Acceptable use policy

Version 2026-10-30 · Published 30 October 2026

Authorised business use

Use ShiftForest only for your organisation’s lawful workforce operations and within your agreed access, capacity and API scopes. Keep credentials private and ensure that users and integrations have authority to access the records they handle. Do not impersonate another person or use a shared terminal as a substitute for a required individual approval.

Prohibited activity

Do not attempt to access another tenant’s records, bypass permissions, defeat security or usage controls, inject malicious code, distribute malware, conduct unauthorised vulnerability testing, disrupt availability, send unsolicited bulk messages or extract data without authorisation. Do not submit content that unlawfully infringes rights, threatens or harasses people, or breaches confidentiality. Do not falsify attendance evidence or manipulate records to conceal unauthorised activity.

Appropriate data

Provide only data necessary for the agreed workforce purpose. Do not store payment-card security codes, private authentication secrets, patient/resident case records or unrelated sensitive information. Health-related workforce information must be necessary and lawfully covered by the agreed processing instructions. Use private documents and role-based access appropriately; free-text notes are not a substitute for a controlled clinical or safeguarding record system.

API, exports and integrations

Respect published limits, retry guidance and scopes. Use stable request identifiers where supported and handle failures without generating duplicate writes. Do not evade quotas using extra accounts or keys. Protect downloaded files, webhook destinations and local/offline copies; removing access in ShiftForest cannot recall copies already sent to your systems. Obtain any required third-party permissions before connecting an integration.

Reporting and enforcement

Report suspected misuse or vulnerabilities to hello@theprojecthero.co.uk with enough detail to investigate, without including secret keys or unnecessary personal data. We may proportionately restrict the affected feature or account while addressing risk, with notice and a chance to remedy where practicable. Serious or repeated breaches may lead to termination under the customer terms. Reporting a concern does not authorise further testing against other customers or production records.