Acceptable Use Policy — Aims Innovations

Rules and guidelines for responsible use of Aims Services

Effective Date: January 1, 2026

Last Updated: April 27, 2026

Entity: Aims Innovations PR LLC ("Aims," "we," "us," or "our")

1. Introduction

This Acceptable Use Policy ("AUP") sets out the rules and prohibitions that apply to anyone who accesses or uses (a) the Aims Innovations public website at [www.aims-innovations.com] (the "Website") or (b) the Aims Research Management System and any associated APIs, integrations, mobile applications, AI agents (including RAchel™), and supporting services (collectively, the "Platform"). The Website and Platform are referred to together as the "Services."

This AUP supplements — and is incorporated into — our Terms of Service, Master Subscription Agreement, Data Processing Agreement, and any institutional contracts you have signed with Aims. If a term in this AUP conflicts with a fully executed institutional agreement, the institutional agreement controls.

By accessing or using the Services, you agree to follow this AUP. If you do not agree, do not use the Services.

2. Who This Policy Applies To

This AUP applies to:

Website Visitors — Any person who browses, downloads from, or interacts with the Website.
Authorized Users — Researchers, principal investigators, study staff, administrators, IT contacts, and other personnel of an institutional client who have been granted Platform credentials.
Participants — Research participants who interact with the Platform, including through participant-facing portals, surveys, scheduling, payment processing, or RAchel™ AI agents.
Third-Party Integrators — Developers and partners who connect to Aims through our APIs or integration tooling.

If you are using the Services on behalf of an organization, you represent that you are authorized to bind that organization to this AUP.

3. General Acceptable Use Principles

Regardless of which Service you are using, you agree that you will not:

Violate any applicable law, regulation, or third-party right (including U.S. federal and state law, Puerto Rico law, EU/UK data protection law where applicable, HIPAA, FERPA, GLBA, the Common Rule, and applicable export controls).
Engage in fraud, deception, or misrepresentation, including impersonating another person, institution, or Aims itself.
Attempt to gain unauthorized access to any account, system, network, or data; probe, scan, or test the vulnerability of the Services without prior written authorization from Aims; or evade authentication, rate limits, or access controls.
Introduce malware, ransomware, worms, time bombs, trojans, or any other malicious code; or interfere with the integrity, performance, or availability of the Services.
Reverse engineer, decompile, or disassemble any portion of the Services, except where such activity is expressly permitted by applicable law that cannot be contractually waived.
Use the Services to develop, train, fine-tune, benchmark, or evaluate any competing product, model, or dataset.
Misuse, mishandle, or expose credentials, API keys, session tokens, or authentication factors. Credentials are personal to the named user and must not be shared.
Use automated tools (bots, scrapers, crawlers, headless browsers) in a manner that exceeds reasonable use, that is not disclosed to Aims, or that circumvents technical or contractual access limits.
Engage in harassing, threatening, defamatory, hateful, or discriminatory conduct toward Aims personnel, other users, or research participants.
Use the Services in any manner that could damage, disable, overburden, or impair Aims infrastructure or interfere with any other party's use of the Services.

4. Website-Specific Acceptable Use

The Website is a public, marketing- and information-oriented property. Authentication is generally not required to browse the Website, but specific areas (such as gated downloads, demo bookings, applicant portals, or careers submissions) may require you to provide information.

4.1 Permitted Use of the Website

You may:

Browse publicly available pages and read or download materials provided for that purpose.
Submit accurate information through contact forms, demo-request forms, newsletter signups, careers/application forms, and similar channels.
Share publicly available URLs and quote reasonable excerpts of public-facing content with attribution.

