# 03 Domain modules: rules by the kind of thing you are building Pick the modules that match the app (the [app register](/playbook/04-app-register) names them per app). Each module adds to the [universal baseline](/playbook/02-universal-baseline). ## M1. Health, wellness, and diagnostics Applies to: RM Health (ex FitterMe), RM Pharma screening assistant, DuoFlow Dx, any food, sleep, cycle, or body-metric feature anywhere. **Which regime you are in** - **HIPAA does not apply** to a direct-to-consumer wellness app unless we contract with a US covered entity (clinic, insurer, employer plan). Do not say "HIPAA compliant". If a clinic ever resells RM Health, a Business Associate Agreement and the Security Rule safeguards become mandatory. - **FTC Health Breach Notification Rule** applies to us as a "vendor of personal health records". Breach means any unauthorised acquisition, including sharing with an SDK the user did not authorise. 60-day clocks, see [06](/playbook/06-incident-runbook). - **Washington My Health My Data Act**, Nevada, Connecticut: opt-in consent to collect and to share consumer health data, a separate Consumer Health Data Privacy Policy link on the homepage, a right to delete, no sale without signed authorisation, no geofencing around care facilities. Applies on a single Washington user. - **California CMIA section 56.06**: a consumer health app is a "provider of health care" for confidentiality. Unauthorised disclosure is actionable. - **UK GDPR Article 9**: health data is special category; explicit consent per purpose, a DPIA is mandatory (ICO list), and a DPO is likely required if processing is large scale. - **India**: SPDI Rules list health as sensitive; DPDP consent; Drugs and Magic Remedies Act for claims; Telemedicine Practice Guidelines 2020 (AI cannot consult or prescribe); Medical Devices Rules 2017 for software that diagnoses. - **Platform rules**: Apple HealthKit (App Review 5.1.3: no use of health data for advertising, data mining, or sale; no HealthKit data to iCloud; privacy policy mandatory; no false or inaccurate data written to HealthKit); Google Health Connect (permissions declaration form, limited use, policy page, data only for the declared purpose, no ads); Google Play Health apps policy (accuracy, disclosures, no medical claims without evidence). **Design rules** 1. Scope is **lifestyle and general wellness**. No diagnosis, no treatment, no drug or dosage talk, no GLP-1 or supplement recommendations, no "cure". The word "screening" is allowed only where the domain module M1b applies. Every coaching output carries the standing line: general wellness information, not medical advice, see a clinician for medical concerns. 2. **Eating-disorder and harm guardrails are deterministic**: BMI under 18.5 target or current, weekly loss above 1% body weight, calorie targets below 1,200 (women) or 1,500 (men), under-18 users, pregnancy or breastfeeding, self-reported ED history, purging or fasting language: stop the plan, show resources, require a clinician note to continue. No weight-loss coaching for under-18s (also an ASA and CAP rule for ads). 3. **Medical red flags route to care**, not to the model: chest pain, fainting, blood, fever with flank pain, suicidal ideation, symptoms in children or pregnancy. Fixed copy, local emergency numbers by region. 4. **Consent per data stream**: weight, food photos, steps, sleep, HRV, cycle data, each with its own toggle; Health Connect and HealthKit permissions requested in context, with the reason shown first. 5. **Photos** (food, test strips, body): processed and discarded unless the user saves them; never used for training; no face capture; stripped of EXIF location. 6. **Human coach in the loop** (the pilot's concierge model): the coach is not presented as a licensed dietitian, nutritionist, or doctor unless they hold that licence in the user's jurisdiction; US states regulate individualised nutrition advice for a fee, so the product gives plans as educational suggestions the user accepts, and the coach console logs the human approval. 7. **Claims**: substantiate every number ("users lost X") with the denominator and period; no before-and-after imagery without consent and a typicality statement; FTC Health Products Compliance Guidance applies to US marketing, ASCI to India, CAP to the UK. 8. **Data residency**: health data of UK users stored in India needs the transfer tool and a DPIA conclusion that the risk is acceptable; document it. 9. **Retention**: user-controlled, default delete on account closure, inactive-account reaper at 2 years with notice. **M1b. Screening devices and software as a medical device (RM Pharma, DuoFlow)** - Software that interprets a test cartridge, a strip, or symptoms to tell a user whether they likely have an infection is a **medical device** in India (MDR 2017, software notified since 