Acceptable use policy.

This Acceptable Use Policy (“AUP”) exists to protect the people whose information sits inside Thornbridge platforms, care recipients, employees, contractors and members of the public, and to keep our services available, secure and trustworthy for everyone who relies on them. It sets out the minimum standards of behaviour we require from anyone who accesses or interacts with our software, infrastructure, APIs or support channels.

This policy applies to every environment we operate, including production tenants, staging and sandbox environments, demonstration instances, our public website, our documentation portal, our support ticketing system and any mobile applications we publish. It applies whether access is obtained through a browser, a native application, an API integration, a webhook, a partner connector or any other means.

Nothing in this policy overrides applicable law. Where local law imposes a stricter standard than this policy, the stricter standard applies.

This policy binds, without limitation:

• Customers: the organisation that has entered into a subscription agreement with us, and which is responsible for ensuring its own users comply with this policy.
• Named users: every individual issued with credentials, including care staff, managers, finance and HR personnel.
• Administrators: users granted elevated permissions to configure tenants, manage other user accounts, or export bulk data.
• Contractors and agency staff: individuals engaged by a customer on a temporary basis who are granted access for the duration of an assignment.
• Integration developers: anyone building against our APIs, webhooks or SDKs, whether employed by a customer, by us, or by a third-party vendor.
• Security researchers: individuals who investigate our systems under the responsible disclosure programme described in section 17.

Customers are responsible for ensuring that their employees, contractors and integration partners are made aware of, and comply with, this policy. A breach by a customer’s user is treated as a breach by that customer for the purposes of our terms of service.

This AUP is incorporated into, and forms part of, our terms of service. Where personal data is processed on a customer’s behalf, the terms of our data processing agreement also apply and take precedence in respect of data processing obligations. Our privacy notice explains how we, as a controller, handle personal data collected about visitors and account holders, and our cookie policy explains our use of cookies and similar technologies. In the event of a conflict between this AUP and the terms of service, the terms of service prevail; in the event of a conflict concerning data processing, the DPA prevails.

Everyone using our platforms must:

• Use the platform only for its intended purpose: the lawful management of care, workforce and compliance records.
• Act honestly, and never misrepresent their identity, role or authority.
• Respect the confidentiality of information belonging to other tenants, organisations or individuals.
• Comply with all applicable laws, including data protection, employment, safeguarding and equality legislation.
• Take reasonable steps to keep credentials, devices and connected systems secure.
• Report suspected misuse, security weaknesses or safeguarding concerns promptly.

You must not use our platforms to create, upload, store, transmit or link to content that is:

• Unlawful under the law of England and Wales or the jurisdiction in which you operate.
• Defamatory of any person or organisation.
• Discriminatory, or that harasses, bullies or intimidates any individual on the basis of a protected characteristic or otherwise.
• Infringing of another party’s intellectual property, confidentiality or other rights.
• Obscene, pornographic, or otherwise inappropriate for a professional care or workplace setting.
• Extremist, or that promotes terrorism, violence or hatred.

This applies to free-text fields, uploaded documents, messages sent through the platform, and any content shared through integrations connected to it.

You must not use our platforms to process personal data:

• Where you have no lawful basis to do so under UK GDPR or equivalent legislation.
• Involving special category data (such as health, sexual orientation, religion or trade union membership) or criminal offence data, other than for the legitimate purposes for which the platform is designed and in accordance with an appropriate policy document where required.
• For covert surveillance of staff, including hidden monitoring not disclosed to those affected, save where lawfully authorised and proportionate.
• By repurposing care records or workforce data for a purpose unrelated to care delivery, employment or compliance without a proper basis for doing so.
• By collecting more personal data than is necessary for the purpose in question.

Customers remain the controller of personal data entered into the platform and are responsible for establishing and documenting their lawful basis for processing, in accordance with our DPA.

Records relating to safeguarding, disciplinary matters, incidents and care delivery must be accurate and made contemporaneously wherever practicable. Users must not:

• Deliberately falsify, backdate or otherwise misrepresent an entry in a care or compliance record.
• Delete or alter a record, or the audit trail relating to it, in order to avoid scrutiny, investigation or regulatory inspection.
• Discourage, penalise or retaliate against a colleague who raises a genuine concern in good faith (whistleblowing).

Where we identify, or are notified of, conduct that may amount to a safeguarding concern or a serious integrity breach affecting care records, we reserve the right to preserve the relevant data and, where we are legally required or it is otherwise appropriate, to notify the relevant regulator, including the Care Quality Commission (CQC) or the Information Commissioner’s Office (ICO), or law enforcement.

• Accounts must be issued to, and used by, one named individual only. Shared or generic logins are not permitted, save for approved service accounts.
• Credentials must not be shared, written down insecurely, or disclosed to any other person, including colleagues.
• Multi-factor authentication (MFA) must be enabled wherever it is offered for an account, and must not be deliberately disabled or circumvented.
• Administrators must offboard leavers promptly, revoking access and credentials on or before the individual’s last working day.
• Privileged or administrative access must be limited to those who need it, reviewed periodically, and never used to access records outside the legitimate scope of the administrator’s role.
• Service accounts and API keys must be held securely, rotated periodically, scoped to the minimum necessary permissions, and never embedded in client-side code or shared publicly.

