Acceptable Use Policy

1. Who this applies to

This Acceptable Use Policy ("AUP") applies to anyone who accesses the CareCompliant platform ("Service"), including account owners, administrators, managers, carers, auditors, and any other named users. It forms part of our Terms of Service. If you breach this AUP, we may suspend or terminate access.

2. Permitted use

You may use the Service to:

• Manage staff records, training, inductions, and right-to-work checks
• Record, triage, and learn from incidents and near-misses
• Plan and evidence audits, risk assessments, and policy acknowledgements
• Prepare for CQC inspections and evidence ongoing compliance
• Share information within your organisation and with regulators, auditors, or commissioners as appropriate

3. Prohibited conduct

You must not, and must not permit anyone else to:

Illegal or harmful use

• Break any applicable law, including data protection, employment, safeguarding, and CQC regulations
• Upload content that is defamatory, harassing, discriminatory, or otherwise unlawful
• Impersonate another person or misrepresent your role within the organisation
• Use the Service to manage or coordinate activity unrelated to regulated health and social care

Unsafe use in a regulated setting

• Rely on the platform or its AI features to make clinical decisions, diagnose, triage, or judge staff
• Close an incident, sign off a safeguarding concern, or approve an action without the human review the platform asks for
• Fabricate, backdate, or alter records to mislead a regulator or inspector
• Remove AI-flagged evidence requirements to "tidy up" a dashboard ahead of an inspection
• Share access with individuals who have not completed the checks your organisation requires for that role

Security and integrity

• Attempt to gain unauthorised access to any part of the Service, other customers' data, or underlying infrastructure
• Probe, scan, or test the vulnerability of the Service without our prior written consent (see section 7 for coordinated disclosure)
• Interfere with or disrupt the Service, servers, or networks connected to it
• Introduce malware, ransomware, or any other malicious code
• Use automated tools to access the Service except through documented APIs and within rate limits
• Reverse-engineer, decompile, or scrape the Service or its outputs

Credentials and accounts

• Share login credentials between individuals (each named user must have their own account)
• Create accounts for people who do not work for or with your organisation
• Keep active accounts for leavers beyond the handover period
• Disable two-factor authentication where it has been required by your organisation or by us

Data handling

• Upload personal data you have no lawful basis to process
• Upload special category or criminal offence data beyond what the platform is designed for (see our DPA, section 4)
• Export data about service users or staff for purposes unrelated to care delivery and compliance
• Upload content that belongs to another organisation without permission

4. Fair use of shared resources

CareCompliant is a multi-tenant platform. To protect every customer, we may apply reasonable limits to storage, API calls, AI feature usage, bulk exports, and email sending. If your usage is materially higher than comparable organisations on the same plan, we will contact you to agree a fair approach before taking any action.

5. AI feature use

AI features are provided to help you notice, summarise, and prioritise, never to decide on your behalf. You must:

• Apply professional judgement to anything the AI produces before acting on it
• Keep the human acknowledgement step where the platform asks for one
• Not use AI features to generate evidence, reviews, or acknowledgements that were never carried out
• Not prompt AI features to produce clinical advice, diagnoses, or judgements about individual staff members

6. Reporting abuse

If you believe the Service is being misused (by someone in your organisation, by another customer, or by a third party), email [email protected]. We take every report seriously and will acknowledge within one business day.

7. Coordinated vulnerability disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability:

• Email [email protected] with a clear description and proof of concept
• Give us a reasonable opportunity to fix the issue before public disclosure
• Do not access, modify, or delete data that does not belong to you
• Do not run denial-of-service tests against production

We will not pursue legal action against researchers who act in good faith under this section.

8. Enforcement

If we reasonably believe this AUP has been breached, we may:

• Contact you to discuss and give you an opportunity to address the issue
• Suspend or disable affected user accounts
• Remove or quarantine offending content
• Suspend or terminate the Service under the Terms of Service
• Cooperate with law enforcement where required

Where there is an immediate risk to safety, data, or the integrity of the Service, we may act without prior notice.

9. Changes

We may update this AUP from time to time. Material changes will be notified at least 30 days in advance. Your continued use of the Service after the effective date constitutes acceptance.

10. Contact

Abuse reports: [email protected]
Security reports: [email protected]
General: [email protected]