2020), in the US (FDA; the Cures Act clinical decision support exemption does not cover analysing images or signals from an IVD for a patient), in the UK (UK MDR 2002 as amended), and in the EU (IVDR 2017/746, Class C for STI-related assays). - Until licensed or cleared: **no clinical claim, no public marketing of cartridge reading, no sale**. Allowed: "investigational", "for research and evaluation", "educational", with a visible statement that it is not approved for diagnosis. Pilot evaluations with real samples follow the New Drugs and Clinical Trials Rules 2019 and ICMR ethical guidelines (ethics committee approval, informed consent, data protection). Student-built software credits are fine; the regulatory status line still applies. - The DuoFlow patent is a **device** patent (dual isolated channels). India Patents Act section 3(i) bars diagnostic-method claims; US law after Mayo is similar. Keep the copy about the architecture, never about a diagnostic method. - Quality: ISO 13485 quality management, IEC 62304 software lifecycle, ISO 14971 risk management, clinical performance evaluation for IVDs. Start the technical file now even if filing is years away. - Photos of intimate areas: memory-only processing, never persisted, never logged, and the UI says so. Keep that true (it is today). - The chatbot never names an antibiotic or dose, never says "you have", always routes red flags to in-person care, and announces itself as an AI assistant in every session and language. ## M2. Children, students, and education Applies to: Tulip (EduOS, RM Schools), CoParent (children's information held by parents), any feature where under-18s may appear (Meet guest join, MyJanata, Nest). - **India, DPDP**: under 18 is a child. Verifiable parental consent is mandatory (DPDP Rule 10 pathways: identity details already held, details supplied by the parent, or a DigiLocker-type virtual token). No tracking, behavioural monitoring, or targeted advertising directed at children. Schools are Data Fiduciaries and get the Fourth Schedule Part A exemption for educational activities and safety; Rang & Mall is the **Data Processor** under contract. Processor-scoped, school-purpose-only processing is the only lawful shape for early-warning or at-risk analytics, and it must stay non-stigmatising. Cross-school model training on identifiable data converts us into an independent fiduciary with full liability; do not do it. - **POCSO Act 2012**: anyone who becomes aware of child sexual abuse must report it (sections 19 and 21). Helpdesk, chat, and media upload features in a school product need a trained escalation path and a retention hold for evidence. - **Aadhaar**: schools cannot demand Aadhaar as a condition of admission or service (Puttaswamy 2018). Never make Aadhaar mandatory in Tulip; never store Aadhaar numbers in plain text; never use biometrics for attendance without a lawful basis, parental consent, and a DPIA. - **Location tracking** (transport module): real-time bus location is fine; per-child tracking history is minimised, retention days not months, visible to that child's parents and the school only. - **Payments**: school fees settle to the school's own account through a licensed PA split-settlement product; marketplace purchases are the marketplace's commerce (Consumer Protection E-Commerce Rules 2020 apply: seller details, returns, grievance officer, no price manipulation); canteen food items are FSSAI-governed; product listings carry MRP per Legal Metrology. - **Communications**: SMS via DLT templates, WhatsApp via approved templates, opt-in per parent; no marketing to children's devices. - **Claims**: no board-affiliation or outcome claims without evidence; results statistics need substantiation and the "past record is no guarantee" line; never invent customers or ratings (ASCI, CCPA). - **US users (not today)**: COPPA for under-13s, FERPA and state student-privacy laws (SOPIPA and its clones) if we ever contract with US schools; Children's Code in the UK. - **Accessibility and language**: GIGW 3.0 and regional languages for government schools. - **CoParent specifics**: children's health, school, and location details are entered by parents and are P0; one parent cannot grant a third party (attorney, new partner) access to the other parent's or the child's data without the other parent's consent or a court order; export for court uses the BSA section 63 certificate (India) or an FRE 902(13) and (14) style certification (US), signed by a human custodian, not machine-signed. ## M3. Legal and immigration information products Applies to: LegalOS, Merit (O-1 and EB-1A readiness), CoParent's legal features, BuilderStudio tender and compliance guidance, any "ask a legal question" feature. - **Unauthorised practice of law**: India (Advocates Act section 29, 33; only enrolled advocates practise), every US