiple layers of security controls aligned with ISO 27001, SOC 2, and HIPAA requirements:

Encryption

• TLS 1.2+ encryption on all connections — every page on our site is served over HTTPS with HSTS enabled.
• AES-256 encryption at rest for stored data, including databases and backups.
• Encrypted backups stored in geographically separate locations for disaster recovery.

Infrastructure Security

• Web Application Firewall (WAF) protecting against OWASP Top 10 attacks (SQL injection, XSS, CSRF).
• DDoS mitigation via CDN with rate limiting on all endpoints.
• Security headers including Content-Security-Policy, X-Frame-Options, and Referrer-Policy.
• Regular vulnerability scanning with critical findings remediated within 72 hours.

Monitoring & Logging

• Comprehensive audit logging of all administrative actions, data access events, and authentication attempts.
• Real-time alerting on suspicious activity including failed login attempts, bulk data exports, and privilege escalation.
• Log retention for a minimum of 6 years in tamper-proof, append-only storage (per HIPAA requirements).

05 — Access Control & Authentication

Access to systems containing customer data is strictly controlled:

• Multi-Factor Authentication (MFA) required for all administrative access — TOTP or hardware key (FIDO2).
• Role-Based Access Control (RBAC) enforcing the principle of least privilege — personnel only access data required for their function.
• Unique user IDs — no shared accounts. Every action is traceable to an individual.
• Session management with automatic timeout after 15 minutes of inactivity for administrative sessions.
• Quarterly access reviews to verify all user permissions remain appropriate.
• Immediate revocation of access upon role change or personnel departure.

06 — Data Classification & Handling

All data is classified into four tiers with corresponding handling requirements:

Data Lifecycle

Data is managed through its complete lifecycle:

• Collection: Data is classified at the point of creation with appropriate metadata tagging.
• Storage: Encryption requirements applied per classification level. Restricted data never stored on personal devices.
• Transmission: TLS minimum. Restricted data requires end-to-end encryption.
• Retention: Defined periods per data type — PHI retained 6 years; financial data 7 years; customer PII for duration of relationship plus 3 years.
• Disposal: Cryptographic erasure or certified destruction with documented disposal events.

07 — HIPAA Notice of Privacy Practices

Given our founder's healthcare background (RN-BSN, Pharmacy Technician) and our healthcare-adjacent digital products, we maintain HIPAA-aligned practices to protect any health-related information that may be collected through our platform.

Administrative Safeguards

• Designated HIPAA Privacy Officer and Security Officer
• Annual Security Risk Assessment (SRA) conducted and documented
• Workforce HIPAA training within 30 days of access to PHI, then annually
• Documented sanctions policy for HIPAA violations
• Contingency plan including backup, disaster recovery, and emergency mode operation

Physical Safeguards

• Facility access controls with documented physical security measures
• Workstation security — auto-lock screens (≤ 5 minutes), full-disk encryption (BitLocker/FileVault)
• Device and media disposal procedures — certified wipe or physical destruction

Technical Safeguards

• Unique user identification — no shared accounts
• Emergency access (break-glass) procedure with full audit trail
• Automatic session logoff after ≤ 15 minutes of inactivity
• AES-256 encryption for PHI at rest; TLS 1.2+ for PHI in transit
• Audit controls generating logs for all systems that create, store, or transmit PHI
• Integrity controls to verify PHI has not been altered without authorization
• Person/entity authentication via MFA for all digital PHI access

08 — Third-Party Services & Business Associate Agreements

We carefully select third-party service providers and require appropriate safeguards:

All business associates are contractually required to:

• Implement appropriate security safeguards
• Report breaches of unsecured PHI promptly
• Ensure subcontractors also maintain BAAs
• Return or destroy PHI upon contract termination
• Make practices available for compliance audits

09 — Incident Response & Breach Notification

We maintain a documented Incident Response Plan with defined severity levels and response procedures:

HIPAA Breach Notification

In the event of a breach involving Protected Health Information, we comply with federal notification requirements under 45 CFR §§ 164.404–408:

• Individual notification — within 60 calendar days of discovering the breach, via written notice.
• HHS notification — breaches affecting ≥ 500 individuals reported within 60 days; smaller breaches reported annually.
• Media notification — if ≥ 500 residents of a single state/jurisdiction are affected, prominent media outlets notified within 60 days.

All notification content includes: description of the breach, types of information involved, steps you should take, our investigation and mitigation actions, and contact information for questions.

10 — Your Rights

You have the following rights regarding your personal data and any Protected Health Information:

• Right to Access — Request copies of your personal data or PHI. We will respond within 30 days.
• Right to Amendment — Request corrections to inaccurate personal data or PHI. We will respond within 60 days.
• Right to Deletion — Request deletion of your personal data, subject to legal retention requirements.
• Right to Restrict Processing — Request limitations on how your data is used or disclosed.
• Right to Data Portability — Receive your data in a structured, machine-readable format.
• Right to an Accounting of Disclosures — Request a log of who accessed your PHI and for what purpose.
• Right to Confidential Communications — Request alternative methods of communication (e.g., "contact me only by email").
• Right to Opt Out — Unsubscribe from marketing communications at any time with no impact on your purchased products or services.

To exercise any of these rights, please contact us using the information below.

11 — Contact Us