BeneVets, Inc. - Acceptable Use Policy

§ 1. Plain-English Summary

In plain English: This Acceptable Use Policy explains what you can and cannot do when you use BeneVets. The short version:

• Be honest about who you are. Do not lie about military service. Do not pretend to be someone's family member to get into their account.
• Use the Service only for yourself. BeneVets is built for you to file your own claim, pro se. You may not act as another veteran's representative through this Service.
• Do not upload someone else's DD-214. Do not alter a DD-214. Do not invite a person who did not ask you to.
• Do not attack the Service. No hacking, scraping, bots, fake crisis alerts, or attempts to break in.
• Do not abuse other people through the Service. No coercion, no elder financial exploitation, no harassment.
• If you break this AUP, BeneVets may warn you, suspend your account, or close it. You can appeal an enforcement action within 30 days.
• If you see someone breaking this AUP, report it to abuse@benevets.org.

This summary is for orientation only. The operative terms appear below.

§ 2. Scope and Acceptance

In plain English: This AUP is part of the Terms of Service. Using the Service means you accept this AUP.

This AUP is incorporated by reference into the BeneVets Terms of Service (Doc 01) and forms a part of the contract between you and BeneVets, Inc. ("BeneVets," "we," "us," "our"). By accessing or using the BeneVets website, web application, or any ancillary surface operated by BeneVets, Inc. (collectively, the "Service"), you ("you," "User") agree to comply with this AUP. If you do not agree, you must not access or use the Service.

Capitalized terms not defined in this AUP have the meanings given in the Terms of Service.

This AUP applies to all Users, including registered account holders, Helpers (as defined in the Helper Terms, Doc 07), unauthenticated visitors, and any person acting through a User's credentials.

§ 3. Eligibility

In plain English: You must be 18 or older and using the Service from the United States.

You may use the Service only if all of the following are true:

1. You are at least 18 years of age.
2. You are located in the United States, including the 50 states, the District of Columbia, U.S. territories (Puerto Rico, U.S. Virgin Islands, Guam, American Samoa, the Northern Mariana Islands), or an Army Post Office (APO), Fleet Post Office (FPO), or Diplomatic Post Office (DPO) address.
3. You are not prohibited from receiving services under any applicable U.S. law, including U.S. economic sanctions and export control law (e.g., 31 C.F.R. Parts 500-599; 15 C.F.R. Parts 730-774).

The Service is not directed to, intended for, or available to children under 13 years of age. We do not knowingly collect Personal Information from children under 13. See the Children's Online Privacy Notice (Doc 16).

The Service is not directed to users located outside the United States. If you access the Service from outside the United States, you do so on your own initiative and at your own risk.

§ 4. Account Integrity

In plain English: Use real information when you register. Have only one account. Do not share your password. Turn on multi-factor authentication when it is offered. You are responsible for what happens under your account.

You must comply with each of the following account-integrity rules:

1. Accurate registration information. You must provide accurate, current, and complete information when you register and must keep that information accurate, current, and complete.
2. One account per natural person. You may maintain only one User account for yourself. You may not register an account for a person other than yourself, except as expressly permitted through the Helper account-linking flow described in the Helper Terms (Doc 07).
3. No credential sharing. You may not share your password, one-time-passcode seed, recovery codes, session token, or any other authentication factor with any other person. Account-linking with a Helper is not credential sharing; it is a separate, granular, revocable, and audit-logged grant managed inside the Service.
4. Responsibility for activity. You are responsible for all activity occurring under your account, including activity by any person to whom you have intentionally or negligently disclosed credentials.
5. Safeguard credentials. You must take reasonable steps to safeguard your credentials, including using a unique, sufficiently complex password and protecting any device on which you remain logged in.
6. Multi-factor authentication. You must enable Time-based One-Time Password (TOTP) multi-factor authentication where the Service offers it and where doing so is reasonable for your circumstances. We strongly recommend that every User enable MFA.
7. Notice of compromise. You must promptly notify us at security@benevets.org if you know or reasonably suspect that your credentials, account, or any account-linked Helper relationship has been compromised.