state (UPL statutes; immigration advice additionally restricted by 8 CFR 1001.1 and state "notario fraud" laws to attorneys and DOJ-accredited representatives), UK (reserved legal activities under the Legal Services Act 2007, immigration advice regulated by the IAA, formerly OISC, under the Immigration and Asylum Act 1999 section 84, a criminal offence without registration). - **Product posture**: self-help information and document organisation, general in nature, with the user making every decision. Texas Government Code section 81.101(c) is the model disclosure: the software clearly and conspicuously states it is not a substitute for the advice of an attorney. Put that line in the UI wherever output resembles advice, not only in the terms. - **Never**: tell a specific user what they qualify for, draft a filing for submission without a human professional's review being recommended, select a legal strategy, predict an outcome with certainty, impersonate an attorney, or contact authorities on the user's behalf. - **Always**: show two scores separately where the law does (Merit's Kazarian step one and final merits), cite the actual authority (statute, regulation, policy manual section, case) and verify it exists, date every rule ("as of"), and offer a path to a licensed professional. - **Attorney users**: attorney work product and client confidences are P0; per-matter access control; no cross-client model training; export and deletion on matter close; audit logs suitable for ethics review. Advertising rules bar advocates in India from advertising; LegalOS must not generate marketing copy that breaches Bar Council Rule 36 for Indian lawyer users. - **Immigration filings are signed under penalty of perjury.** Nothing in Merit may encourage inflating a record. Evidence summaries must be traceable to uploaded source documents. Authorship of a book or article claimed as the petitioner's scholarly work must be substantially and documentably the petitioner's; AI-assisted drafting must be disclosed to the petitioner's counsel. (counsel) - **Colorado AI Act and similar**: legal services are a "consequential decision" category. Keep the human-decides design, an impact assessment on file, and the user notice. - **Cloud LLM exception** (Merit, LegalOS optional keys): redact identifiers locally before sending; provider no-training terms; the user is told which provider handles their documents; BYOK is honoured exactly (user's key, user's provider, nothing else). ## M4. Money: invoicing, billing, ledgers, and anything resembling finance Applies to: RM Bills, RM Cloud console meter, Dwell (rent, deposits, owner statements), Gulgul (delivery payments and ledgers), Tulip (fees, marketplace), CoParent (expense splitting), Rollout (Stripe, RevenueCat), Lakshmi (trading), Capital Hub (commerce), any Stripe or Razorpay integration. - **Never be a payment aggregator, money transmitter, or wallet.** Funds belonging to others flow through Stripe Connect, Razorpay Route, or an equivalent licensed product that settles to the beneficiary. We keep a ledger, we do not keep the money. - **Tax correctness is a product feature**: GST place-of-supply rules, HSN or SAC codes, reverse charge, export under LUT, TDS references, e-invoice IRN where mandated, US sales tax by state, UK and EU VAT. Denominators and totals must be verifiable; the RM Bills state-code bug (Karnataka instead of Andhra Pradesh) shows how one constant changes every invoice's legality. - **Books**: double-entry, immutable journal entries, audit trail of who changed what, numbered documents never reused, credit notes instead of edits. - **Trust and client money** (Dwell): property managers are required by most US states to keep tenant deposits and owner funds in separate trust accounts under a real-estate licence. Dwell is software for licensed managers; it does not manage properties itself and says so. - **Securities**: Lakshmi is an internal research engine. Exposing signals, scores, or "buy" language to anyone outside the company requires SEBI Research Analyst registration (or Investment Adviser registration for personalised advice), risk disclosures, and a ban on assured returns. In the US that would be the Investment Advisers Act and state rules. Until registered: internal only, no public URL without auth, no sharing of outputs. - **Lending, credit, and deposits**: none of our products may offer them; if a feature starts to look like one (pay later, deposits held, interest), stop and seek counsel. - **Fraud and AML**: Stripe and Razorpay carry KYC for us; we still watch for card testing, refund abuse, and sanctioned parties; keep evidence for chargebacks. - **Consumer disclosures**: all fees before commitment, no drip pricing, receipts for every charge, refunds policy, dispute contact. ## M5. Communications services and hosted user content