DrAxis — Acceptable Use Policy

Status: DRAFT v1 — for internal team review. Not legal advice.

Must be reviewed by qualified legal counsel before publication.

Last updated: 2026-08-23

Document control

1. Purpose

This Acceptable Use Policy ("AUP") sets out the rules governing the use of the DrAxis Service. It applies to all Users and is incorporated by reference into the Terms of Service (02-terms-of-service.md).

2. Permitted uses

You may use the Service to:

1. Reference clinical information — access Calculators, drug databases, protocols, and guidelines for your own professional education and reference.
2. Compute clinical scores — enter structured inputs into Calculators to obtain reference outputs.
3. Communicate with peers — exchange messages and attachments with other Verified Users via the in-app messaging feature, in accordance with professional secrecy obligations.
4. Manage your professional profile — maintain your credentials, specialty, and affiliation information.
5. Save reference results — save Calculator outputs to your account for later reference.

3. Prohibited uses

You must not:

3.1 Patient data & privacy

• Enter identifiable patient data (name, national ID, full date of birth, address, phone) into Calculators or messages without anonymization or appropriate consent.
• Share patient-identifiable attachments via messaging without consent or anonymization.
• Use the Service in a manner that breaches medical secrecy obligations under your local code of medical ethics.

3.2 Clinical misuse

• Use Calculator outputs or the antibiotic-suggestion tool as the sole basis for a clinical decision without independent verification.
• Represent DrAxis outputs as a diagnosis or treatment plan to patients or third parties.
• Use the Service to provide medical advice to patients directly (DrAxis is a reference tool, not a telemedicine platform).

3.3 Account & access

• Share your account credentials with any other person.
• Create an account using false or another person's credentials.
• Attempt to verify an account using forged or expired professional credentials.
• Access another User's account, data, or messages without authorization.
• Use the Service if your professional license has been revoked, suspended, or restricted without notifying us.

3.4 System integrity

• Attempt to access systems, networks, or data beyond your authorization.
• Introduce malware, ransomware, or any malicious code.
• Conduct denial-of-service attacks or attempts to overload the Service.
• Scrape, crawl, or extract data via automated scripts, except through documented public APIs.
• Reverse-engineer, decompile, or disassemble the Service (except as permitted by law).
• Bypass security measures, including App Check, reCAPTCHA, rate-limiting, or CORS controls.

3.5 Content & conduct

• Submit Content that is unlawful, defamatory, harassing, or fraudulent.
• Submit Content that infringes intellectual property rights.
• Impersonate another person or professional.
• Use the Service for commercial promotion, advertising, or solicitation without our written consent.
• Use the Service to facilitate any unlawful act in your jurisdiction or ours.

3.6 Cross-border

• Use the Service in a jurisdiction where it is not legally permitted.
• Export or re-export the Service in violation of applicable export control or sanctions laws.

4. Enforcement

We may take any of the following actions if we believe you have breached this AUP:

1. Warning — a formal notice describing the breach and required remediation.
2. Temporary suspension — blocking access to specific features (e.g., messaging) or the entire Service for a defined period.
3. Permanent termination — closing your account and revoking access.
4. Verification revocation — removing your Verified status while allowing account access.
5. Legal action — referring the matter to law enforcement or initiating legal proceedings where the breach is serious (e.g., fraud, patient data breach).

We will act proportionately and, where feasible, provide you with an opportunity to respond before taking permanent action, except where urgent action is required to prevent harm.

5. Reporting violations

If you become aware of a breach of this AUP, report it to security@draxis.app with:

• A description of the breach.
• The User(s) involved (phone number or User ID, if known).
• Evidence (screenshots, messages, timestamps).

We will investigate and take appropriate action. Reports may be made anonymously.

6. Jurisdiction-specific notes

6.1 Tunisia

• Breaches involving medical secrecy may be reported to the Ordre des Médecins de Tunisie (OMT) and may carry criminal liability under the Tunisian Penal Code.
• Breaches involving personal data may be reported to INPDP.

6.2 European Union

• Breaches involving personal data may be reported to the relevant Data Protection Authority.
• Breaches involving illegal content may be reported under the Digital Services Act (Reg. (EU) 2022/2065).

6.3 Gulf countries

• Breaches involving personal data may be reported to NDMO (KSA), UAE Data Office (UAE), or the relevant national authority.
• Breaches involving medical practice may be reported to the relevant Ministry of Health.

7. Changes to this policy

We may update this AUP. Material changes will be notified in-app and/or by email at least 14 days before taking effect. Continued use after the effective date constitutes acceptance.

8. Contact

• Security reports: security@draxis.app
• Legal: legal@draxis.app
• DPO: dpo@draxis.app