§ 5. Prohibited Uses

In plain English: The list below is not exhaustive. If something feels like it is gaming, abusing, attacking, or weaponizing BeneVets, do not do it. The categories below capture the most important rules but are illustrative, not exclusive.

You may not engage in any of the following conduct, and the following enumeration is illustrative, not exclusive. BeneVets reserves the right to identify additional conduct as prohibited consistent with the purposes of this AUP.

§ 5.1 Unauthorized Access

You may not:

• Access or attempt to access any other User's account, Helper relationship, profile data, document storage envelope (including any ProfileVault contents), or symptom log;
• Circumvent, disable, or attempt to circumvent any authentication, authorization, or access-control mechanism, including password gates, multi-factor checks, OAuth flows, server-locked attestation gates, or session-binding;
• Access or attempt to access any administrative, staff, internal, debug, or operations interface without authorization, including non-production environments;
• Use credentials obtained through phishing, social engineering, credential stuffing, or breach of a third-party service to access the Service.

Unauthorized access conduct may violate the federal Computer Fraud and Abuse Act, 18 U.S.C. § 1030, and the California Comprehensive Computer Data Access and Fraud Act, Cal. Penal Code § 502.

§ 5.2 Misrepresentation

You may not misrepresent your identity or your relationship to a veteran. Without limitation, you may not:

• Use a false name, false date of birth, or false contact information at registration or in your profile;
• Falsely claim military service, falsely claim a particular branch, era, character of service, separation status, decoration, or disability rating;
• Falsely claim a relationship to a veteran for purposes of account-linking, Helper status, or any benefit-eligibility inference.

False claims of military service, awards, or decorations may constitute a federal offense under the Stolen Valor Act of 2013, 18 U.S.C. § 704.

§ 5.3 Coercion, Fraud, and Financial Exploitation

You may not use the Service, including the Helper account-linking flow, to coerce, defraud, financially exploit, or otherwise take advantage of any other person, including any other User, any Helper, or any veteran whose account you access.

This prohibition includes, without limitation, elder financial exploitation. Elder financial exploitation may violate the federal Elder Justice Act, 42 U.S.C. § 1397j et seq., and California's Adult Protective Services framework, Cal. Welf. & Inst. Code § 15600 et seq., including the financial-abuse provisions at Cal. Welf. & Inst. Code § 15610.30.

§ 5.4 Scammer Behavior

You may not:

• Send a Helper invitation, account-link request, or any other invitation to a person who did not provide their contact information to you for the purpose of receiving such an invitation;
• Falsely claim a family, caregiver, or representational relationship in order to gain access to another person's profile, documents, or VA records;
• Attempt to extract, harvest, scrape, or otherwise obtain another person's Personal Information, VA-system access, claim status, or Sensitive Personal Information;
• Use the Service to operate, support, or solicit for a scheme that monetizes another veteran's benefits without that veteran's informed authorization and without lawful authority to do so.

§ 5.5 Document Misuse

You may not:

• Upload, store, or transmit through the Service a DD-214 (Certificate of Release or Discharge from Active Duty) that is not your own, except where you are a properly authorized Helper acting on behalf of the veteran-User whose DD-214 it is and where the upload occurs through the Helper account-linking flow;
• Upload an altered, forged, fabricated, or otherwise non-authentic DD-214 or other identity document;
• Sell, transfer, traffic in, or commercially exploit any veteran benefit information, claim information, rating information, or document obtained through or stored in the Service.

Forgery or trafficking of military discharge papers may constitute a federal offense, including under 18 U.S.C. § 498 (forging discharge papers) and 18 U.S.C. § 1028 (identity document fraud).

§ 5.6 Unauthorized Practice of Law and Unauthorized VA Representation

Mirror-language note: The non-representation framing below is drafted to mirror the Terms of Service (Doc 01) and the Pro Se Filing Attestation (Doc 08) exactly. Any revision must be propagated across all three documents.

The Service is built for you to prepare and file your own VA forms acting pro se. BeneVets is not your representative. BeneVets is not accredited under 38 C.F.R. § 14.629. BeneVets does not authorize any User to act as a representative of another veteran through this Service.