Applies to: RM Mail, Nest (Connect), RM Meet, RM Drive, Folio, MyJanata, Rollout creator messaging, RM Music shared library, Writer and Writer-X, VSearch. - **Intermediary status**: in India we are an intermediary under the IT Act and the IT Rules 2021 (grievance officer, takedown timelines, 180-day record retention, published rules); in the US we rely on DMCA 512 and CDA 230 (and must report CSAM); in the UK the Online Safety Act applies to user-to-user services with UK links; in the EU the DSA. The baseline in [02 G](/playbook/02-universal-baseline) implements the common core. - **Email (RM Mail)**: authentication on every domain (SPF, DKIM, DMARC with a policy), one-click unsubscribe for any bulk mail our users send through us, complaint-rate monitoring, and the Gmail and Yahoo bulk-sender requirements (spam rate under 0.3%, aligned authentication, list-unsubscribe). AI triage reads message content: disclose it, let the user turn it off, run it locally, and keep the triage labels out of shared or cross-tenant channels. Hosting others' mail means lawful-access requests will arrive; have a law-enforcement request policy (verify jurisdiction, require legal process, notify the user unless prohibited, log everything). - **Recording and transcription (Meet)**: consent of all participants before recording or transcription starts, a visible indicator for the whole duration, a join-time notice when recording is already on, region-aware (two-party consent states in the US, UK IPA, India section 66E and 72 of the IT Act). Captions are processed locally; voiceprint identification is not built (BIPA). Recordings inherit the meeting's access list, have an owner, and a retention default. - **Encryption claims**: WebRTC is transport-encrypted (DTLS-SRTP) hop by hop; unless insertable streams with an end-to-end key exchange exist, the word "end-to-end" is banned. Same for chat and mail: "encrypted in transit and at rest" is the honest phrase. - **Host controls** are enforced server-side: only an authenticated host can mute, remove, lock, or end. Rooms are entities with owners and invite lists. Guest join is rate-limited, captcha-able, and never mints org-scoped tokens. - **Sharing and data rooms (Drive)**: per-viewer analytics (who opened what, when) is tracking; tell the viewer on the gate page, log the consent, and do not use tracking pixels in emails without consent for UK and EU recipients. Share links expire by default; public links are scannable for malware; uploads are content-hashed for CSAM and known-malware lists. - **Chat (Nest)**: agents that summarise or extract actions read message content; disclose in the channel, keep it tenant-scoped, let admins disable. - **Civic reports (MyJanata)**: reports can identify officials and third parties; defamation risk is the reporter's but we must have a complaint and takedown path; photos may include faces and number plates (blur by default when published); location precision reduced on public views; staff actions logged; government partners are controllers of the data they receive (contract it). - **Music library shared across users**: see M6; a shared pool is a public performance. - **Law-enforcement and legal requests**: one policy, one mailbox, a transparency log kept internally; Indian section 69 and 91 CrPC/BNSS requests, US subpoenas and warrants, UK IPA notices all handled through counsel. ## M6. Music, media, and copyright-heavy products Applies to: RM Music, Rollout, ContentMachine (videogen), Writer-X, Scribe media engine, AIBookly, Research. - **RM Music today** resolves and caches YouTube audio through yt-dlp and queries YouTube Music through the unofficial InnerTube client, then plays it to multiple Gate users from a shared pool with cached copies on disk. Each step is a problem: YouTube's Terms of Service forbid downloading, accessing content through unofficial means, and circumventing playback; caching audio is reproduction (Copyright Act 1957 section 14 and 51 in India, 17 U.S.C. 106 in the US, CDPA 1988 in the UK); playing to users beyond a household is communication to the public and needs performing-rights and sound-recording licences (IPRS, PPL India, Novex in India; ASCAP, BMI, SESAC, SoundExchange, The MLC in the US; PRS and PPL in the UK); lyrics need a lyrics licence. DMCA section 1201 anti-circumvention is the US criminal-adjacent risk. - **Rule**: RM Music stays a **private household tool with no public signup, no marketing, and no public URL without auth** until it is rebuilt on a licensed path (the official YouTube IFrame Player or YouTube Data API within their terms, Spotify or Apple Music SDKs with user subscriptions, or a licensed catalogue). It is not an RM product that can be shown to clients or listed anywhere. Cached audio is capped, short-lived, and never shared outside the box. No monetisation of any