Acceptable Use Policy

This policy applies to Fern™ and its variants, including its apps and integrations. “You” means the Customer and its Authorized Users for an organizational account, or the individual account holder. It forms part of the agreement under which you use Fern.

1. Lawful use and data rights

Use Fern lawfully. Do not infringe intellectual-property, privacy or other rights, impersonate another person, commit fraud or evade applicable sanctions or export restrictions. Eligibility depends on the actual person, ownership, location and transaction under current law, not an outdated country list.

Provide only material you have the right to upload, connect, use and have processed as your agreement describes. Respect source licences, confidentiality duties and information barriers. Connect only authorized folders and services. Obtain a lawful basis and give required notices for other people's personal information.

2. Sensitive information

Do not provide protected health information under HIPAA without a separate signed business associate agreement and suitable service arrangements. Individual plans do not support identifiable patient data.

Other specially regulated information requires written agreement on suitable arrangements first. This includes special-category personal data, criminal-offence data, payment-card credentials, government identity numbers, export-controlled technical data and children's personal information.

Lawfully de-identified or aggregate scientific material may be used. Removing a name does not necessarily make patient-level information anonymous.

3. Confidential information and markets

You may use confidential information and MNPI only where your rights, duties, organizational policies and applicable law permit it. Fern does not authorize trading on restricted information, tipping another person or bypassing a restricted list.

Do not manipulate markets or present fabricated research, trial results or financial information as real. Your trading decisions, disclosure duties and information barriers remain yours. Use Case membership and any agreed isolation arrangements appropriate to the work.

4. Access and security

Do not try to access another customer, account or Case without authorization. Do not bypass authentication, isolation, metering or other controls, or use crafted inputs to expose another person's data or protected system material.

Do not introduce malware, overload or disrupt Fern, or interfere with another user. Scanning, probing and security testing require Varosync's prior written permission and an agreed scope. Report suspected vulnerabilities to [email protected].

5. Accounts

Use a named account for one person. Do not share credentials, rotate an account between people, sell access or evade a suspension through another account. Organizational Customers may provision their unlimited Authorized Users within the licensed Desk scope; individual accounts remain personal.

Protect credentials and authenticators and report suspected compromise promptly. Give accurate account information and keep it current. Customer remains responsible for its Authorized Users, without excusing failures attributable to Varosync.

6. Platform rights and evaluation

Do not scrape or systematically extract Fern's software, protected prompts, methods, Council design, routing, interfaces or Documentation. Authorized exports of your Customer Data and Outputs are permitted.

Do not reverse engineer, decompile or extract source code or underlying protected methods except where applicable law permits it despite this restriction. Do not use Fern, its Outputs or confidential Documentation to build, train, test or improve a product, model or service competing with Fern.

Internal comparisons are permitted. Do not publish confidential platform material or a comparison revealing it without permission. Nothing restricts a consumer's honest review, lawful criticism, protected reporting or other speech that law prohibits restricting. Do not remove proprietary notices or represent Varosync's materials as your own. These use restrictions do not transfer your ownership of Outputs.

7. Automated access

Use supported apps, integrations and any API or feed expressly made available to you. Do not use unapproved bots, scripts or automated extraction routes.

Do not evade fair use, metering, estimates or per-action spending caps. This does not impose a purchase or balance limit on individual Credits or convert organizational fair-use references into hard allowances.

8. Harmful or deceptive uses

Do not use Fern for unlawful threats, harassment, discrimination, defamation, exploitation, fraud or spam. Do not fabricate studies, data, official statements or endorsements and present them as authentic.

Do not use it to develop biological, chemical, nuclear or radiological weapons, or to make a pathogen or toxin more harmful or transmissible. Lawful scientific research is not prohibited merely because it concerns a sensitive field.

Do not use Fern for solely automated decisions about individuals with legal or similarly significant effects without separately agreed lawful scope and safeguards.

9. Research and decisions

Outputs are research and analysis, not investment, legal, medical, clinical, regulatory, tax or accounting advice. They are not securities recommendations or instructions for clinical action. Review them before relying on them.

Do not present an Output as advice, approval or endorsement supplied by Varosync. You may share your own work under your agreement and source rights, on your responsibility. Do not use Fern to diagnose or treat an individual patient. Individuals need not be professionals to use Fern.

10. Enforcement

Varosync may investigate a specific suspected breach using relevant records. Content access is limited to what is necessary for that investigation or security response and is recorded. Varosync does not obtain a general right to read every Case.

Where practicable, Varosync explains the issue and gives a reasonable opportunity to correct it. It may restrict affected content, accounts, integrations or services only as much and as long as reasonably needed. Urgent risks or legal requirements may require action before notice; notice follows promptly where lawful.

Suspension does not itself delete content. Access is restored when the reason is resolved. Termination, cure periods, payment duties, data return and any refunds are governed by the main agreement. This policy creates no independent forfeiture penalty or additional indemnity.

Reports to authorities or affected parties must have a lawful basis and respect confidentiality. A mere suspicion does not authorize public disclosure of Customer information.

11. Updates and contact

Report misuse to [email protected] and security issues to [email protected] without attaching restricted material to the first message.

For B2B, Varosync gives 30 days' notice of policy changes. A material reduction of contracted rights during a term requires Customer's agreement. For individuals, changes follow the notice, consent and consumer-rights provisions in the individual Terms. Mandatory legal or urgent protective changes may take effect sooner only to the extent reasonably necessary and lawful.