You may not, through the Service:

• Hold yourself out, directly or by implication, as a representative, agent, attorney, claims agent, or accredited VSO representative of another veteran, except as expressly authorized under 38 C.F.R. § 14.629 outside the Service;
• Hold yourself out as a "preparer" of another person's VA forms beyond the narrow one-time exception recognized at 38 C.F.R. § 14.629(c) (one-time preparation of a claim by a non-accredited person), and even then, you may not use the Service's transmission, attestation, or filing surfaces to do so;
• Charge or accept any fee, gratuity, or other consideration in connection with preparing, presenting, or prosecuting another person's claim at the Agency of Original Jurisdiction stage, in violation of 38 U.S.C. § 5904 or 38 C.F.R. § 14.636;
• "Help" another veteran through the Service in any manner that constitutes the unauthorized practice of law under California Business and Professions Code § 6125 or the law of any other state where the assisted person is located.

The Pro Se Filing Attestation (Doc 08), which is presented at each transmission to VA, controls the form and substance of the pro se filing acknowledgment for User-initiated transmissions.

§ 5.7 Spam and Abusive Communications

You may not abuse any communication surface offered by the Service, including transactional notifications, Helper invitations, profile-comment fields, or any messaging surface that is later activated. Without limitation, you may not:

• Use a transactional surface to send unsolicited commercial messages in violation of 15 U.S.C. § 7701 et seq. (CAN-SPAM Act);
• Cause the Service to transmit invitations, notifications, or messages to recipients who have not consented to receive them;
• Use the Service to harass, threaten, intimidate, or repeatedly contact any person who has indicated that further contact is unwelcome.

§ 5.8 Automated Access

You may not access the Service through any automated means, including scrapers, bots, crawlers, headless browsers, or scripted clients, except that:

• Documented, well-behaved public search-engine crawlers may access publicly available pages in compliance with our robots.txt directives and any published rate limits;
• Authorized assistive technologies operated by an individual User for that User's own use are permitted and are not "automated access" for purposes of this section.

You may not harvest, scrape, index, frame, mirror, or otherwise systematically extract content or data from the Service, including the VSO directory and the public benefit content, except as expressly permitted in writing.

§ 5.9 Reverse Engineering and Circumvention

You may not:

• Reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code, object code, or underlying ideas, algorithms, file formats, or non-public application programming interfaces of the Service, except to the extent that such activity is expressly permitted by applicable law notwithstanding this limitation;
• Defeat, disable, or circumvent any technical protection measure, encryption, authentication, rate limit, content protection, or copy control on or in the Service.

These prohibitions are in addition to, and not in lieu of, restrictions imposed by 18 U.S.C. § 1030 (CFAA), Cal. Penal Code § 502, and 17 U.S.C. § 1201 (DMCA anti-circumvention).

§ 5.10 Interference

You may not interfere with or disrupt the Service, including by:

• Transmitting any virus, worm, trojan horse, ransomware, logic bomb, or other malicious code;
• Conducting any denial-of-service attack, distributed denial-of-service attack, traffic amplification, or other capacity-exhaustion attack;
• Probing, scanning, or testing the vulnerability of any system or network connected with the Service except through the channel and on the terms set out in the Security and Vulnerability Disclosure Policy (Doc 13);
• Overloading, throttling, or degrading the availability of the Service for others.

§ 5.11 Unlawful Purposes

You may not use the Service for any unlawful purpose or in furtherance of unlawful activity, including fraud, identity theft, money laundering, terrorism financing, human trafficking, or violation of U.S. economic sanctions or export control law.

§ 5.12 Violation of Others' Rights

You may not use the Service in a manner that:

• Infringes any patent, copyright, trademark, trade secret, or other intellectual property right (the DMCA Policy, Doc 12, governs copyright notices);
• Defames, libels, or makes false statements of fact about any identifiable person;
• Harasses, stalks, threatens, doxes, or otherwise targets any identifiable person;
• Violates any other person's right of privacy, publicity, or against intrusion.

§ 5.13 Crisis-Content Abuse

In plain English: Do not fake a crisis. The crisis-keyword surface exists to support people who may be in real danger. Filing a false crisis alert about another person to harass them, embarrass them, or trigger a wellness check against them is prohibited. However, if you are genuinely concerned about yourself or another person and you raise a concern that turns out to be unfounded, that is not a violation. We do not punish good-faith concern.

