Data Management Policy

Effective Date: August 26, 2024

Purpose

To ensure that information is classified, protected, retained, and securely disposed of in accordance with its importance to the organization.

Scope

All data, information, and information systems managed by AI Word Wiz Corp., including Womb WatchAI & Womb Watch collectively.

Policy

AI Word Wiz Corp. classifies data and information systems according to legal requirements, sensitivity, and business criticality to ensure appropriate levels of protection. Data owners are responsible for identifying any additional requirements for specific data or exceptions to standard handling practices.

Information systems and applications shall be classified according to the highest classification of data they store or process.

Data Classification

Confidential: Highly sensitive data requiring the highest levels of protection; access is restricted to specific employees or departments, and these records can only be passed to others with approval from the data owner or a company executive. Examples include:

• Customer Data
• Personally identifiable information (PII)
• Company financial and banking data
• Salary, compensation, and payroll information
• Strategic plans
• Incident reports
• Risk assessment reports
• Technical vulnerability reports
• Authentication credentials
• Secrets and private keys
• Source code
• Litigation data

Restricted: AI Word Wiz Corp. proprietary information requiring thorough protection; access is restricted to employees with a "need-to-know" based on business requirements. This is the default for all company information unless stated otherwise. Examples include:

• Internal policies
• Legal documents
• Meeting minutes and internal presentations
• Contracts
• Internal reports
• Slack messages
• Email

Public: Documents intended for public consumption which can be freely distributed outside AI Word Wiz Corp. Examples include:

• Marketing materials
• Product descriptions
• Release notes
• External-facing policies

Data Handling

Confidential Data Handling:

• Access for non-preapproved roles requires documented approval from the data owner.
• Access is restricted to specific employees, roles, and/or departments.
• Confidential systems shall not allow unauthenticated or anonymous access.
• Confidential Customer Data shall not be used or stored in non-production systems/environments.
• Confidential data shall be encrypted at rest and in transit over public networks in accordance with the Cryptography Policy.
• Mobile device hard drives containing confidential data, including laptops, shall be encrypted.
• Mobile devices storing or accessing confidential data shall be protected by a log-on password (or equivalent, such as biometric) or passcode and shall be configured to lock the screen after five (5) minutes of non-use.
• Backups shall be encrypted.
• Confidential data shall not be stored on personal phones or devices or removable media including USB drives, CDs, or DVDs.
• Paper records shall be labeled "confidential" and securely stored and disposed of in a secure, approved manner in accordance with data handling and destruction policies and procedures.
• Hardcopy paper records shall only be created based on a business need and shall be avoided whenever possible.
• Hard drives and mobile devices used to store confidential information must be securely wiped prior to disposal or physically destroyed.
• Transfer of confidential data to people or entities outside the company shall only be done in accordance with a legal contract or arrangement, and with the explicit written permission of management or the data owner.

Restricted Data Handling:

• Access is restricted to users with a need-to-know based on business requirements.
• Restricted systems shall not allow unauthenticated or anonymous access.
• Transfer of restricted data to people or entities outside the company or authorized users shall require management approval and shall only be done in accordance with a legal contract or arrangement, or with the permission of the data owner.
• Paper records shall be securely stored and disposed of in a secure, approved manner in accordance with data handling and destruction policies and procedures.
• Hard drives and mobile devices used to store restricted information must be securely wiped prior to disposal or physically destroyed.

Public Data Handling:

• No special protection or handling controls are required for public data. Public data may be freely distributed.

Data Retention

AI Word Wiz Corp. shall retain data as long as the company has a need for its use or to meet regulatory or contractual requirements. Once data is no longer needed, it shall be securely disposed of or archived. Data owners, in consultation with legal counsel, may determine retention periods for their data. Personally identifiable information (PII) shall be deleted or de-identified as soon as it no longer has a business use. Retention periods shall be documented in the Data Retention Matrix in Appendix B to this policy.

Data & Device Disposal

Data classified as restricted or confidential shall be securely deleted when no longer needed. AI Word Wiz Corp. shall assess the data and disposal practices of third-party vendors in accordance with the Third-Party Management Policy. Only third parties who meet AI Word Wiz Corp. requirements for secure data disposal shall be used for storage and processing of restricted or confidential data.
AI Word Wiz Corp. shall ensure that all restricted and confidential data is securely deleted from company devices prior to, or at the time of, disposal.
Confidential and Restricted hardcopy materials shall be shredded or otherwise disposed of using a secure method.

Annual Data Review

Management shall review data retention requirements during the annual review of this policy. Data shall be disposed of in accordance with this policy.

Legal Requirements

Under certain circumstances, AI Word Wiz Corp. may become subject to legal proceedings requiring retention of data associated with legal holds, lawsuits, or other matters as stipulated by AI Word Wiz Corp. legal counsel. Such records and information are exempt from any other requirements specified within this Data Management Policy and are to be retained in accordance with requirements identified by the Legal department. All such holds and special retention requirements are subject to annual review with AI Word Wiz Corp.’s legal counsel to evaluate continuing requirements and scope.

Policy Compliance

AI Word Wiz Corp. will measure and verify compliance with this policy through various methods, including but not limited to, business tool reports, and both internal and external audits.

Exceptions

Requests for an exception to this policy must be submitted to the Chief Risk Officer (CRO) for approval.

Violations & Enforcement

Any known violations of this policy should be reported to the CRO. Violations of this policy can result in immediate withdrawal or suspension of system and network privileges and/or disciplinary action in accordance with company procedures up to and including termination of employment.

Version

• Date: 26 August 2024
• Description: First Version
• Author: Quanda Francis
• Approved by: Quanda Francis -Chief Technology Officer

APPENDIX A – Internal Retention and Disposal Procedure

AI Word Wiz Corp.'s Engineering Team is responsible for setting and enforcing the data retention and disposal procedures for AI Word Wiz Corp. managed accounts and devices.

• Customer Accounts: Customer accounts and data shall be deleted within sixty (60) days of contract termination through manual data deletion processes.
• Devices: Employee devices will be collected promptly upon an employee’s termination. Remote employees will be sent a shipping label, and the return of their device shall be monitored. Collected devices will be cleared to be re-provisioned—or removed from inventory; AI Word Wiz Corp. will securely erase the device when reprovisioning. Device images may be retained at the discretion of management for business purposes. In cases where a device is damaged in a way that AI Word Wiz Corp. cannot access the Recovery Partition to erase the drive, AI Word Wiz Corp. may optionally decide to use an E-Waste service that includes data destruction with a certificate. AI Word Wiz Corp. will keep certificates of destruction on record for one year. Physical destruction can be optional if it is verified that the device is encrypted with Full Disk Encryption, which would negate the risk of data recovery. Management will review this procedure at least annually.

APPENDIX B – Data Retention Matrix

This table outlines the data retention periods for various systems and applications within AI Word Wiz Corp.