Acceptable Usage Policy
ASPIRIUM LTD
Version: 2.0
Last Updated: 26 October 2026
This Acceptable Usage Policy (“Policy”) governs the lawful, responsible and secure use of services provided by Aspirium Ltd.
It forms part of our Terms of Service and applies to all Customers, authorised users and individuals accessing our Services through a Customer account.
Its purpose is to protect our Customers, infrastructure, technology partners, service availability and the wider public from unlawful, harmful or abusive activity.
1. Scope and Responsibilities
1.1 Application
This Policy applies to all Services supplied by Aspirium Ltd, including website and email hosting, domain management, Website Care, website development, Email Marketing, Marketing Dashboards, Design Studio, AI Digital Assistant and related digital services.
1.2 Customer responsibility
Customers are responsible for activity carried out through their accounts, credentials, websites, applications, mailboxes and authorised users.
Customers must take reasonable steps to ensure that their employees, contractors and authorised representatives comply with this Policy.
1.3 Third-party services
Certain Services rely on third-party technology, including Stablepoint, ActiveCampaign, AgencyAnalytics and other providers.
Customers must comply with applicable provider restrictions incorporated into their Service Agreement.
1.4 Monitoring
Aspirium may investigate suspected misuse but does not undertake to continuously monitor all Customer content, communications or activity.
2. Lawful and Responsible Use
2.1 Legal compliance
Customers must comply with all applicable laws and regulations when using the Services.
2.2 Rights of others
Customers must not infringe another person’s intellectual property, privacy, confidentiality, contractual or data protection rights.
2.3 Accurate identity
Customers must not impersonate another person, misrepresent their authority, falsify contact information or conceal the origin of communications.
2.4 Harmful activity
Customers must not use the Services to facilitate fraud, harassment, exploitation, unlawful discrimination, threats or other illegal conduct.
2.5 Regulated activities
Customers operating in regulated industries must hold any licences, registrations, professional authorisations or approvals required for their activities.
Aspirium may request reasonable evidence of compliance where necessary.
3. Prohibited Content and Activities
Customers must not use the Services to create, host, distribute, transmit or facilitate:
Malware, ransomware, spyware, viruses or malicious code.
Phishing, identity theft, credential harvesting or financial fraud.
Child sexual abuse material or unlawful sexual exploitation.
Unlawful threats, harassment or incitement to violence.
Copyright infringement or distribution of unlawfully obtained software or media.
Unlawful sales or promotion of controlled goods or services.
Cryptocurrency mining or botnet operations on unauthorised infrastructure.
Denial-of-service attacks, mail bombing or network disruption.
Unlawful gambling or unlicensed regulated financial activity.
Any other activity that materially threatens the security, legality or availability of the Services.
3.1 Adult content
Lawful adult content may be hosted only with Aspirium’s prior written approval and where permitted by the relevant upstream provider.
Illegal sexual content is strictly prohibited.
3.2 Provider restrictions
Certain activities or industries may be prohibited by a particular technology provider even where they are otherwise lawful.
Customers must comply with the applicable restrictions of the Service they use.
4. Security and Network Use
4.1 Unauthorised access
Customers must not attempt to access accounts, networks, systems or information without appropriate permission.
4.2 Security testing
Penetration testing, vulnerability scanning and other security testing affecting Aspirium infrastructure require prior written authorisation.
4.3 Circumvention
Customers must not bypass authentication systems, usage limits, licensing controls, security restrictions or access permissions.
4.4 Network abuse
Operating unauthorised open proxies, public VPN services, Tor exit nodes, open relays or other services likely to compromise infrastructure is prohibited.
4.5 Customer security
Customers must maintain reasonable security practices, including strong passwords, appropriate access controls, supported software and multifactor authentication where available.
4.6 Compromised systems
Where Aspirium reasonably believes a system has been compromised, it may temporarily restrict access, reset credentials, quarantine files or suspend affected functionality.
Customers must cooperate with reasonable remediation instructions.
5. Website and Email Hosting
5.1 Intended use
Hosting services are intended for legitimate business websites, applications and ordinary business email communication.