You may not knowingly cause the Service's crisis-keyword automated decisioning to trigger about another person for the purpose of harassing, embarrassing, or causing a harmful response (including a wellness check, hospitalization, or contact by law enforcement) against that person, where you do not have a good-faith basis to believe the person is in crisis.

A good-faith report or concern that turns out to be unfounded is not a violation of this section. BeneVets will not penalize a User for raising a genuine concern in good faith, even where the concern proves mistaken in retrospect. The chilling of legitimate but-cautious reporting is a harm we explicitly seek to avoid.

§ 6. Content You Enter

In plain English: Right now you can enter only profile information, symptom log notes, and Helper invitations. We expect those to be true (for identity), lawful, free of other people's private information they have not consented to share, and respectful of the people you mention.

The Service does not host user-generated content for public display at version 1. The only User-entered content is:

1. Profile data - name, contact information, branch of service, era of service, separation status, disability rating, conditions of interest;
2. Document uploads - DD-214 and any other identity documents you upload to the ProfileVault;
3. Symptom-log narratives - your own narrative entries describing symptoms relevant to C&P examination preparation;
4. Helper communications - invitations and short messages within the Helper account-linking flow.

Each of these inputs is subject to the following restrictions:

1. Accuracy of identity and contact information. Identity and contact information you enter must be accurate, complete, and current. Inaccurate identity information may impair the Service's ability to support your VA filings.
2. Lawful content. You may not enter content that is unlawful, that constitutes a threat of violence, or that depicts the sexual exploitation of a minor (which, if encountered, will be reported to the National Center for Missing & Exploited Children as required by 18 U.S.C. § 2258A).
3. Third-party Personal Information. You may not enter Personal Information about a third party without that third party's consent, except as expressly contemplated by the Service (for example, identifying a minor dependent by relationship label only, as described in Section 3 of the master context, with no minor name, date of birth, or contact information).
4. Dignity. You must treat your own dignity and the dignity of any other person you reference with respect. Slurs, dehumanization, and degrading language directed at any individual or group are prohibited.

§ 7. Forward-Compatible UGC Provisions (Parked)

In plain English: Today you cannot post comments, reviews, forum threads, or community messages. When we open those features in a later release, the rules below will apply. They are parked here so you have notice now.

When BeneVets activates a user-generated-content surface (including but not limited to comments, reviews of partners, forums, community messaging, or shared narratives), the following additional content rules will apply. These provisions are reserved and will become operative on the effective date of the corresponding feature release. Until that effective date, no UGC surface is available and these provisions do not impose obligations on Users.

1. Suicide-method content. You may not post content that describes the method, means, or specific lethality of any suicide attempt, completed suicide, or self-harm act. This rule is informed by the SAMHSA-endorsed safe-messaging guidelines for reporting on suicide and applies regardless of the speaker's identity or stated intent.
2. Medical-claim certainty. You may not post content asserting certainty about VA medical or rating outcomes, including but not limited to: "I can guarantee you'll get a 100% rating," "this condition is automatically rated at X%," or similar phrasing. Generalized lay descriptions of one's own claim experience are not prohibited.
3. Undisclosed solicitation. You may not post content soliciting paid representation, legal services, financial services, or any other commercial relationship without prominent, plain-language disclosure of the speaker's interest. Veterans Service Organizations and accredited representatives may not solicit through the Service without identifying their accreditation status, organization, and any fee arrangement applicable to the solicited matter.
4. Other rules to be announced. Additional rules may be announced at the time of UGC activation, including rules regarding crisis-content, misinformation about VA programs, and anti-harassment.

§ 8. Helper-Feature Abuse

In plain English: Helpers get power. Do not abuse it. The full rules for Helpers live in Doc 07.

The Helper / Account-Linking Terms (Doc 07) govern the rights and obligations of any User who grants Helper access and any person who accepts Helper access. The principal abuse-prevention rules - including the bar on accepting Helper access without informed authorization from the veteran-User, the revocation framework, the audit-log mechanism, and the VSO-Helper accreditation requirements - are stated in Doc 07. To the extent of any conflict between Doc 07 and this AUP with respect to Helper conduct, Doc 07 controls.