kind. - **Rollout** handles artists' unreleased masters and artwork: those are the artist's trade secrets and copyrights; per-artist access control, watermarked previews, signed URLs with short expiry, no AI training on assets, and a clear licence from the artist to us limited to providing the service. Streaming "AI Ask" retrieval must cite the source asset. Creator outreach is marketing email to individuals: PECR and CAN-SPAM rules, suppression list. - **Generated media** (ContentMachine, Scribe images, AIBookly covers): label as AI-generated (YouTube's altered-content disclosure, Meta's labels, India's synthetic-media rules); never clone a real person's voice or likeness without written consent (Tennessee ELVIS Act, right of publicity in most US states, India's personality-rights case law); check generated images for embedded third-party marks; music beds licensed. - **Books and articles** (AIBookly, Research, Scribe long-form): quotations within fair use or fair dealing limits and attributed; no reproduction of paywalled text; plagiarism check before publish; references verified to exist and to say what is claimed; AI disclosure where the distribution channel requires it (Amazon KDP requires disclosure of AI-generated content; most journals require disclosure of AI assistance and forbid AI authorship under ICMJE and COPE guidance; arXiv requires disclosure of significant AI use). Copyright in purely AI-generated text is doubtful in the US (Copyright Office 2025 report, Thaler); human authorship must be real and documented for anything we or a customer intends to own or cite. - **Platform automation**: posting through official APIs with approved apps only; X Automation Rules and LinkedIn API terms forbid unapproved automation and scraping; never automate likes, follows, or engagement; one customer's credentials never touch another customer's account (Scribe's single-token bug is a breach waiting to happen). ## M7. E-signature, evidence, and records Applies to: RM Sign, CoParent evidence exports, isdwell job cards, RM Bills, Drive data rooms, Dwell leases (via Documenso). - **Validity**: US (ESIGN, UETA: intent, consent, attribution, retention), UK (UK eIDAS: simple signatures valid; advanced requires unique link and sole control; qualified requires a QTSP), EU (eIDAS), India (IT Act: contract is valid; only Aadhaar eSign or a licensed DSC is an "electronic signature" with evidentiary presumption under BSA sections 85 to 89; excluded document classes in the First Schedule). - **Product duty**: say exactly what level the signature is in each region; for India offer Aadhaar eSign or DSC integration for documents where presumption matters, and show the exclusion list (wills, trusts, POAs, negotiable instruments other than cheques, sale deeds). - **ESIGN consumer consent** (US): before a consumer signs, disclose the right to paper, how to withdraw consent, hardware and software requirements, and obtain consent in a way that demonstrates access (the classic "click to confirm you can open this PDF"). - **Audit trail**: every event (created, sent, viewed, consented, signed, completed, declined) with UTC timestamp, IP, user agent, signer identity method, document hash before and after, and a tamper-evident chain; RFC 3161 timestamps and PAdES-LTV sealing on the final PDF. Completion certificates are signed by a key we control and rotate on schedule; keep the verification page public. - **Evidence exports** (CoParent, isdwell): BSA section 63 certificate template for India, FRE 902(13)/(14) certification for US federal courts, Civil Evidence Act 1995 for England and Wales. Certificates are produced for a named human custodian to sign; the product never "machine-signs" a sworn statement. Chain-of-custody fields: hash, source system, export time, exporter identity. - **Retention**: signed documents retained for the period the parties choose (default 7 years, never less than the limitation period of the governing law), exportable by every party, deleted on request after the period with a record of deletion. - **Identity of signers**: email link plus a second factor where the document value warrants (SMS OTP, knowledge question, ID check); log the method. External signers are data subjects too: notice on the signing page, minimal data, deletion after completion plus retention period. ## M8. Recruitment, employment, and autonomous applying Applies to: Digitailor (Reach), TalentSignal and Merit's employer network, Planet's hiring workflows, Atlas if it ever tracks people. - **Acting for the candidate**: the user authorises each application (or a clearly scoped batch), sees exactly what will be submitted, and can stop. Every answer on an application is the user's own or derived from the user's verified profile; the agent never guesses protected-class self-identification (race, gender, disability, veteran