Acceptable Use
Last updated August 2026. This policy forms part of the terms of service. It is short because it only covers things that cause real harm.
Use the platform for your own patients and your own claims
Your access is for the organization named on the account. Sending us events for patients of an organization you do not have a treatment, payment or operations relationship with is a HIPAA problem before it is a contractual one, and we will treat it as such.
Do not put protected health information where it does not belong
Free-text fields, facility names, file names and support tickets are not places for patient identifiers. We redact what we can detect, but a patient name typed into a facility label is a disclosure we cannot undo on your behalf. When in doubt, send us the internal reference and we will look it up.
Protect the credentials
Ingestion credentials are per facility and are the key to that facility's event stream. Do not share them between sites, do not email them, and rotate them when someone with access leaves. Two-factor is mandatory on every user account and cannot be turned off, including by an Owner and including by us.
Do not attack the shared platform
No penetration testing without written agreement in advance, no attempts to reach another tenant's data, no denial-of-service testing, and no automated traffic designed to find the limits of the service. Good-faith security research is welcome and there is a documented path for it: see vulnerability disclosure.
Do not resell or rebrand the platform
Access is for your organization's own operations. Reselling access, operating it as a service for third parties, or presenting it as your own product requires a separate written agreement. Ask us. We are not hostile to the idea, we just need it to be deliberate.
Do not use it as the only record of clinical decisions
Attergo is a decision support and record-keeping platform. It does not practise pharmacy or medicine, it does not verify clinical appropriateness, and a figure it produces is never a substitute for professional judgement. Your dispensing system and your clinical record remain the systems of record for care.
What happens if this is breached
For anything that endangers patients, another customer or the platform itself, we suspend the affected access immediately and tell you why, in writing, the same day. For everything else we contact you first and give you a reasonable opportunity to fix it before taking any action.
In every case, including a suspension and including a termination, event ingestion continues and your archive is preserved. We will not use the destruction of your audit evidence as leverage in a commercial dispute, and you should not accept a vendor who would.
Questions
Write to support@attergo.com.