Acceptable Use Policy

1. Authorized business use

Use Westover EPR only for lawful, authorized business activities consistent with your organization role and accepted scope. You may not access, upload, modify, export, approve, or disclose records for another organization without express authorization.

2. Prohibited conduct

You may not:

• attempt to bypass authentication, tenant isolation, permissions, review gates, or rate limits;
• probe, scan, exploit, disrupt, overload, or reverse engineer the service except as law permits;
• share credentials, impersonate another person, or misrepresent review authority;
• upload malware, malicious instructions, or content intended to manipulate AI processing;
• use the service to violate privacy, intellectual-property, confidentiality, export, or other laws;
• approve or represent AI-generated proposals as source-confirmed without human comparison;
• fabricate evidence, citations, measurements, reviewer identities, filings, receipts, or approvals;
• use the service for automated legal conclusions or guarantees of compliance;
• scrape, resell, sublicense, or provide bureau-style access without written permission;
• submit unnecessary sensitive personal information or regulated data; or
• use the service to harm, harass, defraud, discriminate, or facilitate unlawful conduct.

3. Data and AI safeguards

Customer Data must be lawfully obtained, relevant to the authorized workflow, and appropriately minimized. Do not put passwords, secret keys, complete payment-card details, government-system credentials, protected health information, or unrelated personal data into files, notes, prompts, or support tickets.

Do not instruct Gemini to ignore authority boundaries, invent evidence, infer missing weights, decide producer identity or exemptions, approve records, or take external action. Suspected prompt injection, source manipulation, or model-output errors must be reported and reviewed rather than silently accepted.

4. Enforcement

We may investigate suspected violations and proportionately restrict an operation, file, user, integration, or account to protect the service and affected organizations. Serious or repeated violations may result in suspension or termination and may be reported when legally required. Where practical and safe, we will provide notice and an opportunity to respond or cure.

5. Reporting concerns

Report security concerns, unauthorized access, abusive use, or suspected violations to compliance@westoverepr.com. Do not include passwords, access tokens, or unnecessary Customer Data in the report.