Data ethics acceptable use for recruiting outreach (boundaries, do/don’t, provenance)

Last updated: August 30, 2026

By Ben Argeband, Founder & CEO of Heartbeat.ai — Concrete do/don’t examples; no moralizing.

Who this is for

This is for recruiters and recruiting ops leaders who need clear boundaries for outreach that protect deliverability, brand, and candidate relationships without slowing down the pipeline. If you need something to hand to leadership, compliance, or procurement, this is written to be operational and auditable rather than aspirational.

One non-negotiable: you own compliance. Tools can help you execute, but they can’t own your policies, training, or judgment calls.

Quick Answer

Core Answer

Use contact data only for relevant recruiting outreach, with clear identity context, limited retention, an easy opt-out, and strict opt-out enforcement via a suppression list.

Key Insight

Ethical outreach is operational: provenance, relevance, frequency caps, and opt-out enforcement matter more than which channel you use.

Best For

Recruiters and ops teams that want clear, enforceable boundaries

Compliance & Safety

This method is for legitimate recruiting outreach only. Always respect candidate privacy, opt-out requests, and local data laws. Heartbeat does not provide medical advice or legal counsel.

Acceptable use in 6 rules

• Be relevant: only contact people who plausibly match the role (specialty, setting, location, seniority).
• Be transparent: say who you are, why you’re reaching out, and what the next step is.
• Be restrained: use frequency caps and stop rules; don’t pile on across channels.
• Make it easy to stop: every message includes an easy opt-out.
• Honor opt-outs everywhere: centralize and enforce via a suppression list across all tools and channels.
• No patient data: recruiting outreach never uses or implies access to patient information.

Framework: the “don’t be a creep” standard

Teams lose real productivity when a campaign gets flagged, blocked, or called out publicly. Before any outreach goes out, run it through a fast filter:

• Respect: treat the person like a professional, not a lead. No pressure, no guilt trips.
• Relevance: the message should make sense given their specialty, licensure, geography, and career stage.
• Transparency: say who you are and why you’re reaching out.
• Control: give a clear easy opt-out and honor it immediately across channels.
• Restraint: frequency caps and quiet hours. If you wouldn’t want it done to you on personal time, don’t do it to them.
• Separation: recruiting outreach is not patient outreach — no patient data, no clinical context, no insinuations.

What acceptable use is not

• Not permission to spam — volume doesn’t replace relevance.
• Not a reason to ignore gatekeepers or keep pushing after a “no.”
• Not patient outreach — don’t reference care events, cases, or anything implying clinical surveillance.

Training examples:

• Acceptable: “Dr. Patel — I recruit hospitalists in the Midwest. Are you open to hearing about a 7-on/7-off role in Dayton? If not, reply ‘no’ and I’ll stop.”
• Not acceptable: “I saw you treated a patient at X hospital…”
• Acceptable: one follow-up after no response, then stop or switch to a single lower-friction touch.
• Not acceptable: calling, texting, emailing, and messaging the same day with escalating language.

Do / don’t (fast reference)

• Do lead with relevance: role, location, and why them. Don’t send generic blasts that force the candidate to guess.
• Do identify yourself and your organization. Don’t use deceptive subject lines or fake familiarity.
• Do include an easy opt-out in every channel. Don’t bury opt-out language.
• Do treat any “stop/remove/unsubscribe” as an opt-out and enforce it via a suppression list. Don’t rely on individual recruiters to remember.
• Do set frequency caps and stop rules per role. Don’t pile on across channels within 24–48 hours.
• Do keep content strictly recruiting-related. Don’t reference patient care or anything implying clinical tracking.

Step-by-step method

Step 1: write a one-page acceptable-use SOP your team will actually follow

Keep it short and enforceable. It should answer:

• Purpose: “We use contact data to communicate about employment opportunities and career conversations.”
• In-scope audience: who you recruit and what “relevant” means for your org.
• Allowed channels: email, phone, SMS, voicemail, professional social — and who can use each.
• Frequency caps: max attempts per person per role, plus quiet hours.
• Stop rules: when to stop after no response, and when to stop immediately.
• Opt-out enforcement: how opt-outs are captured and applied via a suppression list.

