INFORMATION GOVERNANCE · ACCEPTABLE USE

Acceptable Use Policy

The rules that every authorised user agrees to when using RTT Buddy, and the consequences of misuse.

Status

Draft

Version

0.1

Reference

IG-AUP-001

Last updated

9 October 2026

This is a standalone, binding policy. It applies in addition to the adopting organisation's own information governance, IT acceptable use, and conduct policies. Where another applicable policy is stricter, the stricter rule applies. Fields marked [Customer to confirm] are completed with the adopting organisation before go-live.

1 Purpose

This Acceptable Use Policy sets out how RTT Buddy may and may not be used. Its purpose is to keep patients safe, keep data secure, and protect the integrity of Referral to Treatment (RTT) pathway administration. Using RTT Buddy responsibly is a condition of access.

This policy is binding on every authorised user. By using RTT Buddy you accept it. It complements the RTT Buddy User Terms of Service and the Staff Privacy Notice.

2 Scope

This policy applies to all authorised users who access RTT Buddy, on any device or network, whether on the organisation's premises or remotely. It covers all use of the service and all content entered into it.

3 Conditions of access

• Access is granted to named individuals only, through the approved onboarding process.
• You may use RTT Buddy only for legitimate work connected to your role in RTT and waiting-list administration.
• Access is personal to you and may be withdrawn at any time under section 10.

4 Acceptable use

You may use RTT Buddy to:

• ask plain-language questions about RTT scenarios using events, dates, and timings;
• obtain cited guidance on whether the RTT clock should start, stop, or pause, and which rule applies;
• support your own judgement and your conversations with your RTT lead or validation team.

5 Prohibited use

You must not:

• enter patient-identifiable data, or attempt to bypass, disable, or test the no-PID guardrail;
• treat an answer as a final ruling without the checks in section 7;
• share, reuse, or borrow sign-in credentials, or access the service using another person's account;
• enter content that is unlawful, discriminatory, offensive, or unrelated to RTT administration;
• attempt to disrupt, probe, scrape, reverse engineer, or gain unauthorised access to the service or its data;
• copy, export, or share the organisation's policy content or the tool's output outside your authorised work;
• represent the tool's guidance as a clinical decision or as official organisational policy; or
• use the service in any way that breaches your organisation's information governance or IT acceptable use policies.

6 Patient-identifiable data

RTT Buddy is designed so that it never needs to know who a patient is. RTT rules turn on events and timings, for example the referral date, a missed appointment, the start of active monitoring, or a decision to treat, not on identity.

7 Reliance and escalation

Every answer names its source and states a confidence level. You must read both before you act.

Any web-sourced content is labelled unverified and must be confirmed against your policy before you rely on it. A flag for review is never a sign-off. When in doubt, escalate.

8 Your responsibilities

• Keep your sign-in credentials confidential and sign in only from approved devices and networks.
• Lock your screen when away from your device and sign out on shared devices.
• Report a suspected account compromise, security concern, or accidental entry of patient-identifiable data promptly to your RTT lead or IT service desk.
• Co-operate with monitoring, audit, and investigations under this policy.

9 Monitoring

Use of RTT Buddy is logged and may be monitored and audited to keep the service safe, secure, and accurate, and to investigate suspected misuse. Logs record the de-identified scenario and the reasoning trail only, and do not store patient-identifiable data. Monitoring is carried out in line with the Staff Privacy Notice and your organisation's policies.

10 Breaches and consequences

Breach of this policy is taken seriously. Depending on the nature and severity of the breach, one or more of the following may follow:

• Suspension or withdrawal of access to RTT Buddy, immediately and without notice where necessary to protect patients or data;
• Referral to your line manager and the organisation's information governance team for review;
• Referral under the organisation's disciplinary, conduct, or HR procedures, which may result in formal action up to and including dismissal;
• Referral to a professional regulator where professional standards may have been breached; and
• Referral to the police or other authorities where the breach may be unlawful, for example unauthorised access to data.

Suspected personal data breaches are handled under the organisation's incident and breach procedures and may be reportable to the Information Commissioner's Office. Nothing in this section limits the organisation's existing rights or duties.

11 Reporting concerns

If you see misuse, a security weakness, or a suspected data breach, report it promptly to your RTT lead, your information governance team, or your IT service desk. Reporting a genuine concern in good faith will not count against you.

12 Review and acceptance

This policy is reviewed at least annually and when the service or relevant guidance changes materially. Continued use of RTT Buddy after a material change confirms your acceptance of the updated policy.