Acceptable use policy
Last updated
About this policy
This acceptable use policy (the "Policy") applies to every organization that uses the Vayra Platform, Vayra White Label, Vayra Intelligence, or related services (the "Platform Services") under an agreement with Vayra Health & Wellness, Inc. ("Vayra"), and to that organization's employees, contractors, clinicians, and other authorized users (together, "Partner"). It forms part of Partner's agreement with Vayra. If this Policy conflicts with a signed agreement, the signed agreement controls.
Partner is responsible for ensuring that its users and anyone acting on its behalf comply with this Policy.
Lawful use
Partner may use the Platform Services only in compliance with all applicable laws and regulations, including federal and state laws on the practice of medicine, telehealth, prescribing, controlled substances, pharmacy, compounding, corporate practice of medicine, fee splitting, anti-kickback and self-referral, consumer protection, privacy, and data security.
Prescribing and clinical practice
Partner may not use the Platform Services to:
- prescribe, dispense, or arrange for any medication except through a clinician who holds the licenses and registrations required in the state where the patient is located, following a clinically appropriate evaluation;
- prescribe or promote any medication for a use, to a population, or in a manner that is unlawful;
- offer medications without a valid prescription where one is required;
- obtain, sell, or distribute controlled substances other than in full compliance with federal and state law;
- pressure, incentivize, or direct clinicians toward a particular diagnosis, prescription, or treatment outcome, including through quotas, targets, or compensation tied to prescribing;
- interfere with, override, or circumvent a clinician's independent professional judgment, including by altering clinical protocols, intake logic, or eligibility screening to bypass clinical review; or
- represent that a patient is eligible for, or will receive, any treatment before a clinician has made that determination.
Marketing and claims
Partner is responsible for its own marketing, including marketing that uses Vayra White Label branding or appears on Partner's domains. All marketing must comply with the Federal Trade Commission Act, FTC guidance on truth in advertising and health claims, FDA requirements, and applicable state law.
Partner may not:
- make false, misleading, or deceptive claims, or claims that are not substantiated by competent and reliable scientific evidence;
- make claims about medical outcomes, weight loss amounts, or other results that are not substantiated, or present atypical results as typical;
- guarantee any clinical result, prescription, or treatment;
- state or imply that a compounded medication has FDA approval, is a generic version of an approved drug, or has been reviewed by FDA for safety or effectiveness;
- use the brand name of a product that has FDA approval in a way that suggests a compounded medication is that product;
- state or imply that Partner, Vayra, or the Platform Services hold a government certification for HIPAA, or have been certified as compliant with HIPAA by any government agency or other body. There is no government certification for HIPAA;
- claim any security, privacy, or compliance certification, accreditation, or attestation that Partner or Vayra does not hold;
- use testimonials or endorsements that do not reflect the honest experience of the person giving them, or fail to disclose material connections;
- use pricing that hides material fees, terms, or recurring charges, or fail to clearly disclose subscription and cancellation terms; or
- send marketing messages in violation of laws governing email, text messages, or telephone calls.
Vayra may review Partner marketing that references the Platform Services or Vayra and may require changes. Review by Vayra does not make Vayra responsible for Partner's marketing.
Vayra Intelligence
Vayra Intelligence is an AI module that supports clinicians and patients within the Platform Services. It does not diagnose, prescribe, or replace a clinician. Partner may not:
- present Vayra Intelligence, or any output from it, as a licensed clinician, or as a diagnosis, prescription, or treatment plan;
- configure, prompt, or use Vayra Intelligence to diagnose, prescribe, or make clinical decisions without review by a licensed clinician;
- represent to patients that they are communicating with a human when they are communicating with Vayra Intelligence;
- attempt to bypass, disable, or manipulate the safety controls, guardrails, or escalation behavior of Vayra Intelligence; or
- use Vayra Intelligence to generate content that violates this Policy or the usage policies of Vayra's AI model provider.
Security and system integrity
Partner may not:
- access or attempt to access any account, data, or system that Partner is not authorized to access;
- share user credentials, or allow anyone other than the authorized user to use an account;
- disable or circumvent multi-factor authentication, access controls, audit logging, or other security measures;
- probe, scan, or test the vulnerability of the Platform Services without Vayra's prior written authorization;
- introduce malware or other malicious code, or use the Platform Services to distribute it;
- interfere with or disrupt the Platform Services, including through denial of service attacks or excessive automated requests;
- reverse engineer, decompile, or attempt to extract the source code or models of the Platform Services, except as the law expressly permits;
- scrape or extract data from the Platform Services by automated means outside the interfaces Vayra provides; or
- use the Platform Services to build or benchmark a competing product.
Partner must promptly report any suspected security vulnerability, compromised account, or Security Incident to security@vayraplatform.com.
Data handling
Partner may not:
- upload or process patient information without the notices, consents, and authorizations that the law requires;
- use the Platform Services to process protected health information before a business associate agreement with Vayra is in effect, where one is required;
- use patient information for any purpose that the law or the patient's authorization does not permit; or
- sell patient information or use it for advertising in violation of applicable law.
Harmful and prohibited content
Partner may not use the Platform Services to create, store, or send content that is unlawful, fraudulent, defamatory, harassing, discriminatory, or that infringes another person's intellectual property or privacy rights.
Enforcement
Vayra may investigate any suspected violation of this Policy. If Vayra reasonably believes that a violation has occurred or is likely, Vayra may take actions it considers appropriate, which may include:
- requiring Partner to remove or correct content or marketing;
- suspending specific features, users, or accounts;
- suspending Partner's access to the Platform Services, in whole or in part;
- terminating Partner's agreement in accordance with its terms; and
- reporting the matter to law enforcement, licensing boards, or regulators where required or appropriate.
Where practical and lawful, Vayra will give Partner notice and an opportunity to cure before suspension. Vayra may act without prior notice where it reasonably believes that a violation poses a risk to patient safety, to the security of the Platform Services, or of legal liability. Where notice and cure apply, Vayra will describe the violation in writing and give Partner at least 10 business days to cure it before suspending the affected Platform Services.
Reporting violations
To report a suspected violation of this Policy, email legal@vayraplatform.com. Report security issues to security@vayraplatform.com.
Changes to this policy
Vayra may update this Policy from time to time. We will revise the "updated" date on this page and notify partners of material changes at least 30 days' before they take effect, unless a change is required sooner by law or to address a risk to patient safety or security.