You must not:

• Attempt to access another tenant’s data, or any system, account or data you are not authorised to access.
• Attempt to escalate privileges beyond those granted to you.
• Disable, bypass or tamper with audit logging or other security controls.
• Introduce malware, ransomware or other malicious code.
• Carry out or facilitate a denial-of-service attack against our infrastructure.
• Carry out load testing or penetration testing without our prior written authorisation.
• Scrape, crawl or carry out automated bulk extraction of data from the platform other than through supported export or API functionality within agreed limits.
• Reverse engineer, decompile or attempt to derive source code, save to the extent permitted by law.

Our services are provided subject to fair use. We may apply reasonable rate limits to API calls, exports and bulk operations to protect the stability and performance of the platform for all customers. Automated integrations must respect published rate limits, back off appropriately on receiving throttling responses, and must not attempt to circumvent limits by distributing requests across multiple keys or accounts. Sustained or excessive usage that materially affects service performance for other customers may be throttled or suspended.

Where the platform is used to send email, SMS or other messages, you must not:

• Send unsolicited bulk communications (spam) or use the platform for marketing without a proper lawful basis and consent where required.
• Spoof sender identities, headers or domains.
• Ignore unsubscribe requests or supported suppression lists, or otherwise contact individuals who have opted out.

Where you connect a third-party system to our platform via an integration, webhook or connector, you are responsible for ensuring that the receiving system is secure, that data is only shared with parties who have a legitimate need for it, and that the third-party service’s own terms and privacy practices are compatible with your obligations under data protection law. Webhook endpoints must validate signatures where we provide them, and must not be configured to forward data to parties outside your organisation without appropriate authorisation.

Customers may export their data using supported export functionality at any time during the subscription term, and for a reasonable period following termination as described in our terms of service. Bulk exports must be handled securely once downloaded, and must not be retained for longer than necessary or shared beyond those with a legitimate need. Automated or scripted bulk export activity outside supported tooling is not permitted without prior agreement.

Where our platform offers AI-assisted features, such as drafting or summarisation tools, you must not enter personal data, confidential information or any other data that you do not have the right to process into those features. Output from AI features should be reviewed by a competent human before being relied upon, particularly where it relates to safeguarding, care planning or compliance decisions. You must not use AI features to generate content that would otherwise breach section 5 or section 6 of this policy.

We monitor and log system activity, including authentication events, administrative actions, API usage, error rates and security events, in order to protect the platform, investigate suspected misuse, and meet our audit and security obligations. We do not monitor the content of records for day-to-day operational purposes beyond what is necessary to provide the service, and access to logs by our personnel is restricted and itself subject to audit. Monitoring is carried out in accordance with our privacy notice and is proportionate to the purposes described above; it is not used to surveil individual users beyond what is necessary for security and service integrity.

If you become aware of a suspected breach of this policy, whether relating to content, data use, safeguarding, or system security, you should report it to your organisation’s administrator and, where appropriate, to us directly at security@thornbridgesolutions.com. We will treat reports made in good faith seriously and will not penalise anyone for raising a genuine concern.

We welcome reports from security researchers who identify genuine vulnerabilities in our platform. If you believe you have found a security issue, please contact security@thornbridgesolutions.com with sufficient detail to reproduce the issue, before disclosing it to any third party.

Safe harbour

We will not pursue legal action against a researcher who makes a good-faith effort to comply with this programme, provided that the researcher acts within its scope, avoids privacy violations and service disruption, gives us a reasonable opportunity to investigate and remediate before any public disclosure, and does not access, modify or exfiltrate data belonging to other tenants.

Scope

In scope are our production web applications, public APIs, and infrastructure that we own and operate. Out of scope are social engineering of our staff or customers, physical security testing, denial-of-service testing, testing against another customer’s tenant without that customer’s written consent, and any testing carried out against third-party services we integrate with but do not control. Automated scanning that generates excessive traffic should not be carried out without prior agreement. Further detail on our security programme is available on our security page.

Where we identify or are notified of a suspected breach of this policy, we will generally take a proportionate, graduated approach, which may include:

• Contacting the relevant account administrator to raise the concern.
• Issuing a formal warning setting out the breach and required remediation.
• Throttling or restricting access to affected features or accounts.
• Suspending the account or accounts involved pending investigation.
• Terminating the account or agreement under the terms of service for serious or repeated breaches.
• Notifying the relevant regulator or law enforcement authority where required or appropriate.

We may act more swiftly, including immediate suspension without prior warning, where we reasonably believe there is an immediate risk to safety, security or the integrity of care records.

If you believe an enforcement action has been taken in error, you or your administrator may appeal by contacting us in writing, setting out the grounds for appeal. We will review the matter promptly and confirm the outcome, though enforcement action taken to protect safety, security or the integrity of care records may remain in place while an appeal is considered.

Where a customer or user’s breach of this policy causes us loss, liability or regulatory exposure, the customer agrees to indemnify us in accordance with the indemnity provisions of our terms of service.

We may update this policy from time to time to reflect changes in our services, technology, or legal and regulatory requirements. Material changes will be notified through the platform or by email to account administrators. Continued use of our services after a change takes effect constitutes acceptance of the updated policy.

Questions about this policy, or reports of suspected breaches, should be sent to security@thornbridgesolutions.com. For questions about our wider legal terms, see our terms of service, privacy notice, DPA and cookie policy.