Acceptable Use Policy

Product: RehabDesk AI
Effective Date: 1 September 2026
Last Updated: 1 September 2026

1. Purpose

This Acceptable Use Policy ("AUP") defines the rules governing how clinic subscribers ("you" or "Clinic") may use the RehabDesk AI platform, its features, and its integrations with WhatsApp, Instagram, and Google Business Profile. Violations of this AUP may result in suspension or termination of your account.

This AUP should be read together with our Terms and Conditions, Privacy Policy, and Data Processing Agreement.

2. Permitted Uses

RehabDesk AI is authorized for use as a legitimate healthcare clinic practice management tool for the following purposes:

• Managing patient registration, medical histories, clinical assessments, and treatment plans for patients who are actively in a treatment relationship with your clinic
• Generating and delivering invoices to patients for services rendered
• Tracking session attendance and progress for multi-session treatment packages
• Sending transactional WhatsApp messages (invoices, appointment confirmations, reminders) to patients using your clinic's registered WhatsApp Business number
• Sending WhatsApp marketing messages to patients who have explicitly opted in to receive communications from your clinic, using Meta-approved message templates only
• Responding to inbound patient WhatsApp and Instagram DMs via the AI chatbot
• Managing your clinic's Google Business Profile (review requests, posts, insights) within Google's policy guidelines
• Managing your clinic's team access and role-based permissions

3. Prohibited Uses

The following uses are strictly prohibited:

3.1 Data Misuse

• Using the platform to collect, store, or process personal data of individuals who are not your patients or who have not consented to data collection
• Accessing, viewing, or attempting to access patient or clinic data belonging to any other clinic using the platform (cross-tenant access)
• Using patient data for any purpose other than providing healthcare services to those patients and managing the clinical relationship
• Exporting patient data for use in a competing application or service, or for sale to third parties
• Using patient contact information obtained through the platform to contact patients on behalf of any business other than the registered clinic

3.2 WhatsApp Misuse (Critical - Affects Your Meta Account Status)

• Sending unsolicited bulk messages (spam) to individuals who have not explicitly opted in to receive communications from your clinic via WhatsApp
• Sending marketing messages to patient contacts without recorded opt-in consent
• Using the WhatsApp broadcast feature to send messages on behalf of any business other than the registered clinic
• Sending message templates that have not been approved by Meta, or sending marketing content through utility or authentication template categories to avoid Meta review
• Sending messages that mislead, deceive, or misrepresent your clinic's identity, services, or fees
• Using the WhatsApp integration to send messages to numbers obtained from sources other than your own patient database (e.g., purchased contact lists, scraped numbers)
• Sending free-form WhatsApp messages outside the 24-hour session window (after a patient-initiated message) - this violates Meta's policy and will result in message failures
• Operating the WhatsApp chatbot on a phone number that is not a registered, verified WhatsApp Business number

Consequences of WhatsApp misuse: Meta may suspend or permanently ban your WhatsApp Business Account (WABA), remove your phone number from the WhatsApp Business platform, or reduce your messaging tier. These consequences are imposed by Meta and are beyond our control. RehabDesk AI is not liable for loss of WhatsApp access due to your violation of Meta's policies.

3.3 Instagram Misuse

• Using the Instagram AI chatbot to send automated messages that violate Meta's platform policies
• Automating behaviour that would violate Instagram's Automation Policy
• Using the chatbot to send commercial messages to users who have not initiated contact with your clinic's Instagram account
• Attempting to scrape Instagram user data through the integration

Note: Meta App Review for the Facebook Messenger and Instagram Direct Messaging permissions requires that your usage conforms to Meta's stated policies. Misuse can result in your Meta App being rejected from review or having permissions revoked.

3.4 Google Business Profile Misuse

• Soliciting reviews in exchange for incentives, discounts, or gifts (in violation of Google's review policies)
• Requesting reviews from individuals who were not actual patients of your clinic
• Using the GMB integration to post content that is false, misleading, or violates Google's content policies
• Asking more than once per patient within a 30-day period for a review (the platform enforces a 30-day cooldown per patient - circumventing this is a policy violation)

Consequences of GMB misuse: Google may remove reviews, flag your Business Profile, or take action against your Google account.

3.5 General Prohibited Conduct

• Using the platform for any unlawful purpose under Indian law or the laws of your jurisdiction
• Attempting to gain unauthorized access to any other clinic's data, our backend systems, or administrative interfaces
• Uploading malware, viruses, or any malicious code to the platform
• Reverse-engineering, decompiling, or copying the platform's code, algorithms, or AI models
• Impersonating RehabDesk AI, another clinic, or any individual through the platform
• Using the platform for any purpose other than managing a legitimate, registered healthcare practice
• Attempting to overload or attack the platform's infrastructure (DDoS, brute force attacks)
• Using multiple accounts to circumvent trial or subscription limitations
• Sharing subscription access with clinics not included in your subscription (each clinic requires its own subscription)

4. Patient Data Handling Obligations

As a clinic using RehabDesk AI, you are the Data Fiduciary for your patients' personal and health data. Your obligations include:

4.1 Lawful processing: Only collect and process patient data for legitimate healthcare purposes with appropriate legal basis (consent, legitimate interest, or statutory obligation).