status), work authorisation, criminal history, salary history, or legal name. "Legal name is its own question" stays a test. - **Work authorisation and visa facts**: never misstate; H-1B sponsorship claims about a specific employer come only from the DOL LCA disclosure data with the date and case number shown; the H-1B claim rule forbids per-role assertions. - **Platform terms**: apply only through channels that permit it (employer career sites and ATS forms are generally fine when acting as the candidate's agent with the candidate's credentials and consent; LinkedIn's user agreement prohibits automation and scraping; Indeed, Glassdoor, and most boards prohibit bots). Keep a written per-channel risk acceptance. Rate-limit like a human; honour robots and captchas; never bypass bot detection with deception (the SmartRecruiters detection episode is a signal to stop, not to evade). - **Running on the user's device** (decided for Digitailor) keeps the user as the party accessing sites and keeps resumes off our servers; do not quietly move execution back to our servers. - **Data**: resumes, immigration status, and EEO answers are P0 (CPRA names citizenship and immigration status as sensitive PI; Virginia, Colorado, Connecticut require opt-in consent for sensitive data processing); Gmail or Outlook inbox access for receipt verification uses restricted OAuth scopes, which triggers Google's restricted-scope verification and annual CASA security assessment and the Limited Use policy (data only to provide the user-facing feature, no humans reading, no ads, no transfer). Budget for the assessment before launch, or use a forwarding-address design instead. - **Employer side** (future): automated screening or ranking is a high-risk AI use (NYC Local Law 144 bias audits, Illinois AI in employment law, Colorado AI Act, EU AI Act Annex III). Do not build scoring of candidates for employers without the governance in place. - **Anti-discrimination**: Title VII, ADEA, ADA, state laws; the UK Equality Act; India's constitutional and statutory protections. Filtering jobs for a user by their preferences is fine; filtering candidates for employers by protected traits is not. - **Communications to recruiters or employers on the user's behalf**: sent from the user's identity with the user's consent, truthful, no spam patterns, CAN-SPAM still applies to commercial content. ## M9. Hosting and cloud (RM Cloud) Applies to: RM Cloud, the RM Cloud console, per-client VMs, any "we host it for you" arrangement including per-station isdwell instances. - **CERT-In Directions**: as a cloud and VPS provider we must keep validated customer names, addresses, contact numbers, emails, ownership pattern, purpose of hire, and IP allocations for **5 years** after cancellation; keep logs 180 days in India; report incidents within 6 hours; sync clocks to NIC or NPL. - **DPDP processor role**: a DPA with every client that stores personal data on our infrastructure; we process only on instructions; we notify the client of breaches without delay so the client can meet its own clocks; sub-processor list; return or delete on exit. - **Contract essentials**: SLA with a defined measurement (and credits, not promises), maintenance windows, backup scope and RPO/RTO, data location (India), support hours, acceptable-use policy (no illegal content, no spam, no crypto-mining without agreement, no sanctioned parties), suspension and termination, liability cap, and a law-enforcement request clause. - **Operations the contract depends on**: tenant isolation (VM or LXC per client, no shared databases across clients), encrypted backups with an off-site copy and tested restores, capacity and uptime monitoring with a status page, physical security and power (UPS, failover uplink), change management, vulnerability patching SLAs, and a documented incident process. - **Honest marketing**: no uptime percentages that are not measured; no "enterprise-grade" without the evidence; do not describe the physical setup in client-facing copy beyond what is true and necessary. - **Billing**: metered usage feeds RM Bills; invoices carry GST; clients outside India are exports under LUT. - **Acceptable use and abuse**: an abuse mailbox, takedown handling for hosted sites, and cooperation with Cloudflare's abuse process. ## M10. Social publishing and marketing automation Applies to: Scribe, Writer-X, Planet outreach, ContentMachine, Rollout campaign tools, Folio reminders. - **Disclosure**: paid partnerships and material connections disclosed in the post (FTC Endorsement Guides, ASCI Influencer Guidelines, CAP Code); AI-generated content labelled where the platform or law requires; never generate reviews, testimonials, or endorsements about a customer's product from fictional people (FTC fake-reviews rule). - **Platform terms**: official APIs, approved apps, scopes