§ 9. Sponsored Content and Partner Relationships

In plain English: You cannot pretend to be a BeneVets partner. You cannot say BeneVets endorses you if it does not.

You may not:

• Hold yourself out as a partner, sponsor, vendor, contractor, or affiliate of BeneVets if you are not in fact such a partner under a written agreement with BeneVets;
• Display or use the BeneVets name, logo, trademarks, or service marks in a manner that suggests endorsement, sponsorship, or affiliation that does not exist;
• Falsely claim that BeneVets endorses, recommends, certifies, or has reviewed any product, service, organization, or representative.

Paid placement of sponsored content within the Service is governed by the BeneVets Sponsorship Policy published at /sponsorship-policy and is subject to the rules summarized in Section 6 of the master context.

§ 10. Reporting Violations

In plain English: If you see something, tell us. Email abuse@benevets.org. We will read it. We will not retaliate against a person who reports in good faith.

Report suspected violations of this AUP to: abuse@benevets.org.

In your report, please include:

• A description of the conduct you observed or experienced;
• The approximate date and time;
• The username, account, or other identifier of the User involved (if known and if you can share it lawfully);
• Any supporting screenshots or excerpts;
• Your contact information (optional but helpful).

We acknowledge receipt of abuse reports within five (5) business days. We investigate every credible report. We do not disclose the identity of a reporter to the reported User except as required by law. We do not retaliate against a User who reports a suspected violation in good faith.

Reports of suspected security vulnerabilities should be routed instead to the Security and Vulnerability Disclosure Policy (Doc 13).

Copyright infringement notices should be routed instead to the DMCA / Copyright Policy (Doc 12).

§ 11. Enforcement

In plain English: We respond proportionally. First we try to fix it with a warning. We escalate only when we have to. We do not penalize honest mistakes.

BeneVets applies a graduated enforcement response:

1. Warning. For first-time or minor violations, we issue a written warning describing the conduct, the rule it violated, and the remediation requested. The User has an opportunity to cure.
2. Temporary suspension. For continued violations after warning, for serious first-time violations, or for conduct presenting a credible risk to other Users, we may temporarily suspend the account. A suspension notice states the duration and the conditions, if any, for reinstatement.
3. Termination. For severe violations, for repeated violations after suspension, or for conduct posing an ongoing risk to other Users or to the integrity of the Service, we may terminate the account.

Enforcement is intended to be proportionate to the conduct. We do not penalize good-faith mistakes. We consider intent, prior history, and the magnitude of any harm.

Consequences of termination. Upon termination, access to the account ends. Data is retained, deleted, or returned in accordance with the Data Retention Schedule (Doc 14) and the Privacy Policy (Doc 02). Certain records, including audit-log entries related to a terminated account, are retained for legal, regulatory, and dispute-resolution purposes as described in Doc 14.

§ 12. Appeal of Enforcement

In plain English: If we close or suspend your account and you disagree, you have 30 days to ask us to reconsider. A different person will review the decision.

A User who receives a warning, suspension, or termination may appeal the enforcement action by emailing appeals@benevets.org within thirty (30) calendar days of the enforcement notice.

The appeal should describe:

• The enforcement action being appealed;
• The User's account or other identifier;
• The factual basis for the appeal;
• Any supporting documentation.

A BeneVets staff member who was not involved in the original enforcement decision reviews the appeal. We aim to provide a written decision on the appeal within twenty-one (21) calendar days. Note: form-submission workflows that depend on VA API access will not be enabled until BeneVets is granted production VA API credentials; appeals concerning such workflows are subject to that gating of receipt. The appeal decision is the final internal disposition; it does not preclude any legal remedy otherwise available.

§ 13. Right to Refuse Service

In plain English: We can decline to serve a person who keeps breaking the rules or who puts other Users at risk.

BeneVets may decline to provide the Service, in whole or in part, to any User who:

• Has repeatedly violated this AUP;
• Whose continued access presents a credible risk of harm to other Users, to BeneVets staff, or to the integrity of the Service; or
• Whose use of the Service would violate applicable law.