4.2 Prohibited Conduct on the Website

In addition to Section 3, you must not:

Submit false, misleading, or third-party personal information through any Website form (including using another person's email, phone number, or institutional affiliation without authorization).
Use Website forms or contact channels to send unsolicited commercial messages, recruitment pitches, spam, or solicitations to Aims personnel.
Scrape, crawl, mirror, or systematically extract Website content (including for the purpose of training machine-learning models) without prior written permission from Aims.
Frame, embed, or republish Website content in a manner that misrepresents Aims, removes attribution, or implies a partnership or endorsement that does not exist.
Bypass any paywall, gating mechanism, sign-up requirement, or jurisdictional restriction on the Website.
Download, copy, or distribute logos, trademarks, white papers, case studies, or other Aims materials except as expressly permitted by a written license, press kit, or partner program.
Submit code, scripts, or content through Website inputs that are designed to execute on Aims systems or other users' browsers.

4.3 Public Inquiries and Demo Requests

If you contact us through the Website to discuss a potential engagement, you agree that the information you provide may be used for sales qualification, scheduling, and the legitimate business purposes described in our Privacy Policy. Do not include sensitive personal data, protected health information ("PHI"), or any data subject to a data use agreement in any open-text Website field.

5. Platform RMS-Specific Acceptable Use

The Platform is a controlled, authenticated environment used by institutional clients (including academic medical centers, research universities, and pediatric and public-health research organizations) to manage the participant research lifecycle. Use of the Platform is governed by your institution's executed agreement with Aims and may involve PHI, student records, or other regulated data.

5.1 Authorized Access and Account Security

When using the Platform, you must:

Only access the Platform using credentials issued to you, and only for the purpose contemplated by your role and your institution's agreement.
Maintain strong, unique passwords and use multi-factor authentication ("MFA") where offered or required.
Promptly notify Aims and your institutional administrator of any actual or suspected unauthorized access, credential compromise, or security incident.
Log out of shared devices, lock your screen when unattended, and not store Platform credentials in unsecured locations or third-party tools.
Promptly report personnel changes (departures, role changes) to your institutional administrator so access can be adjusted.

You are responsible for activity that occurs under your account, except to the extent caused by Aims's failure to perform.

5.2 Permissible Research Activities

You may use the Platform only for:

Research activities that are within the scope of your institution's subscription and any associated Statement of Work or service order.
Studies that have appropriate Institutional Review Board ("IRB") approval, exemption, or determination, where required by law or institutional policy. You are solely responsible for obtaining and maintaining such approvals and for operating within their terms (including approved consent language, recruitment scripts, data elements, and protocol versions).
Recruitment, screening, scheduling, consent, data collection, communication, payment, and analytic workflows that are described in your IRB-approved protocol or that fall within an applicable IRB exemption or quality-improvement determination.

5.3 Prohibited Research and Data Activities

You must not use the Platform to:

Conduct research that lacks the IRB approvals or determinations required by your institution or by law, or that operates outside the scope of those approvals.
Recruit, contact, or collect data from minors, prisoners, pregnant women as a vulnerable class, decisionally impaired adults, or other populations subject to additional protections, except where your IRB approval and consent procedures expressly authorize it.
Upload, transmit, or store data categories that are not within scope of your institution's agreement or executed Data Processing Agreement / Business Associate Agreement (e.g., uploading PHI to an instance not configured for HIPAA workflows, uploading payment card numbers, uploading classified or export-controlled data).
Re-identify, attempt to re-identify, or combine de-identified datasets with external sources for the purpose of identifying individuals, except as expressly permitted by your IRB approval and applicable law.
Use Platform-collected data for any commercial, marketing, employment, insurance underwriting, credit, or law enforcement purpose unrelated to the approved research.
Disclose, export, or transmit participant data to any third party other than as expressly permitted by your institutional agreement, your IRB approval, applicable law, and the participant's consent.
Retain participant data beyond the retention period specified in your protocol, your institution's policies, or applicable law.

