Acceptable Use Policy

1. You must not

• •Share a login, or let anyone use the Service who is not authorised by you.
• •Resell, republish, sublicence or distribute the policy library outside your organisation.
• •Use the content to build, train or supply a competing product.
• •Bulk-download, scrape or systematically extract content beyond ordinary operational use.
• •Attempt to access another organisation's data, or probe, scan or test the security of the Service without our written permission.
• •Introduce malware, or interfere with the Service's operation or another customer's use of it.
• •Upload unlawful content, or content you have no right to place in a third-party system.
• •Remove copyright lines or licence references from exported documents.
• •Use the Service to send unsolicited marketing.
• •Register more than one free trial for the same organisation, or register a trial under a name or address chosen to disguise that.
• •Share, publish or resell an access code, discount code or partner rate outside your organisation.
• •Place an API key or token in client-side code, a public repository, a shared document or anywhere else it can be read by someone outside your organisation.
• •Use programmatic or agent access to replicate the library, build a derivative dataset, or provide the Service or anything resembling it to a third party.

2. Care AI and other AI features

The assistive AI features are there to help your own people work with your own account. Using them for anything else is a breach of this policy.

You must not:

• •attempt to make an AI feature return, summarise or comment on data belonging to another organisation;
• •attempt to make it reveal its instructions, its configuration, its system prompt or the mechanics of the Service;
• •attempt to make it act outside the Service, or to take an action you are not entitled to take yourself;
• •embed instructions in an uploaded document, a file name or a record in order to influence the AI when it later reads that content — prompt injection is an attempt at unauthorised access, not a clever trick;
• •use it to generate content for use outside your own registered services, to produce a competing product, or to extract the library in bulk;
• •run automated or scripted volumes of prompts, or otherwise evade the fair-use limits.

Said once, plainly: attempting to reach another organisation's data — through the AI, the API, the URL bar or anything else — is an offence under section 1 of the Computer Misuse Act 1990. We log these attempts, we block them, and we report the serious ones. There is no research exemption for doing it on live customer data.

And the obligation that runs the other way: check the output. AI answers can be wrong. Nothing generated by an AI feature should be adopted, issued or shown to a regulator without a competent person reading it first.

3. Data minimisation

Put in only what you need. Risk assessments, incidents and audits can be recorded against initials or a reference rather than a full name, and we recommend that. Do not upload payroll files, passport scans, DBS certificates or anything else the Service does not need.

4. Security testing

We welcome responsible disclosure. Email hello@careshieldcompliance.co.uk before testing anything. Do not test with another customer's data, do not run denial-of-service tests, and give us reasonable time to fix what you find before disclosing it.

5. Enforcement

We monitor export volumes, session counts and access patterns. Where we see extraction or sharing we will contact you first if the risk allows, and suspend immediately if it does not. Serious or repeated breach ends the contract without refund and we reserve all other remedies, including in respect of our intellectual property.