Compliance and security

Purpose

IPROD S.r.l. regards its Integrated Management System (IMS) as the fundamental tool for combining the quality of the products and services it offers with the protection of information and data, in the context of the development and operation of the iProd cloud platform and of the software and infrastructure supply activities for the medical device sector.

This policy expresses the will of top management to define and maintain a framework capable of guiding the organisation’s strategic choices, operational priorities and improvement objectives. The framework takes into account the context in which the organisation operates, its business model and its strategic direction, and is an expression of the company’s mission and vision.

Through this document, IPROD S.r.l. intends to promote a culture based on shared responsibility, risk awareness and compliance with applicable law, so that every member of the organisation understands their role in achieving the IMS objectives and in meeting the applicable requirements.

Scope

This policy applies to all activities, processes and services managed by IPROD S.r.l. at its operating site at Via Gaetano Malasoma 26, 56121 Pisa (PI), Italy, and to the cloud infrastructure on which the iProd platform is delivered. It involves all personnel of the organisation, external collaborators and third parties who work on behalf of the company or who access its information systems. The manufacture, assembly, sterilisation and physical storage of medical devices are outside the scope, because the organisation operates exclusively as a software developer and IT infrastructure provider.

Normative references

• ISO 13485
• ISO/IEC 27001
• Regulation (EU) 2017/745
• Regulation (EU) 2017/746
• IEC 62304
• GDPR
• Legislative Decree 196/2003 (Italian Personal Data Protection Code)

Normative references for medical devices: MDR, IVDR

In its role as a software developer and supplier of technical components and IT infrastructure on behalf of medical device manufacturers, IPROD S.r.l. operates within the supply chain governed by Regulation (EU) 2017/745 (MDR). The organisation recognises the central importance of this regulatory framework and undertakes to ensure that its software design, development and maintenance activities meet the requirements applicable to its role in the supply chain, with particular attention to the traceability of the goods and services supplied, risk management and conformity with the technical specifications agreed with the manufacturer.

Regulation (EU) 2017/746 (IVDR) is not currently applicable to the organisation’s activities, since the scope of supply does not include in vitro diagnostic medical devices. Should the scope of supply extend to that area, IPROD S.r.l. undertakes to promptly adapt the IMS to the relevant requirements.

The organisation also adopts IEC 62304 as the reference technical standard for the lifecycle of software classified as a medical device, integrating its requirements into its development practices in order to ensure consistency between regulatory obligations and operating processes.

Commitment and objectives of the management system

Management commitment

The top management of IPROD S.r.l., through the Chief Executive Officer, takes full responsibility for the effectiveness of the IMS and undertakes to promote its development, implementation and continual improvement. This commitment takes the form of communicating to the whole organisation the importance of meeting customer and applicable regulatory requirements, of setting measurable objectives, and of conducting management reviews, the arrangements for which are governed by the PRO Management Review Procedure and the outcomes of which are recorded in the MOD Management Review Minutes. Top management also ensures the availability of human, technological and financial resources adequate for the effective operation of the IMS, as governed by the PRO Management Processes procedure.

Quality of products and services

IPROD S.r.l. strives for excellence in the design, development and maintenance of the iProd cloud platform and of the software components intended for integration with medical devices. The organisation undertakes to determine and meet customer requirements and applicable regulatory requirements, placing at the centre of its activity attention to the needs of B2B customers in the manufacturing sector and of medical device manufacturers for whom it operates as a qualified supplier.

Quality is understood as the ability to provide services that conform to contractual and technical specifications, are reliable over time and meet the expectations of interested parties. To this end, the organisation promotes the adoption of structured development practices, the systematic monitoring of process performance and the proactive handling of nonconformities, so that the IMS remains effective and is constantly adapted to the operating context.

Information security

The protection of information is a pillar of IPROD S.r.l.’s activity, given the cloud nature of its services and the criticality of the data processed on behalf of its customers. The organisation takes an approach based on the systematic assessment of the risks that may compromise the confidentiality, integrity and availability of information, calibrating controls in proportion to the level of risk identified, as detailed in the PRO Risk Management Procedure.

IPROD S.r.l. undertakes to meet the applicable information security requirements, whether legislative, regulatory or contractual, and promotes a shared security culture at every level of the organisation, in the conviction that the responsibility for protecting information assets lies with every member of staff. The security principles adopted, including information classification, access control based on the principle of least privilege and secure software coding, are put into operation in the POL Information Security Policy and in the related procedures.

Objectives and continual improvement

This policy is the structural framework for setting and reviewing the IMS objectives, which must be measurable, consistent with the commitments expressed here and updated on the basis of changes in the internal and external context, the results of risk assessments and the outcomes of management reviews. The PRO Objectives and Planning to Achieve Them procedure governs how objectives are defined, planned, implemented and monitored over time.

The organisation sees continual improvement as the driver of the IMS’s evolution: the results of internal and external audits, the analysis of incidents and of emerging threat trends, customer feedback and the needs of interested parties feed a constant review cycle that guides the updating of controls, policies and procedures.

Management system documentation

IPROD S.r.l. undertakes to maintain a structured body of documentation adequate to support the planning, operation and control of its processes. The IMS documentation includes the statements on policy and objectives, the Medical Device Quality Manual, the documented procedures and the records required by the reference standards, as well as any further document required by the applicable regulatory requirements. The operational management of documented information, including identification, approval, distribution and retention, is governed by the PRO Documented Information Management Procedure, while the MOD Documentation List is its up-to-date register.

Communication of the policy

This policy is made available as documented information and communicated to all personnel of the organisation through the internal channels adopted by the IMS, so that every member of staff understands its content and their contribution to achieving the objectives. The organisation also undertakes to make the policy accessible to external interested parties, by publishing it on the corporate website and by including it in supply contracts and in relations with customers, as provided for in the PRO Communication Management Procedure.

The policy is reviewed at every management review and updated when necessary to ensure its continued suitability for the organisation’s context and strategy.