limited to what the feature needs; no purchased engagement; no automated DMs at scale; respect per-platform automation rules and rate limits; tokens encrypted per customer, revocable, never shared between tenants. - **Ghostwriting**: a customer publishing AI-assisted posts under their name is lawful; the customer approves every post (practice mode exists for a reason) and can see the audit trail. - **Email outreach** (Planet): B2B cold email to a named person is still personal data processing; lawful basis is legitimate interest in the UK and EU with an easy opt-out and the PECR corporate-subscriber rule in mind; CAN-SPAM in the US; CASL consent in Canada; suppression list enforced at the send path; no scraped lists from LinkedIn; sending identity is the customer's domain, not rmmail.in. - **Claims in generated copy**: the generator must not invent statistics, awards, customer names, or comparisons; the template bans superlatives without a source; health, finance, and legal claims are routed to the domain modules. - **Scheduling across time zones** respects quiet hours where SMS is involved (TCPA 8 am to 9 pm local). ## M11. Consumer subscriptions and apps in the stores Applies to: Scribe, AIBookly, Digitailor, Rollout, Folio, Nimitra, RM Health mobile, RM Music mobile (private), Authenticator PWA. - **Before the button**: price, currency, tax treatment, period, renewal, trial length and what happens at its end, how to cancel, refund policy. The same facts in the confirmation email. - **Cancel**: online, in-app, in no more steps than signup, with immediate confirmation; no retention offers that block the path; UK and EU 14-day cancellation right with waiver for instant access; California ARL reminders for annual plans and any price change. - **Store rules**: Apple App Store Review Guidelines 3.1.1 and Google Play Billing for in-app digital purchases; account deletion inside the app (Apple 5.1.1(v), Google Play policy); privacy nutrition labels and Data Safety forms must match the code exactly (they are enforced as representations); third-party SDK disclosures; login with Apple if other social logins exist; no misleading screenshots. - **Free tiers** and "practice mode" must not silently expire into charges. - **Receipts** carry the legal entity name, GST or VAT details, and support contact. ## M12. Astrology, entertainment, and belief-based products (Nimitra) - **India**: Consumer Protection Act 2019 section 2(47) misleading advertisement, CCPA penalties; Drugs and Magic Remedies Act section 3 (no remedies for diseases, no "magic" claims); state anti-superstition laws (Maharashtra 2013, Karnataka 2017) target exploitative practices, especially remedies sold under threat; never upsell remedies for doshas, never predict death, disease, fertility, or marriage vetoes (already `SUPPRESSED` safety classes). - **US**: several states and cities criminalise fortune telling for a fee unless offered as entertainment (New York Penal Law 165.35 is the model); US-facing copy and terms state "for entertainment and reflective purposes" prominently. - **UK**: Consumer Protection from Unfair Trading Regulations 2008 Schedule 1 bans falsely claiming a product can cure illness or win games of chance, and the CAP Code restricts psychic and astrology ads to entertainment; the DMCC Act 2024 carries the banned practices forward. - **Data**: birth date, time, place are P1; religion and caste inferred or entered are special category (UK GDPR Article 9) and sensitive in practice in India: collect only with explicit consent and only for the feature; matching features never rank by caste. - **AI**: the model never performs astrology (deterministic rule engine fires; the model writes prose; a verifier strips claims without a rule id); persona is AI-forward and never pretends to be a human acharya; human review is a labelled premium tier. - **Minors**: charts for children may be generated for a parent; no direct service to under-18s; no predictions about a child's health or lifespan. - **Payments**: Razorpay in India, Stripe elsewhere; refunds policy for digital readings; no "urgent remedy" upsells. ## M13. Research, academic, and publishing tools Applies to: Research (autonomous paper pipeline), research-papers viewer, VSearch (manuscript integrity), Plume, ENTROPIA-VDI, AIBookly. - **Research integrity**: AI cannot be an author (ICMJE, COPE, Nature, Elsevier, IEEE policies); AI assistance is disclosed in the methods or acknowledgements; every reference verified to exist and to support the claim (DOI resolution, not model memory); figures are not AI-generated unless the venue allows and it is disclosed; data availability statements are true. - **Plagiarism and text reuse**: similarity check before any submission; self-plagiarism rules; quotations attributed. - **Human subjects**: any study involving people (Reach