5.2 Resource allowances
Customers must remain within the resource limits of their purchased plan, including storage, CPU, memory, bandwidth, databases, email sending and other technical allowances.
5.3 Fair use
Customers must not use resources in a manner that materially disrupts other users or compromises shared infrastructure.
5.4 Unlimited resources
Any reference to unlimited resources is subject to reasonable business use, technical limitations and the restrictions of the applicable hosting platform.
5.5 Storage restrictions
Unless expressly permitted, shared hosting must not be used primarily as a remote backup repository, general file-storage service, media archive or large-scale download platform.
5.6 Intensive workloads
Cryptocurrency mining, high-volume computation, persistent resource-intensive background processing and similar activities unsuitable for shared hosting are prohibited.
5.7 Software
Customers must maintain valid licences and must not install malicious, unlawfully obtained or deliberately compromised software.
5.8 Updates
Customers are responsible for maintaining their applications, themes and plugins unless maintenance is expressly included in their subscription.
5.9 Backups
Customers should maintain independent backups of important business information.
Any backups provided through hosting are subject to the relevant service arrangements.
6. Business Email and Electronic Messaging
6.1 Ordinary business email
Standard hosted email accounts are intended primarily for ordinary business communications and transactional messages.
They must not be used as bulk marketing platforms unless expressly authorised.
6.2 Unsolicited messages
Sending spam, unsolicited bulk email, phishing messages or deceptive communications is prohibited.
6.3 Sender identity
Customers must not forge message headers, impersonate senders or use domains and addresses without authority.
6.4 Mailing practices
Customers must maintain appropriate mailing-list quality, honour applicable unsubscribe requests and comply with relevant electronic marketing laws.
6.5 Sending restrictions
Aspirium and its hosting providers may rate-limit, reject, delay or block messages where reasonably necessary to protect platform security, deliverability or reputation.
6.6 Compromised scripts
Customers must secure website forms, mailboxes and automated scripts against unauthorised sending.
7. Email Marketing and Automation
This section applies specifically to Email Marketing and Automation services supplied by Aspirium using ActiveCampaign or another approved platform.
7.1 Permitted use
Customers may use Email Marketing services only for lawful business communications and marketing activities permitted by the applicable platform terms.
7.2 Marketing permissions
Customers must obtain and maintain the permissions required by applicable electronic marketing and data protection law.
Where the underlying platform requires verified opt-in, Customers must satisfy that requirement even where the law might otherwise permit a particular form of marketing.
7.3 Contact verification
Customers must be able to demonstrate an appropriate source and permission for the contacts they upload or message.
They must maintain accurate and reasonably current contact records.
7.4 Prohibited mailing lists
Customers must not use:
Purchased or rented mailing lists.
Harvested or scraped email addresses.
Lists obtained through unauthorised third parties.
Contact information collected deceptively.
Lists containing recipients who have objected or unsubscribed.
Contact databases that cannot satisfy the applicable platform’s permission requirements.
7.5 Unsubscribe facilities
Marketing communications must provide an effective means of opting out where required.
Customers must promptly honour unsubscribe requests and maintain appropriate suppression records.
7.6 Sender identification
Campaigns must accurately identify the sender and use truthful sender information, subject lines and business contact details.
7.7 Misleading content
Customers must not send messages containing fraudulent claims, misleading offers, deceptive advertising or unlawful representations.
7.8 Prohibited campaigns
Customers must not use Email Marketing services for campaigns prohibited by ActiveCampaign’s applicable policies.
Such restrictions may include certain financial services, cryptocurrency activities, gambling, affiliate marketing, unlawful goods, deceptive income opportunities, prohibited medical product promotions and other restricted industries or activities.
The applicable provider policy determines the precise restrictions, including any exceptions or approval requirements.
7.9 Healthcare marketing
Healthcare Customers must ensure that their communications comply with applicable professional advertising, confidentiality, privacy and data protection obligations.
