Security Policy – Protecting Your Data and Transactions

At Global Pharma Cares, protecting your personal information and transaction data is a priority. We use security measures designed to help safeguard information transmitted through our website and payment processes.

Security at Global Pharma Cares

At Global Pharma Cares, the security of our customers’ personal and financial information is of utmost importance. We have implemented comprehensive security measures and best practices to help safeguard your data against unauthorized access, use, disclosure and other security threats.

This Security Policy outlines the security protocols, technologies and procedures we employ to protect your information when you browse our website, create an account and conduct transactions with us.

We are committed to maintaining high standards of information security and regularly reviewing our security practices as technology and security threats evolve.

SSL/TLS Encryption

What Is SSL Encryption?

SSL and TLS are encryption protocols designed to protect data transmitted between your browser and our servers. They establish an encrypted connection so information transmitted through the website is protected during transfer.

Our SSL/TLS Implementation

Security Area	Implementation
TLS Protocols	TLS 1.2 and TLS 1.3
Encryption	256-bit encryption
Stored Data	AES encryption for data at rest
Key Exchange	RSA 2048-bit or higher where applicable
Certificate	Active SSL/TLS certificate from a trusted Certificate Authority
Website Coverage	HTTPS protection across GlobalPharmaCares.com

How an Encrypted Connection Works

You connect to our website.

Your browser verifies the site’s SSL/TLS certificate.

An encrypted connection is established.

Information you submit is encrypted during transmission.

Our systems process the information securely.

Responses are transmitted back over the encrypted connection.

What This Means for You

Your connection uses HTTPS encryption
Your browser can verify the website certificate
Information transmitted through the connection is encrypted
The padlock indicator helps confirm an encrypted connection

Secure Payment Processing

How We Process Payments Safely

Payment Security Standards

Payment processing is designed around applicable payment-security requirements
Payment systems use security controls for transaction handling
Payment information is transmitted using encrypted connections
Access to payment-related information is restricted

Credit Card Protection

Full payment-card information is not intended to be stored directly on our website servers
Payment processing may be handled by secure third-party providers
Transactions may use tokenization and encryption
Limited transaction information may be retained for order records

Payment Processing Flow

You enter the required payment information during checkout.

Payment data is transmitted through an encrypted connection.

The payment provider verifies and processes the transaction.

The transaction is authorized or declined.

A transaction result is returned to the website.

Your order record is updated based on the transaction result.

Payment Options

Payment Type	Security Context
Card Payments	Encrypted payment processing with applicable verification controls
Digital Wallets	May use tokenization and provider-level authentication
PayPal	Processed through PayPal’s payment environment where available
Bank Transfers	Available payment processes may vary by region

Firewall and Network Security

Network Protection

Network traffic is subject to security controls
Unauthorized access attempts can be blocked
Incoming and outgoing traffic may be monitored
Security rules help reduce malicious traffic

Server Protection

Server-level security controls
Application-level protection
Threat detection and monitoring
Security scanning and updates

Intrusion Detection

Traffic may be monitored for suspicious behaviour
Security alerts can be generated for unusual activity
Automated controls may block detected threats
Events can be reviewed as part of security monitoring

DDoS Protection

Traffic filtering measures
Controls designed to help maintain website availability
Load-management measures where applicable
Monitoring for abnormal traffic patterns

Network Segmentation

Customer information can be separated from general website systems
Payment-related systems can operate through separate providers or environments
Administrative systems use restricted access
Database access can be protected behind multiple security controls

Secure Data Storage

Database Security

Encryption at Rest

Stored information may be encrypted
Encryption keys are managed separately from ordinary user access
Backups may also be encrypted

Access Controls

Database access is restricted
Role-based access controls may be used
Administrative access can require additional authentication
Access activity may be logged

Backup Security

Automated backups may be created regularly
Backup information can be stored securely
Recovery processes can be tested periodically
Backup retention is managed according to operational needs

File Storage

Files are stored in controlled environments
Access is limited to authorized users or systems
Access may be logged
Obsolete information can be removed according to retention procedures

Security Audits and Vulnerability Testing

Security requires ongoing review. Our security approach may include assessments designed to identify vulnerabilities and improve protective controls.

