Legal Notice

Presentation

This website is owned by Wandercraft, a simplified joint-stock company (société par actions simplifiée) under French law with a share capital of €82,288.40, with its registered office at 88 rue de Rivoli, 75004 Paris (France), registered with the Versailles Trade and Companies Register (RCS) under SIRET number 788 627 198 000 21 and intra-Community VAT number FR02788627198.

Wandercraft's Marketing and Communications Department is responsible for maintaining the website and is headquartered at 88 rue de Rivoli, Paris.

Phone (France): 01 79 35 09 49

Phone number in the U.S.: 646-448-4787

Email: contact@wandercraft.health

Website Hosting

The website www.wandercraft.eu is hosted by Webflow, Inc., located at 398 11th Street, 2nd Floor, San Francisco, CA 94103

Email: contact@webflow.com

Complaints

If you have any complaints about the content of the site or your experience with our products, please send an email to contact@wandercraft.health

Photo Credits

Photos: Wandercraft

Videos: Wandercraft

Coordinated Vulnerability Disclosure Policy

Updated in May 2026

Wandercraft recognizes the important role that security researchers—whether individuals or organizations—play in promoting secure design practices and mitigating security risks, both in the medical device sector specifically and in the healthcare ecosystem more broadly. The purpose of this policy is to provide security researchers with clear guidelines for conducting vulnerability discovery activities and to communicate our preferences regarding how to report discovered vulnerabilities to us.

This policy describes which systems and types of research it covers, how to submit vulnerability reports to us, and how long we ask security researchers to wait before publicly disclosing vulnerabilities.

We encourage you to contact us to report any potential vulnerabilities in our systems.

Subject

The goal of Wandercraft’s coordinated vulnerability disclosure program is to coordinate the investigation and disclosure of potential new vulnerabilities in Wandercraft products. The shared goal of security researchers and Wandercraft should always be to reduce risk, taking due account of the entire operational environment affected by any discovered vulnerability.

Scope of Application

This Coordinated Vulnerability Disclosure Statement applies to all commercially available Wandercraft products, including related applications (“Wandercraft products”).

This process should be used to report potential new vulnerabilities in Wandercraft products. Vulnerabilities in operating systems and other third-party components should not be reported through this process.

Although we develop and maintain other systems and services accessible via the Internet, we ask that research and active testing be conducted only on the systems and services covered by the scope of this document. If you believe that a specific system not included in the scope warrants testing, please contact us first to discuss it. Over time, we will expand the scope of this policy.

Prerequisites for Notification

Security researchers must meet the following prerequisites throughout the entire research and disclosure process, including the initial investigation and testing:

• Comply with all applicable laws and regulations in your location and in the location where the Wandercraft product is located;
• Do not use a vulnerability to carry out disproportionate actions, such as exploiting a vulnerability beyond demonstrating its existence, collecting more data than is strictly necessary to verify it, altering or deleting sensitive data from the product, or creating a backdoor in a product or otherwise introducing additional vulnerabilities into it for later use;
• Do not conduct research or testing on systems where there is any risk of harm to patients;
• Do not test products or network infrastructure in clinical or other active environments where Wandercraft products are being used for any type of patient diagnosis, treatment, care, or monitoring, or where they could inadvertently be used for such purposes;
• Any Wandercraft product intended for subsequent use in a clinical setting must be restored to its original condition once testing is complete. Please contact Wandercraft for technical assistance;
• Be sure to obtain written authorization from the owner of the Wandercraft product before conducting any tests, so that the scope of the tests is clear.
• Do not publicly disclose the details of a vulnerability before the deadline mutually agreed upon with Wandercraft has expired;
• Do not act outside the scope described in this document; and
• Please provide us immediately with the details of any communication to regulatory agencies or other third parties regarding any discovered vulnerabilities.

Once you have confirmed the existence of a vulnerability or discovered any sensitive data (including personally identifiable information, protected health information, financial information, intellectual property, confidential information, or trade secrets of any party), you must stop the test, notify us immediately, and not disclose this data to anyone else.

Test Method

The following test methods are not permitted:

• Network denial-of-service (DoS or DDoS) attacks or other attacks that hinder access to a system or data, or that damage them
• Physical tests (e.g., office access, open doors, “tailgating”), social engineering (e.g., phishing, vishing, smishing), or other non-technical vulnerability tests

Vulnerability Report

To report a potential new vulnerability to the Wandercraft product security team, please send an email to (cvd@wandercraft.health). Use our PGP key or other appropriate encryption tools to protect any sensitive information. Do not include sensitive data (such as personally identifiable patient information or protected health information) in the body of the email or in any attachments (such as screenshots, images, or log files).

Information submitted under this policy will be used solely for defensive purposes: to mitigate or correct vulnerabilities.

This CVD email address should not be used for inquiries regarding previously disclosed vulnerabilities or vulnerabilities in third-party components (other than Wandercraft products). Information regarding previously disclosed vulnerabilities can be requested by contacting Wandercraft.

What we're asking for

To help us sort and prioritize submissions, we recommend that your reports:

• Describe the location where the vulnerability was discovered and the potential impact of its exploitation.