Customers must not upload, record, infer or use identifiable health information or other special-category personal data in Email Marketing Services. This includes symptoms, diagnoses, treatment histories, clinical correspondence, and tags, segments, scores or automations that reveal or infer an identifiable person’s health condition or treatment.
Ordinary contact details may be used for a lawful mailing list where the list’s name, selection criteria, associated information and use do not themselves reveal or infer special-category data. Removing a diagnosis field does not make a list permissible if its membership or segmentation still reveals a health condition.
Customers must prevent website forms, booking systems and other integrations from passing prohibited information into Email Marketing Services.
7.10 Contact limits
Customers must comply with the contact, sending, storage and feature allowances of their subscription.
Artificially deleting and reimporting contacts to circumvent subscriber limits or pricing restrictions is prohibited.
7.11 Automation misuse
Customers must not use automations to generate spam, manipulate engagement statistics, overwhelm recipients or evade sending restrictions.
7.12 Deliverability
Customers are responsible for maintaining appropriate sender authentication, mailing-list hygiene and domain reputation.
Aspirium does not guarantee message delivery, inbox placement, open rates or campaign results.
7.13 Monitoring and complaints
Aspirium or its technology provider may investigate unusually high bounce rates, spam complaints, unsubscribe rates or other indicators of abuse.
Customers must cooperate with reasonable compliance investigations.
7.14 Suspension
Email Marketing functionality may be restricted or suspended where reasonably necessary to address suspected spam, unlawful processing, serious complaints or platform policy violations.
7.15 Platform policies
Customers must comply with the applicable ActiveCampaign policies, including:
Where these policies impose stricter conditions than this Policy, those conditions apply to the extent validly incorporated into the Customer’s Agreement.
7.16 Changes to platform restrictions
ActiveCampaign may update its requirements.
Aspirium may implement necessary restrictions to maintain compliance with the underlying platform, subject to the change provisions of its Terms of Service.
8. Websites, Applications and Personal Data
8.1 Lawful content
Customers must have the necessary rights to upload, store, publish and distribute content through the Services.
8.2 Personal data
Customers must process personal data lawfully and implement appropriate security, access and retention controls.
8.3 Sensitive information
Standard Hosting Services may be used to operate ordinary clinic websites and receive administrative enquiries and booking requests. These may include limited health information that an individual supplies in connection with their enquiry, such as a brief description of symptoms or the reason for requesting an appointment.
This permission covers the hosting, transmission, storage, backup and technical support reasonably necessary to operate those website functions. It does not authorise using standard hosting as a clinical records system, electronic health record system or patient portal, or to store or manage clinical records, consultation notes, diagnostic reports or clinical images.
Customers remain responsible for establishing an appropriate lawful basis and, where applicable, a condition for processing special-category data; providing privacy information; minimising collection; and implementing appropriate security, access and retention controls.
This hosting permission does not extend to Email Marketing, Design Studio, AI features or other Services that prohibit such information. Customers must configure integrations, notifications and automations to respect those restrictions.
Customers must not store payment-card details or card security codes in website forms, databases or files. Payments should be handled through an appropriately configured payment provider.
8.4 Website forms
Public forms, file uploads and authentication systems must use appropriate security and anti-abuse measures, including encrypted connections, restricted administrative access and supported software.
Customers must limit the information requested to what is reasonably necessary, discourage unnecessary medical detail and attachments in general enquiry forms, and apply appropriate retention periods to submissions and copies.
Customers must assess the security of form notifications and connected systems. Where a destination Service prohibits health information, notifications and integrations must exclude that information.
8.5 Exposed information
Customers must not knowingly expose passwords, access tokens, confidential records or private information through publicly accessible files, logs or directories.
9. Design Studio, Analytics and AI Services
9.1 Authorised access
Customers may use digital tools only within the permissions and allowances of their subscription.
9.2 Intellectual property
Customers must hold appropriate rights to images, designs, logos, fonts, documents and other materials uploaded or distributed through the Services.
9.3 Design Studio
Customers must not use Design Studio to create unlawful, fraudulent, infringing or deliberately deceptive content.