Security Reviews

Periodic security assessments
Review of website and system configuration
Evaluation of identified risks
Remediation of confirmed weaknesses

Vulnerability Testing

Automated vulnerability scanning
Review of security updates
Monitoring for newly disclosed vulnerabilities
Prioritization of significant security issues

Application Review

Review of website components
Security testing before significant changes where appropriate
Updating software and dependencies
Review of security configuration

Security Incident Response

Detect and assess the reported security issue.

Contain affected systems where necessary.

Investigate the nature and scope of the issue.

Address the identified vulnerability.

Restore affected services safely.

Notify affected users where required.

Document the incident and improvements made.

Continue monitoring for recurrence.

Third-Party Security Standards

Some website operations depend on third-party service providers. Security considerations form part of how those services are selected and managed.

Payment Providers

Appropriate payment-security controls
Encrypted transaction handling
Security and compliance responsibilities
Incident-management procedures

Hosting Providers

Data-center security controls
Infrastructure monitoring
Backup and recovery capabilities
Access restrictions

Email & Communication Services

Encrypted connections where supported
Account-access controls
Security updates
Data-protection requirements

Analytics & Monitoring

Secure data transmission
Access restrictions
Retention controls
Privacy considerations

Vendor Oversight

Periodic review of important service providers
Security and privacy requirements where appropriate
Incident-reporting expectations
Review of significant service changes

Access Control and Authentication

Employee Access Management

Least Privilege

Access can be limited according to job responsibilities
Administrative permissions are restricted
Access rights can be reviewed periodically
Unnecessary access can be removed

Multi-Factor Authentication

Additional authentication may be required for sensitive systems
Authenticator applications can be used where supported
Security keys may be supported for selected systems

Access Logging

Administrative activity may be logged
Logs can include user, action and timestamp information
Suspicious access patterns can be reviewed

Customer Account Security

Password Security

Passwords should be stored using secure hashing methods
Passwords should not be stored as readable plain text
Password resets require identity verification through the account process
Strong, unique passwords are recommended

Account Authentication

Additional authentication options may be available
Account-recovery controls may be used
Authentication processes are designed to reduce unauthorized access

Session Management

Sessions may expire after inactivity
Secure cookies may be used
Forms may use anti-forgery protections
Session identifiers can be refreshed periodically

Industry Security Best Practices

Information Security

Security management practices are reviewed as technology and operational requirements evolve.

Web Application Security

Common web-security risks are considered when maintaining and updating the website.

Data Protection

Privacy and data-protection requirements are considered according to applicable laws and customer location.

Continuous Improvement

Security measures are reviewed and updated as threats, standards and technologies change.

Website and Application Security

HTTPS Enforcement

Website pages use HTTPS where configured
HTTP traffic can be redirected to HTTPS
Security headers may be used to strengthen browser protection
Mixed-content issues are monitored and corrected where identified

Security Headers

Content Security Policy where applicable
Frame restrictions to reduce clickjacking risk
Content-type protections
Referrer controls
Browser-feature restrictions where appropriate

Input Validation

User input is validated before processing
Controls help reduce SQL injection risk
Controls help reduce cross-site scripting risk
File uploads can be validated

Output Protection

Output is encoded according to context
HTML content is handled safely
Links and URLs are validated where appropriate
Security controls reduce injection risks

API Security

Authentication

Authentication is required for protected services
Tokens can expire and be renewed
Rate limiting may be used to prevent abuse

Encryption

API traffic uses encrypted connections where applicable
Sensitive information should not be exposed unnecessarily
Authentication tokens are transmitted securely

Authorization

Role-based access controls may be used
Permissions can be restricted by endpoint or service
Access activity may be logged

Malware and Threat Protection

Malware Detection

Security scanning of website systems
Threat detection tools where appropriate
Regular security updates
Review of suspicious files or activity

Threat Intelligence

Monitoring of emerging vulnerabilities
Review of relevant security advisories
Prioritization of significant patches
Updates to security controls where needed

Security Monitoring

Monitoring for suspicious activity
Security alerts where appropriate
Investigation of significant events
Response procedures for confirmed threats