The right reserved in this Section 13 is exercised consistent with the proportionality and good-faith principles in Section 11 and with applicable civil rights and anti-discrimination law. BeneVets does not refuse service based on race, color, religion, national origin, ancestry, disability, medical condition, genetic information, marital status, sex, gender, gender identity, gender expression, sexual orientation, age, veteran or military status, or any other characteristic protected by applicable law.

§ 14. Removal of Content

In plain English: If content on the Service is dangerous or illegal, we may remove it right away.

BeneVets may remove or restrict access to any User-entered content that violates this AUP without prior notice in any of the following circumstances:

• The content presents a credible risk of imminent harm to any person;
• The content is unlawful or its continued presence would violate applicable law;
• Removal is compelled by legal process or a request from law enforcement that meets the standards set out in the Privacy Policy (Doc 02);
• Removal is necessary to protect the security or integrity of the Service.

In other circumstances, BeneVets endeavors to provide notice and an opportunity to cure before removal.

§ 15. Cooperation with Law Enforcement

In plain English: When law enforcement asks for information using proper legal process, we cooperate. We may report something that looks like a serious crime.

BeneVets cooperates with law enforcement requests that meet the legal-process standards described in the Privacy Policy (Doc 02), including subpoenas, court orders, search warrants, and lawful emergency requests under 18 U.S.C. § 2702(b)(8) and 18 U.S.C. § 2702(c)(4).

BeneVets may, in its discretion and consistent with applicable law, report suspected illegal activity to appropriate authorities. Such reports may include, without limitation:

• Suspected child sexual abuse material, reported to the National Center for Missing & Exploited Children as required by 18 U.S.C. § 2258A;
• Suspected threats of imminent violence;
• Suspected fraud against the U.S. Department of Veterans Affairs.

§ 16. Mandatory Reporter Analogs

In plain English: BeneVets is not a "mandatory reporter" under California law. But we may report serious abuse or imminent danger when we see it.

BeneVets, Inc. is not a "mandated reporter" under California's Child Abuse and Neglect Reporting Act, Cal. Penal Code § 11164 et seq., or under California's Elder Abuse and Dependent Adult Civil Protection Act, Cal. Welf. & Inst. Code § 15630.

BeneVets nonetheless reserves the discretion, consistent with applicable law and the Privacy Policy (Doc 02), to report:

• Suspected child abuse or neglect to a child protective services agency or law enforcement;
• Suspected elder abuse or dependent-adult abuse (including financial exploitation under Cal. Welf. & Inst. Code § 15610.30) to Adult Protective Services or law enforcement;
• Threats of imminent harm to self or to others to law enforcement, a crisis-response agency, or, where appropriate, the Veterans Crisis Line.

Discretionary reports of this kind are made in good faith and only where BeneVets believes, based on information then available, that such a report is appropriate to protect against a credible risk of harm. Section 16 does not modify the consent-based and rights-based framework of the Privacy Policy.

§ 17. Cross-References

This AUP must be read together with:

• Terms of Service (Doc 01) - the master contract between User and BeneVets, into which this AUP is incorporated.
• Privacy Policy (Doc 02) - describes the collection, use, and disclosure of Personal Information, including law-enforcement-cooperation standards referenced in Sections 14-16 above.
• Helper / Account-Linking Terms (Doc 07) - governs Helper relationships and Helper conduct; controls over this AUP as to Helper conduct (see Section 8 above).
• Pro Se Filing Attestation (Doc 08) - governs the pro se attestation that a User makes at each transmission to VA.
• DMCA / Copyright Policy (Doc 12) - exclusive channel for copyright infringement notices.
• Security and Vulnerability Disclosure Policy (Doc 13) - exclusive channel for security vulnerability reports.
• Data Retention Schedule (Doc 14) - governs retention, deletion, and return of data on termination.

§ 18. Changes to this AUP

In plain English: We may update this AUP. When we make material changes, we will tell you.

BeneVets may update this AUP from time to time. Material changes will be communicated through one or more of the following: a banner notice on the Service, a transactional email to registered Users, or a notice at the next login. The "Last revised" date at the top of this document reflects the most recent revision. Continued use of the Service after the effective date of a material revision constitutes acceptance of the revised AUP.

§ 19. Contact

End of Document 06 - Acceptable Use Policy.