Acceptable Use Policy

This Acceptable Use Policy (“AUP”) applies to all users of the ClintoBytes Service provided by PulamAI Tech Private Limited, trading as ClintoBytes. It is incorporated into the Terms of Service.

1. Permitted use

You may use the Service only for lawful healthcare administration and related business operations within your organisation, within the features and limits of your plan, and in accordance with applicable law, professional obligations, the Terms of Service and the DPA.

2. Prohibited activities

You must not, and must not permit any user or third party to:

2.1 Unlawful or harmful use

• use the Service to violate any law, court order, professional obligation or third-party right;
• submit, disclose or process personal data without the authority, notice, consent or other lawful basis required;
• use the Service to harass, threaten, exploit, discriminate unlawfully against, or harm any person;
• use the Service for emergency response or as a substitute for direct emergency services or clinical assessment; or
• misrepresent AI-generated material as independently verified clinical advice.

2.2 Security abuse

• attempt to gain unauthorised access to accounts, tenants, branches, systems, databases, APIs or infrastructure;
• probe, scan or test vulnerabilities without prior written authorisation;
• bypass authentication, tenant separation, role permissions, feature entitlements, usage limits or rate limits;
• introduce malware, malicious code, ransomware, destructive scripts or harmful payloads;
• interfere with or disrupt the Service, its networks or other customers’ use;
• conduct denial-of-service tests, load tests or penetration tests without written approval; or
• extract, scrape or enumerate records beyond the access expressly granted to the user.

2.3 Data misuse

• access, export, disclose, sell or use patient, staff or other Customer Data for an unauthorised purpose;
• attempt to identify people from de-identified or aggregated data without authority;
• use another customer’s data or attempt cross-tenant access;
• upload data that you are not legally entitled to provide; or
• use the Service to create or maintain unlawful patient, employee or consumer profiles.

2.4 AI misuse

• use AI-generated output without the review required by the Terms or clinical policy;
• rely on AI output as the sole basis for diagnosis, prescribing, treatment, triage or discharge decisions;
• configure an AI feature to issue or execute clinical orders without the appropriate authorised human review;
• use the Service to generate fraudulent medical records, prescriptions, certificates, claims or invoices;
• use the Service to train or fine-tune an external model on Customer Data unless authorised by the Customer, permitted by the DPA and lawful; or
• attempt to extract model weights, confidential prompts, credentials or another customer’s information.

2.5 Fraud and abuse

• impersonate another person or organisation;
• evade payment, exceed plan limits through technical circumvention, or abuse trials;
• submit false billing, payment, insurance or reimbursement information;
• send spam, phishing, unlawful bulk messages or communications that violate applicable telecom, consent or template-registration rules; or
• use the Service to facilitate fraud, unlawful prescribing, diversion of controlled medicines or other unlawful activity.

2.6 Intellectual property and reverse engineering

• copy, resell, sublicense, lease or commercially exploit the Service except as expressly permitted;
• remove proprietary notices or misrepresent ownership;
• reverse engineer or attempt to derive source code, except to the limited extent such restriction is prohibited by applicable law; or
• use the Service to build a competing product by copying protected non-public materials.

3. Clinical and operational safeguards

Customers must ensure that:

• only appropriately authorised staff access clinical and administrative functions;
• each user uses their own credentials where supported;
• clinicians verify and sign clinical outputs;
• AI suggestions remain drafts until reviewed by an authorised professional;
• records and orders are checked for patient identity, allergies, dosage, interactions and other relevant safety factors;
• downtime and emergency workflows are maintained outside the Service; and
• patient communications are sent only when lawful and appropriately configured.

4. Security research

Do not conduct security testing without written permission from ClintoBytes. To report a suspected vulnerability, contact security@clintobytes.health and include a description, affected endpoint or feature, reproducible steps and potential impact. Do not include patient-identifiable information unless strictly necessary; redact it where possible. Do not access, modify, delete or disclose data that is not yours.

5. Monitoring and enforcement

We may use technical and operational logs to investigate suspected abuse, protect the Service, enforce contractual limits and comply with law. We will limit access to such logs to authorised personnel and handle them under applicable privacy and security obligations.

If we reasonably believe a violation has occurred, we may:

• request that the activity stop or be corrected;
• temporarily limit affected functionality;
• suspend an account or credentials where necessary to protect people, data or the Service;
• preserve relevant evidence for security or legal purposes; and
• terminate access for serious, repeated or unremedied violations.

Where reasonably practicable, we will provide notice and an opportunity to respond. We may act without prior notice where needed to address an immediate security, safety or legal risk. We will apply measures proportionately and in accordance with applicable law.

6. Reporting abuse

Report suspected abuse to security@clintobytes.health or support@clintobytes.health. For suspected exposure of patient data, include “URGENT — suspected data incident” in the subject and do not send additional patient data unless requested through a secure channel.

7. Updates

We may update this AUP by publishing a revised version and date. Material changes will be notified as required by the Terms of Service or applicable law.

8. Contact

PulamAI Tech Private Limited, trading as ClintoBytes
Security: security@clintobytes.health
Support: support@clintobytes.health
Registered office: SFNO.603/2,4A, Murungatholuvu, Erode - 638051, Tamil Nadu