Acceptable use policy

This policy explains what is and isn't acceptable when using Medishelf. It applies to account owners and to every staff member they invite, and it supplements our Terms & Conditions. The account owner is responsible for making sure their team follows it.

• Run the inventory, purchasing, POS and reporting of the pharmacies on your plan.
• Invite staff, contractors and accountants who work for your pharmacy, each with their own login.
• Export your data at any time and use it however you like — it's yours.
• Connect hardware such as barcode scanners, receipt printers and cash drawers.

• Attempting to access another pharmacy's data, or probing for weaknesses outside our responsible disclosure process.
• Sharing one login between several people, or sharing credentials outside your business.
• Reverse-engineering, scraping, copying or reselling the software or access to it without written consent.
• Uploading malware, or interfering with the service's performance or security.
• Using Medishelf for anything unlawful, fraudulent or deceptive — including false invoices or manipulated records.
• Storing data you don't have the right to collect, or using customer contact details for spam.
• Using automated tools to create accounts or overload the service.

Because pharmacies are regulated businesses, a few extra rules apply:

• Only use Medishelf to sell products you are licensed to sell in your jurisdiction.
• Don't use the system to disguise the sale of controlled or prescription-only medicines, or to bypass legal record-keeping.
• Keep batch, expiry and supplier details accurate — other features (such as FEFO suggestions and alerts) depend on them.
• Comply with the privacy laws that apply to your customers' personal data.

Plans include generous limits for normal pharmacy use. If an account's usage — such as automated API calls or very large file imports — begins to affect other customers, we'll contact you first to find a solution, such as scheduling imports or moving to a more suitable plan, before applying any rate limits.

Most issues are honest mistakes, so we start with a conversation. If a violation continues, we may restrict features or suspend the account. We act immediately, without prior notice, only where there is serious risk — for example attempted access to other tenants' data, active malware, or illegal activity. Data in a suspended account stays protected and, unless the law requires otherwise, exportable. If you believe we got it wrong, contact us and a person will review the decision.

To report misuse of Medishelf, email support@medishelf.co. For security vulnerabilities, use security@medishelf.co and see our Security page.