Stop-rule examples

• Immediate stop: any opt-out language (“stop,” “remove,” “unsubscribe,” “don’t contact”).
• Immediate stop: any explicit negative response.
• Stop and correct: wrong person, specialty, or location — fix targeting, don’t keep trying.
• Stop and route: a gatekeeper requests a different channel — follow it once, then stop if declined.
• Stop after cap: no response after your defined attempt limit for that role.

Step 2: separate identity sources from contact channels (provenance)

Procurement and compliance teams rarely just want “where did you get the data.” They want structure: what establishes identity, what enables contact, and what transformations you apply in between.

Provenance one-pager outline:

• Identity sources: what establishes professional identity (name, specialty, license/NPI context).
• Contact channels: email/phone/SMS endpoints used for outreach — acknowledge these decay over time.
• Transformations applied: verification, refresh, deduping, and suppression enforcement, described at a high level.
• Refresh reality: how often you re-check contactability and remove bad endpoints.
• Suppression governance: where the suppression list lives, who owns it, and how it propagates to tools.
• Audit artifacts: opt-out logs, campaign settings, template versions.

This structure lets you answer due-diligence questions without exposing sensitive sourcing details.

What to say if asked “where did you get my info?”

• Identity context: “We recruit in [specialty/region] and use professional registries to confirm identity and credentials.”
• Contact channel: “We use business contact channels to reach out about roles.”
• Control: “If you’d like, I can remove you from outreach — just reply ‘stop’ and I’ll add you to our suppression list.”

Step 3: build opt-out and suppression into the workflow

• Every outbound email includes an easy opt-out instruction.
• Every SMS includes a clear stop instruction, and you honor it.
• Any opt-out request updates your suppression list and applies across all sequences and tools.
• Ops audits suppression enforcement weekly with spot checks across campaigns.

For mechanics and failure modes, see suppression lists and opt-out management for recruiting ops.

Step 4: set channel rules that protect deliverability and reputation

• Email: role-relevant messaging, no deceptive subject lines, stop after a small number of attempts.
• Phone: call during reasonable local hours, leave one short voicemail, don’t hammer the same number.
• SMS: use sparingly and only where policy supports it, include stop language, avoid long multi-part texts.

Being aggressive can buy a few extra touches short term, but you pay for it in blocks, complaints, and brand damage that slows hiring down the road.

Step 5: track metrics that show you’re staying within bounds

You don’t manage ethics with vibes — you manage it with controls and audits. A small, consistent set of metrics tells you whether outreach is respectful and effective:

• Connect Rate = connected calls / total dials.
• Answer Rate = human answers / connected calls.
• Deliverability Rate = delivered emails / sent emails.
• Bounce Rate = bounced emails / sent emails.
• Reply Rate = replies / delivered emails.

Diagnostic table

Use this to check whether your outreach program is operating inside acceptable use.

Weighted checklist

Score each campaign before launch. Under 80 points, fix it before you hit send.

• (25 points) Relevance is explicit: specialty/role + location + why them.
• (20 points) Opt-out is clear and simple across email and SMS, and routes into a centralized suppression list.
• (15 points) Frequency caps are set per person and per role, and enforced in tooling.
• (10 points) A provenance one-pager exists: identity sources vs contact channels vs transformations.
• (10 points) No sensitive content — no patient data, no clinical event references, no insinuations.
• (10 points) Sender transparency: real name, company, and a direct reply path.
• (10 points) A metrics plan exists with thresholds and stop rules.

Outreach templates

These are intentionally plain. They’re built to be respectful, relevant, and easy to stop. Replace bracketed fields and keep your frequency cap consistent with your SOP.