Backup and Business Continuity

Area	Security Approach
Backup Frequency	Automated and scheduled backups according to operational requirements
Backup Protection	Backup information can be encrypted and access restricted
Recovery Testing	Recovery procedures may be tested periodically
Business Continuity	Redundancy and recovery procedures are maintained where appropriate
Service Restoration	Systems can be restored using established recovery procedures

Security Training and Awareness

Security Fundamentals

Security policies and procedures
Password and access-control practices
Data-protection responsibilities
Incident-reporting procedures

Ongoing Awareness

Security updates and reminders
Training on emerging threats
Policy and procedure updates
Role-specific guidance where required

Phishing Awareness

Recognizing suspicious messages
Avoiding unsafe links and attachments
Reporting suspected phishing attempts
Reviewing common social-engineering techniques

Physical Security Measures

Data Center Security

Controlled access to infrastructure
Restricted areas for sensitive equipment
Environmental monitoring
Power and continuity systems
Physical monitoring measures

Office Security

Controlled access to sensitive areas
Secure handling of documents
Appropriate disposal of confidential material
Protection of devices and workstations
Restricted access to business information

What Happens If a Security Incident Occurs

If a security incident affecting customer data is identified, our response focuses on containment, investigation, remediation and appropriate communication.

Stage	Actions
Immediate Response	Detect the incident, assess severity, isolate affected systems and preserve relevant evidence.
Investigation	Determine the scope, affected information, root cause and appropriate mitigation measures.
Notification	Notify affected individuals or authorities where required by applicable law.
Resolution	Address the vulnerability, restore systems safely and implement preventive measures.
Follow-Up	Continue monitoring and review the incident to improve future security practices.

Your Role in Security

While we maintain security controls for our website and systems, customers also play an important role in protecting their accounts and information.

Protect Your Account

Use a strong and unique password
Do not share your password
Avoid reusing passwords across websites
Change your password if you suspect unauthorized access
Use additional authentication if available

Secure Your Device

Keep operating systems and software updated
Use reputable security software
Keep your browser updated
Avoid sensitive transactions on untrusted networks

Recognize Threats

Be cautious with unexpected emails claiming to represent us
Do not click suspicious links
Do not download unexpected attachments
Check website addresses before entering sensitive information
Report suspected phishing attempts

Monitor Your Account

Review account activity regularly
Check your order history
Watch for unauthorized activity
Review relevant payment statements
Report suspicious activity promptly

Security Compliance and Standards

Framework / Requirement	Area
PCI-DSS	Payment-card security requirements where applicable
GDPR	European data-protection requirements where applicable
CCPA	California privacy requirements where applicable
Information Security Standards	Security-management and risk-control practices
Service Provider Controls	Review of relevant third-party security responsibilities

Report a Security Concern

If you discover a security vulnerability or have a security concern, please report it privately rather than posting technical details publicly.

SECURITY CONTACT security@globalpharmacares.com

Suggested Subject:
SECURITY ISSUE – [Brief Description]

Information to Include

Description of the vulnerability or concern
Steps to reproduce the issue where applicable
Potential impact
Your preferred contact information
Proof of concept if relevant and safe to provide

Our Response

Acknowledge the security report
Assess the reported issue
Investigate confirmed vulnerabilities
Provide updates where appropriate
Confirm when remediation is complete where possible

Our Commitment to Continuous Security Improvement

Security is not static. It is an ongoing process that requires regular review as technology, systems and security risks evolve.

Staying informed about emerging threats and vulnerabilities
Regularly reviewing security measures
Updating security technologies where appropriate
Training our team on evolving security practices
Learning from security incidents across the industry
Applying relevant security best practices
Maintaining clear communication about significant security issues
Reviewing customer security concerns and feedback

As new threats emerge and technology changes, we continue to review and adapt our security practices.

GLOBAL PHARMA CARES SECURITY

Your Security Is Our Priority

At Global Pharma Cares, protecting customer information is an important part of how we operate. We continue to review security infrastructure, monitoring and internal practices to help protect personal and transaction information.

Trust depends on consistent and transparent security practices. We will continue adapting our approach as technology, security standards and threats evolve.