4.2 Sensitive data handling: Patient health data (diagnosis, treatment history, clinical assessments) is Sensitive Personal Data under the DPDP Act. Handle it with heightened care and ensure only authorized staff with a legitimate need can access it.

4.3 Staff access control: Assign the minimum necessary role to each staff member. Deactivate staff accounts promptly when staff members leave your employment. Do not share login credentials.

4.4 Data retention in the platform: Do not use the platform as a long-term archive beyond your clinical needs. Regularly review and delete patient records you no longer need (subject to legal retention requirements).

4.5 No unauthorized exports: Do not export patient data in bulk and share it with unauthorized parties. Data exports are for your clinic's own operational and archival purposes only.

4.6 Minor patients: Before entering data for a patient under 18 years, ensure you have obtained verifiable parental or guardian consent.

5. WhatsApp Opt-In Compliance Requirements (Mandatory)

Given the specific regulatory and platform policy requirements around WhatsApp marketing, we set out these requirements explicitly. We have designed a system that makes compliance easy and natural - no awkward manual asking required.

5.1 The Recommended Approach: Automated WhatsApp Consent Request

How it works: After a patient is registered in the platform, the system offers to send an automated WhatsApp "welcome + consent" message to the patient's number. This is the recommended path for obtaining marketing consent because:

• The patient gives consent in their own medium (WhatsApp), in their own time
• There is a clear, timestamped WhatsApp message log as evidence - not just a verbal claim
• No awkward receptionist conversation required
• The patient's reply (YES / STOP) is automatically captured by the chatbot and updates their marketing consent status in the platform.

The consent message template looks like:

"Namaste [Name]! Welcome to [Clinic Name]. Your registration is confirmed.
To receive appointment reminders, health tips, and updates from us on WhatsApp, reply YES.
If you prefer not to receive these, reply STOP. You can opt out anytime."

• Patient replies YES → Patient is marked as 'Subscribed' (auto-captured)
• Patient replies STOP or ignores → Patient remains 'Unsubscribed' (no marketing messages sent)

This is fully compliant because: The consent is affirmative (patient actively replies YES), digitally recorded, and freely given - it meets both DPDP Act and Meta's opt-in requirements.

5.2 What Constitutes Valid Opt-In

A patient has validly opted in to receive WhatsApp marketing messages if any of the following is true:

• They replied YES (or equivalent affirmative) to the automated consent WhatsApp message described in Section 5.1, OR
• They explicitly agreed in writing (physical or digital) to receive WhatsApp promotional messages from the clinic, OR
• They initiated contact via WhatsApp and explicitly requested to receive updates (within the 24-hour session window)

5.3 What Does NOT Constitute Valid Opt-In

• The patient simply being registered in your system with a phone number is NOT consent to WhatsApp marketing
• A patient providing their phone number for appointment or treatment purposes is NOT consent to marketing broadcasts
• A receptionist verbally telling the patient "we'll send you updates" without the patient confirming
• Pre-ticked opt-in boxes on intake forms
• Ignoring the consent message (silence is NOT opt-in)

5.4 Recording and Honouring Opt-Outs

• When a patient responds "STOP," "Unsubscribe," or any clear opt-out phrase to any WhatsApp message, they must be immediately removed from all future marketing broadcasts. The chatbot captures this automatically if they use standard opt-out words.
• The WhatsApp Consent indicator on each patient's profile shows their current consent status. Keep this accurate.
• You must ensure that broadcast campaigns are only sent to patients whose consent status is active.
• Sending marketing messages to patients who have not opted in (or have opted out) is a breach of this AUP and may violate TRAI regulations and the DPDP Act.

6. Consequences of Violation

Violations of this AUP may result in, at our discretion:

• Warning: For minor or first-time violations, we will notify you of the violation and request remediation.
• Feature suspension: We may temporarily disable specific features (e.g., WhatsApp broadcast) if we have evidence of misuse.
• Account suspension: We may suspend your account pending investigation of serious violations.
• Account termination: For severe, repeated, or willful violations, we may terminate your account without refund.
• Legal action: We reserve the right to pursue legal remedies for violations that cause harm to third parties, other clinics on the platform, or to RehabDesk AI.

We will use good-faith judgment in applying these consequences and will notify you of any action taken against your account.

7. Reporting Violations

If you become aware of another user violating this AUP, or if you suspect unauthorized access to your account, please report it to:

Email: legal@rehabdesk.app
Security incidents: support@rehabdesk.app

We will investigate all reports in good faith.

8. Changes to This Policy

We may update this AUP as the platform evolves, as new integrations are added, or as the regulatory landscape changes. Material changes will be communicated via email to registered clinic owners with at least 14 days notice.

This Acceptable Use Policy was last reviewed on 1 September 2026.