# Acceptable use policy

**Draft for review.** Not approved. Owner: `{{SECURITY_OWNER}}`. Last reviewed: `{{REVIEW_DATE}}`.
Applies to everyone at `{{COMPANY_LEGAL_NAME}}` who builds, supports or operates Veteros.

## You must

- Use your own accounts, with two-step sign-in wherever it is offered.
- Keep devices locked, encrypted and up to date.
- Use synthetic data for development, demos and tests. Never copy live clinic data to a laptop,
  a chat tool, a ticket or a test fixture.
- Look at a clinic's data only to answer that clinic's request or to fix a problem it reported,
  and only as much as the task needs.
- Report a suspected incident, a lost device or a leaked secret to `{{SECURITY_CONTACT_EMAIL}}` at once.

## You must not

- Share credentials or tokens, or put secrets in the repository.
- Give medical advice or a diagnosis to a clinic's clients, or let a product feature do so.
  Clinical and pricing questions go to clinic staff.
- Send clinic data to a service that is not in the sub-processor list.
- Turn off a security control (row-level security, an append-only trigger, the Gemini data-terms
  guard, two-step sign-in) without an approved exception.

Breaking this policy may lead to loss of access and disciplinary action.