5.4 Use of AI Features (Including RAchel™)

The Platform includes AI-powered features, including RAchel™, a participant-facing conversational agent, and various administrative-side AI assistants. When using these features, you must:

Use AI features only within the boundaries of your IRB-approved protocol, including any approved scripts, disclosures, and consent language relating to AI interactions.
Disclose to participants, where required by law, IRB policy, or institutional policy, that they are interacting with an AI agent.
Not configure, prompt, or operate AI features to provide medical advice, diagnosis, treatment recommendations, mental-health crisis intervention, legal advice, or financial advice, except where such use is (i) expressly contemplated by the Platform's documented capabilities, (ii) authorized by your IRB and your institution, and (iii) accompanied by appropriate clinical or professional oversight.
Not attempt to extract, exfiltrate, or manipulate model weights, system prompts, training data, or other proprietary AI components through prompt injection, jailbreaking, or similar techniques.
Treat AI-generated outputs as assistive, not authoritative. You are responsible for reviewing AI-generated outputs that drive participant communications, eligibility decisions, payment determinations, or scientific conclusions.
Not submit content into AI features that you are not contractually or legally permitted to disclose to a sub-processor (consistent with your DPA / BAA and any data use agreements).

5.5 API, Integration, and Automation Use

If you connect to the Platform via API or integration tooling, you must:

Stay within published rate limits and quotas, and not engage in patterns of access that resemble denial-of-service or scraping behavior.
Securely store API keys and rotate them upon personnel changes or suspected compromise.
Use only the data fields and endpoints necessary for your authorized purpose, consistent with the principle of least privilege.
Not proxy, resell, or sublicense API access to third parties without Aims's prior written consent.

5.6 Participant-Facing Conduct

If you interact with participants through the Platform, you must:

Use approved messaging templates, consent forms, and recruitment scripts.
Not contact participants who have withdrawn, opted out, or otherwise indicated they do not wish to be contacted.
Honor participant data subject rights (access, correction, deletion) consistent with your IRB approval and applicable law, and use Aims-provided tooling to do so where available.
Not use the Platform to send communications unrelated to the approved research (e.g., marketing for unrelated products or services).

6. Prohibited Content and Activities

You will not upload, transmit, generate, or facilitate any content that:

Violates intellectual property, privacy, publicity, contract, or confidentiality rights of any third party.
Is obscene, child-sexual-abuse material, or otherwise unlawful.
Promotes violence, terrorism, self-harm, or unlawful discrimination.
Contains malware, exploits, or code intended to compromise systems.
Is intentionally false or designed to manipulate AI models or analytic outputs in misleading ways.
Contains payment card data, full Social Security numbers, or other sensitive identifiers outside of fields specifically designed and approved for such data.

7. Reporting Violations and Security Issues

If you become aware of:

A violation of this AUP,
A suspected security incident, vulnerability, or data exposure, or
Conduct that endangers a research participant or other person,

please contact us immediately:

Security and Incident Reporting: security@aims-innovations.com
Trust & Safety / AUP Reports: trust@aims-innovations.com
General Support: support@aims-innovations.com

We support good-faith security research conducted in accordance with our coordinated disclosure program, and we will not pursue legal action against researchers who follow that program in good faith.

8. Enforcement

We may, in our reasonable discretion and consistent with our institutional agreements:

Investigate suspected violations, including by reviewing logs, audit trails, and content;
Issue warnings;
Suspend or revoke individual user access;
Suspend or terminate institutional access (subject to contractual notice and cure provisions);
Remove or quarantine offending content;
Cooperate with law enforcement and regulators where legally required;
Refer matters to your institution, IRB, or compliance office where appropriate.

We will use reasonable efforts to provide notice of enforcement actions to the institutional administrator of record, except where doing so would compromise an investigation, public safety, or our legal obligations.

9. Changes to This AUP

We may update this AUP from time to time. Material changes will be communicated to institutional administrators by email and/or in-Platform notice with reasonable advance notice, except where a shorter notice period is necessary to address a security or legal issue. Continued use of the Services after the effective date of a change constitutes acceptance of the updated AUP, subject to the terms of your institutional agreement.

10. Contact

Aims Innovations PR LLC
Suite 200, PMB 0565, San Juan, PR 00901
San Juan, Puerto Rico

General: hello@aims-innovations.com

Legal: legal@aims-innovations.com

Privacy: privacy@aims-innovations.com

Security: security@aims-innovations.com