Policies

Employee explanation

This policy requires client identifying info, personal data, regulated financial context, medical context to be removed or masked before use with personal AI.

Supporting excerpt

Client, Patient, and Medical Information • Employees must not submit identifiable client or patient information to an unapproved AI tool. • Protected information includes client names, patient names, email addresses, phone numbers, street addresses, medical record numbers, account numbers, appointment dates, invoices, photographs, diagnostic reports, treatment records, and any combination of details that could identify a client or patient. • When an approved workflow permits AI assistance, direct identifiers must be removed or replaced with placeholders before content is submitted. • If identifiable client or patient information is detected in an unapproved AI destination, Accord should redact the identifiers when safe redaction preserves the task.

Data categories

Employee explanation

This policy does not allow secrets credentials, prompt injection to be submitted to external AI.

Supporting excerpt

Credentials and Security Secrets • Employees must never submit passwords, authentication codes, API keys, access tokens, private keys, database credentials, or other security secrets to any generative AI tool. • Any detected credential or secret must be blocked rather than merely warned or redacted. • Employees must not attempt to bypass, disable, or evade AI governance controls.

Data categories

Employee explanation

This policy does not allow confidential data, regulated financial context, intellectual property to be submitted to personal AI.

Supporting excerpt

• Employees must not submit confidential contracts, pricing terms, donor information, unpublished financial results, strategic plans, internal investigation material, proprietary procedures, or nonpublic business-development information to an unapproved AI tool. • Confidential internal information may be used with an approved enterprise AI tool only when the applicable data-handling agreement and department policy permit that use.

Data categories

Employee explanation

This policy requires review or approval before client identifying info, hr context, legal context is used with approved AI.

Supporting excerpt

Monitoring and Privacy • The organization may record policy events such as the rule triggered, action taken, risk level, AI destination, department, and timestamp. • The organization should not retain complete employee prompts or AI responses for routine governance reporting unless a separately approved investigation or legal requirement authorizes retention. • Governance reporting must be limited to the minimum information required to understand risk, improve policy, and demonstrate compliance.

Data categories

Employee explanation

This policy requires review or approval before confidential data, medical context is used with approved AI.

Supporting excerpt

Purpose • This policy governs the use of generative artificial intelligence tools by employees, contractors, trainees, and volunteers of Northstar Veterinary Medical Center. • The organization supports responsible use of approved AI tools when those tools improve work without exposing confidential information, replacing professional judgment, or violating organizational policy.

Data categories

Employee explanation

This policy does not allow client identifying info, hr context to be submitted to external AI.

Supporting excerpt

Test design: Each numbered clause uses explicit terms such as “must,” “must not,” “only,” “blocked,” and “required” so Accord’s current deterministic policy importer has a fair chance to identify candidate rules.

Data categories

Employee explanation

Client identifying information cannot be sent to personal AI. Accord will remove identifiers when it can do so safely, otherwise the submission is blocked or routed for approval.

Supporting excerpt

Employees must not submit client names, addresses, account numbers, veterinary medical records, payment information, or other identifying information to personal or unapproved AI services. When identifying information can be removed without preventing the task, it must be removed before submission. If adequate de-identification is not possible, the submission must be blocked or routed for approval.

Data categories