MyTherapy EU Declaration of Conformity under the Cyber Resilience Act

EU Declaration of Conformity

  1. Product: MyTherapy mobile application and related backend services.
  2. Manufacturer: smartpatient GmbH, Neumarkter Str. 87, 81673 Munich, Germany.
  3. Responsibility statement: This declaration of conformity is issued under the sole responsibility of the manufacturer, smartpatient GmbH.
  4. Object of the declaration: MyTherapy is a software product with digital elements made available as a mobile application for iOS and Android, supported by backend services and APIs necessary for its operation. The product supports medication management and health-related self-organisation, including reminders, treatment documentation, and connected digital functionality. Product traceability is maintained through released application versions, platform-specific distribution records, backend release records, and associated software bill of materials documentation.
  5. Conformity statement: The object of the declaration described above is in conformity with Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act).
  6. References to relevant specifications: The conformity assessment is supported by the manufacturer’s documented information security and secure development framework, including ISO/IEC 27001:2022 certified controls and related internal processes for vulnerability handling, secure development, change management, monitoring, incident response, and software component governance. Public supporting documents include the MyTherapy Cybersecurity & Safe Use Information page and the Coordinated Vulnerability Disclosure Policy. Where relevant, the manufacturer also maintains a Software Bill of Materials for MyTherapy as part of the technical documentation.
  7. Conformity assessment procedure: Conformity assessment is performed under the internal control procedure applicable to products with digital elements that are not subject to mandatory third-party assessment under the Cyber Resilience Act.
  8. On behalf of: smartpatient GmbH, Munich, Germany.

Name: Amir Ali Khalil Ibrahim, Rense Johannes Kramer

Function: Managing Directors

Date of issue: 14 Aug 2026

Version Number: v1.0

CE marking

The CE marking is affixed under the sole responsibility of the digital product manufacturer.