Acceptable Use Policy

This Acceptable Use Policy ("AUP") applies to everyone who accesses CUBE OneCare: the customer organizations that provision accounts, the end-users who sign in (providers, patients, administrators, caregivers), and any person who interacts with the platform through APIs, webhooks, or integrations. The AUP is incorporated by reference into the Terms of Service.

You must not, and must not permit any third party to:

• Violate any applicable law or regulation, including HIPAA, HITECH, GDPR, and any law governing medical licensure, controlled substances, or consumer protection.
• Upload, transmit, or store malware, ransomware, worms, keyloggers, or any content designed to interfere with the operation of the platform or of any third party.
• Attempt to probe, scan, or test the vulnerability of the system or network, or breach security or authentication measures, except under a sanctioned program coordinated with our security team (see § 5 Responsible Disclosure).
• Use the platform to send unsolicited bulk communications, spam, chain messages, or harass any individual.
• Access or attempt to access PHI belonging to individuals for whom you have neither a treatment relationship nor a permitted business reason.
• Scrape, crawl, or enumerate the platform or APIs at rates materially inconsistent with human interaction, or use the platform to train a machine-learning model without written authorization.
• Reverse engineer, decompile, or disassemble the platform, or remove proprietary notices from the service.
• Resell, sublicense, or otherwise provide the platform as a service to parties that are not contractually identified end-users of your subscription.
• Use the platform for operations classified as a medical device by a regulator, unless CUBE OneCare has in writing acknowledged the specific feature as fit for that regulated use.
• Use the platform in ways that cause disproportionate harm to others — including discriminatory or illegally-targeted behaviour against protected classes.

• Keep credentials (passwords, API keys, MFA seeds) confidential. Report suspected compromise immediately through the secure compliance contact form.
• Ensure individuals under your organization's account receive appropriate HIPAA and privacy training before accessing PHI.
• Keep configuration and access controls aligned with the principle of least privilege, and review role assignments at least quarterly.
• Promptly notify us if you believe another user is violating this AUP, at [email protected].

We may take any of the following actions when we become aware of an AUP violation, based on severity, recurrence, and risk to other customers or patients:

• Request remediation and proof of corrective action from the responsible customer.
• Temporarily suspend the offending account, integration, or IP ranges.
• Terminate the customer's subscription without refund for material breaches.
• Preserve evidence and cooperate with law-enforcement inquiries where legally required.

We prioritize customer continuity: we will attempt to scope the enforcement as narrowly as possible consistent with the harm. Critical security threats (active exfiltration, ransomware, imminent patient-safety risk) may justify immediate unscoped suspension.

Security researchers are encouraged to report suspected vulnerabilities through our responsible-disclosure program: use the secure compliance contact form with reproduction steps. Good-faith research conducted within the scope published at /trust (no exfiltration of real PHI, no social engineering of staff or users) will not trigger legal action under this AUP. We commit to acknowledging reports within two business days and following up within fifteen.

We may update this AUP as the platform evolves. Material changes will be announced at least thirty (30) days in advance via the customer administrator console. Continued use of the service after the effective date of a change constitutes acceptance.