study papers, RM Health pilot data) needs informed consent, an ethics review where the venue or law requires it, and de-identification; health-pilot data from two users is identifiable by definition and stays out of publications without consent. - **Confidential manuscripts** (VSearch): author content is confidential and copyrighted; retention limited to the review; no training; access by role. - **Cloud LLM exception** (Research): anonymise where possible; no unpublished third-party data sent to providers; provider terms honoured. - **Claims about our own research** in marketing follow the same substantiation rule as everything else. ## M14. Government, defence, and public-sector deployments Applies to: isdwell (MES, GE(Maint) Ezhimala pilot), MyJanata with municipal partners, BuilderStudio (CPWD, NHAI contractors), Tulip in government schools. - **Security audit**: a CERT-In empanelled auditor's certificate before go-live on any government-facing deployment; STQC or equivalent for NIC-hosted systems; annual re-audit. - **GIGW 3.0** accessibility and usability guidelines, bilingual interface (Hindi and English) for central government under the Official Languages Act, state languages for state bodies. - **Official Secrets Act 1923 and MoD rules**: establishment charts, quarter layouts, and personnel counts of defence stations can be restricted information. Keep them out of public repositories, out of cloud LLM prompts, and out of demo data that leaves the box; per-station on-premise deployment is the default for defence; transit through our servers only with written authorisation. - **Zero-PII design** (isdwell) is a compliance asset: fob identity is the unit, not the person; keep it that way; no names, phones, or emails added later "for convenience". - **Procurement**: GeM registration, Udyam (MSME) and DPIIT startup recognition for tender relaxations, Make in India local-content declarations, security and source-code escrow clauses read before signing, no gifts or facilitation payments (Prevention of Corruption Act; FCPA if a US party is ever involved; UK Bribery Act for UK-linked work). - **RTI and records**: data held for a public authority may be subject to Right to Information requests made to that authority; design exports accordingly. - **Contracts**: the public body is the Data Fiduciary; we are the processor; data residency in India; exit and handover clauses; no vendor lock-in claims. ## M15. Housing and property (Dwell, isdwell residents) - **Fair housing (US)**: the Fair Housing Act bars discrimination on race, colour, religion, sex, familial status, national origin, disability; HUD's guidance on tenant screening and advertising algorithms applies to any AI that ranks applicants or targets ads; state and local laws add source of income, age, sexual orientation, criminal history limits (fair-chance housing ordinances). Dwell's screening uses a licensed CRA (TransUnion SmartMove): the landlord is the end user, permissible purpose is the landlord's, adverse-action notices go to the applicant with the CRA's contact; Dwell never assembles or scores consumer reports itself. - **Algorithmic rent setting** across landlords is under antitrust attack (RealPage litigation, local bans): no cross-landlord pricing recommendations. - **Deposits, late fees, notices, lease terms** are state-specific; templates carry jurisdiction fields and a "review with local counsel" note; lead-based paint and other mandatory disclosures are in the lease builder by state. - **Resident communications**: TCPA consent for texts; maintenance notifications transactional; marketing separate. - **Accessibility**: resident portals meet WCAG; reasonable-accommodation requests tracked. - **India (isdwell)**: residents are identified by quarter, never by person; job cards follow the MES paper format; no tenant scoring. ## M16. Identity, authentication, and secrets products (Gate, Authenticator, Wallet, Card) - Gate is the identity provider for everything: it carries the highest blast radius. OIDC conformance, key rotation with JWKS overlap, per-client TTLs, consent screens listing scopes, admin MFA, audit logs of every token issuance and revocation, tenant (org) isolation, and a published security page. - Authenticator stores TOTP seeds on the user's device: encrypted at rest with a device-bound key, export only with re-authentication, no cloud sync without end-to-end encryption that is real, and no analytics. - Wallet (secrets vault) is a P0 system: envelope encryption, per-secret access policies, reveal events logged and alertable, no secret values in logs or search indexes, break-glass with two-person rule, and a threat model document before any customer uses it. - Card (identity layer, vCard) publishes personal data at the user's request: per-field visibility, unpublish instantly, no indexing unless opted in.