Acceptable Use Policy

Hesper processes sensitive personal information about identifiable people - claimants, insureds, witnesses, medical providers - in a context where the consequences of misuse are real. A denied claim. A fraud referral. A reported crime.

This policy sets the boundaries. It applies to every customer and every authorised user, and it is incorporated into our Terms of Service and Master Subscription Agreement.

The Services may be used only to triage, investigate, document and resolve insurance claims submitted to or administered by the customer, and to detect and document indicators of potential insurance fraud in connection with those claims.

You must not use the Services to deny, delay, reduce, rescind or otherwise adversely resolve a claim, or to refer any person to a regulator or law enforcement agency, solely or automatically on the basis of investigation output, without independent human review.

Every adverse claim determination and every fraud referral must be reviewed and approved by a qualified human who has authority to make that determination and who has considered the underlying claim record.

This is not a formality we ask for to shift risk. AI output is probabilistic and can be wrong in both directions - it can miss real fraud and it can flag honest claimants. A human being has to stand behind the decision.

Outside the permitted purpose

• investigating any person who is not a party to, or reasonably connected with, a claim you are administering
• underwriting, rate-setting, eligibility, renewal or non-renewal decisions, unless expressly agreed in writing on an order form
• employment screening, tenant screening, credit decisions, or any other purpose governed by the Fair Credit Reporting Act
• general background investigations unrelated to an open claim
• providing claims investigation services to unaffiliated third parties on a resale or service-bureau basis without our written consent
• any personal, curiosity-driven, political or non-business purpose

Against people

• harassing, stalking, intimidating, threatening or surveilling any individual
• making or supporting any decision that unlawfully discriminates on the basis of race, colour, national origin, religion, sex, sexual orientation, gender identity, age, disability, genetic information, familial status, immigration status or any other protected characteristic
• pretexting, impersonation, deception or unauthorised access to obtain information about any individual
• obtaining or using information in violation of the Driver's Privacy Protection Act, a state insurance information privacy act, a state medical confidentiality statute or any other applicable law

Data sources

• accessing any third-party data source for which you do not hold a current licence, membership and permissible purpose
• entering credentials for a source you are not authorised to use, or exceeding the scope of your authorisation
• scraping, harvesting or bulk-collecting data in violation of a source's terms

Technical

• reverse engineering the Services, extracting model weights, or deriving training data
• using the Services or their output to develop, train, benchmark for publication, or improve a competing product or model
• submitting malicious code, or content designed to manipulate, hijack or subvert the Services' automated reasoning, including prompt injection, outside an authorised security test
• circumventing rate limits, quotas, authentication or access controls
• penetration or load testing without our prior written consent

Content

• submitting data you have no right to submit, or for which you lack a lawful basis
• submitting protected health information subject to HIPAA without notifying us first
• submitting payment card data in any form - the Services are not PCI-DSS compliant and must not be used to process cardholder data

• maintain written internal procedures governing who may use the Services, for what, and how output is reviewed before it is acted on
• train your authorised users on this policy and on the human review rule before granting access
• promptly investigate and remediate suspected misuse, and tell us about any material violation
• remain responsible for your own compliance with unfair claims settlement practices laws, antifraud plan requirements, licensing requirements and applicable AI governance regulation

We may investigate suspected violations and expect reasonable cooperation. We may suspend access for a material violation - but except where an emergency or a legal requirement makes it impossible, we will give notice and a reasonable opportunity to cure, and will keep any suspension as narrow and as short as reasonably possible. A material, uncured violation is a material breach of the agreement.

We do not monitor the content of customer data for compliance with this policy and have no obligation to do so. Our automated abuse and security controls are not a review of your claims-handling practices.

Report suspected misuse or security issues to security@gethesperai.com.