Customers must not upload or include identifiable patient health information, clinical records or other special-category personal data in projects, images, templates, brand assets or other Design Studio content. This includes identifiable patient photographs or testimonials where their content or context reveals health information.
Customers must not upload passwords, payment-card details or other authentication secrets. These restrictions also apply to integrations and AI features available within Design Studio.
9.4 Marketing analytics
Customers must obtain necessary authorisation before connecting third-party advertising, website, analytics or social accounts.
9.5 Tracking and privacy
Customers must comply with applicable privacy, cookie and electronic communications laws when deploying tracking technologies.
9.6 AI inputs
Customers must not submit identifiable patient information, clinical records, special-category personal data, criminal-offence data, passwords, payment-card details or other authentication secrets to AI features.
This restriction applies to prompts, conversations, uploaded documents, images, connected data sources and automated integrations. Removing a person’s name is insufficient where the remaining information could reasonably identify them.
Customers may use fictional examples or information that has been genuinely anonymised so that individuals are no longer identifiable. AI features are not supplied for maintaining patient records or making clinical decisions about identifiable individuals.
9.7 AI outputs
Customers must review and verify AI-generated information before use.
9.8 Professional decisions
AI features must not be used to make unauthorised automated clinical decisions or provide unreviewed professional advice.
9.9 AI misuse
Customers must not use AI functionality to facilitate fraud, impersonation, unlawful discrimination, harassment, infringement or other prohibited conduct.
9.10 Usage limits
Customers must not circumvent AI usage limits, licensing restrictions, access controls or reasonable technical safeguards.
10. Reports, Complaints and Investigations
10.1 Reporting
Suspected abuse may be reported through Aspirium’s published contact or support channels.
10.2 Investigations
Aspirium may review relevant account records, technical logs and content where reasonably necessary and lawful to investigate credible complaints, suspected misuse, security incidents or regulatory requests.
10.3 Cooperation
Customers must provide reasonable cooperation with legitimate investigations and remediation requirements.
10.4 External authorities
Aspirium may disclose relevant information to regulators, law enforcement, upstream providers or affected third parties where lawful and reasonably necessary.
10.5 Rights complaints
Where credible intellectual property, privacy or other legal complaints arise, Aspirium may restrict affected content while the matter is investigated.
11. Enforcement and Suspension
11.1 Available measures
Where Aspirium reasonably believes this Policy has been breached, it may:
Issue warnings.
Require corrective action.
Restrict particular functionality.
Rate-limit traffic or messaging.
Quarantine harmful files.
Reset compromised credentials.
Temporarily suspend Services.
Terminate affected Services in accordance with the Terms of Service.
11.2 Proportionality
Aspirium will take proportionate action where reasonably practicable, considering the nature, severity and urgency of the issue.
11.3 Urgent action
Immediate action may be taken without advance notice where reasonably necessary to prevent serious security risks, unlawful activity, data compromise or significant service disruption.
11.4 Opportunity to remedy
For non-urgent and remediable breaches, Aspirium will normally provide reasonable notice and an opportunity to correct the issue.
11.5 Restoration
Restoration may depend on satisfactory remediation, compliance with platform requirements and resolution of the underlying problem.
11.6 Data protection
Suspension or termination does not override Aspirium’s obligations concerning the return, deletion or lawful retention of Controller Personal Data under the applicable Data Processing Agreement.
12. Changes to This Policy
12.1 Updates
Aspirium may update this Policy to reflect changes in legislation, security threats, service functionality, infrastructure or third-party requirements.
12.2 Material changes
Material changes adversely affecting existing Customers will be handled in accordance with the notice and cancellation provisions of the Terms of Service.
12.3 Publication
The current version will be published on Aspirium’s website with its effective date.
13. Contact and Related Policies
ASPIRIUM LTD
Company number: 16989063
Registered office:
71–75 Shelton Street
Covent Garden
London
WC2H 9JQ
United Kingdom
Website: https://aspirium.co.uk
Questions or suspected misuse may be reported through the website contact form or Customer support system.
Related policies
End of Acceptable Usage Policy.