amwell iso 27001 certificate 2023.pdf

CERTIFICATE OF REGISTRATION

Information Security Management System-ISO/IEC 27001:2013

The Certification Body of Schellman Compliance, LLC hereby certifies that the following organization operates an Information Security Management System that conforms to the requirements of ISO/IEC 27001:2013

American Well Corporation

for the following scope of registration The scope of the ISO/IEC 27001:2013 certification is limited to the information security management system (ISMS) supporting the operations underlying the Amwell Telehealth Solution (video healthcare encounters and secure chat) including Home CareTalks, Hospital Acute Care, Converge Platform, Conversa Automated Care, and SilverCloud Health, in accordance with the Statement of Applicability version 6.0, dated November 24, 2021. The organizational scope includes the Governance, Risk, and Compliance (GRC), Information Security, Information Technology, Product Development, and Clinical Operations teams affecting the ISMS.

which includes the following in-scope location(s) on page 2 of 2

Certificate Number: 1347810-2
Authorized by:

Ryan Mackie Principal, Schellman Compliance, LLC 4010 W Boy Scout Blvd., Suite 600 Tampa, Florida 33607, United States www.schellman.com

Issue Date Original Registration Date Expiration Date Certificate Version
September 8, 2023 February 9, 2018 December 27, 2026 Version 2

  1. The aforementioned organization has a perpetual responsibility to maintain compliance with ISO/IEC 27001:2013 during the period of certification.

  2. This certificate is subject to the satisfactory completion of annual surveillance audits by Schellman Compliance, LLC

  3. ISO/IEC 27001:2013 compliance audits are not designed to detect or prevent criminal activity or other acts that may result in an information security breach. As such, this certification should not be construed as a guarantee or assurance that an organization is unsusceptible to information security breaches.

  4. The information in this document is provided “AS IS”, without warranties of any kind. Schellman Compliance, LLC expressly disclaims any representations and warranties, including, without limitation, the implied warranties of merchantability and fitness for a particular purpose.

  5. This certificate is the property of Schellman Compliance, LLC and is bound by the conditions of contract. The authenticity of this certificate can be validated by contacting Schellman Compliance, LLC

  6. Certificates against the ISO/IEC 27001:2013 version of the standards will expire on October 31, 2025 if not transitioned to the ISO/IEC 27001:2022 version per the IAF MD 26 requirements.

Certificate Number: 1347810-2

In-Scope Location(s)

Location Function / Role

75 State Street Main location of the ISMS and central office supporting Floors 26 & 27 operational control and authority for the management Boston, Massachusetts 02109 system; policy and procedure reviews; business United States operations; system development; application security; background checks; product management; and analysis of statutory and regulatory requirements