Email template (initial)

Subject: Quick question about your next role

Hi Dr. [Last Name] — I’m [Name], a recruiter with [Org]. I’m reaching out because we’re hiring a [Role/Specialty] in [City/Region] and your background in [relevant signal] looks aligned.

Are you open to a 5-minute call this week to see if it’s worth a longer conversation? If not, reply “no” and I’ll stop reaching out.

Follow-up rule: if I don’t hear back, I’ll only follow up up to [YOUR CAP] times for this role.

— [Name], [Title], [Org] | [Phone] | [Email]

SMS template (only where policy supports it)

Hi Dr. [Last Name] — [Name] recruiting for [Org]. Are you open to hearing about a [Role] in [Location]? Reply STOP to opt out.

Follow-up rule: if no response, I’ll stop after [YOUR CAP] attempts for this role.

Voicemail template

Hi Dr. [Last Name], this is [Name] with [Org]. I’m calling about a [Role] opportunity in [Location]. If you’re open to a quick chat, call me back at [Number]. If not interested, no problem.

Common pitfalls

• Assuming a list equals permission. Static purchased lists decay quickly. The more defensible standard combines access, refresh, verification, and suppression.
• Opt-out that doesn’t actually stop outreach. If someone opts out and still gets contacted, you’ve proven you can’t be trusted.
• Over-contacting across channels. Multi-channel is fine; pile-on isn’t. Set caps and stop rules.
• Using sensitive context. Even material that seems public shouldn’t reference patient care, cases, or anything implying clinical tracking.
• Confusing identity with contactability. A stable identifier, like a registry record, doesn’t mean the email or phone number you found is current or appropriate for outreach.
• Policy without enforcement. If ops can’t audit it, it’s not a policy — it’s a hope.

How to improve results

Ethical outreach should also perform. When it doesn’t, teams tend to compensate with more volume and more pressure. Improve performance by tightening relevance and channel hygiene, not by escalating persistence.

1) Fix targeting before you fix copy

Every outreach list needs a clear inclusion rule: specialty, geography, setting, seniority. If you can’t explain why a person is on the list in one sentence, recruiters will compensate with volume.

2) Reduce wasted touches with verification and ranking

Cutting down wrong numbers and dead inboxes reduces the temptation to over-contact. Heartbeat.ai supports workflows built around ranked mobile numbers by answer probability, so recruiters start with the most connectable path instead of brute force.

3) Run a weekly outreach health review

• Email: Deliverability Rate, Bounce Rate, and Reply Rate, tracked by campaign and sender domain.
• Phone: Connect Rate and Answer Rate, tracked by time-of-day and list category.
• Opt-out enforcement: confirm requests land in the centralized suppression list the same business day, and spot-check opted-out records against active sequences and dialer queues.
• Complaint signals: track spam complaints, negative replies, and “stop contacting me” messages. A spike triggers a template and targeting review.

4) Tighten stop rules

Define a maximum number of attempts per person per role, and a cool-down period before any future outreach. This protects your brand and keeps recruiters focused on reachable, relevant candidates.

Legal and ethical use

This page covers acceptable-use boundaries and operational controls; consult your counsel for jurisdiction-specific requirements. For a broader view of recruiting compliance topics, start with recruiting compliance resources.

Your obligations depend on jurisdiction, channel, and your organization’s own policies. At minimum, build your program to respect:

• TCPA: especially relevant for calling and texting practices and consent requirements — treat SMS as higher-risk than email and govern it accordingly.
• CAN-SPAM: accurate sender information, no deceptive subject lines, and a clear opt-out mechanism for commercial email.
• Opt-out: if someone opts out in any channel, honor it across all channels using a centralized suppression list.
• No patient data: recruiting outreach should never involve patient information or imply access to it.

For clarity on what we do and don’t handle, see: Not HIPAA: no patient data.

Evidence and trust notes

When referencing professional identity context, we anchor to authoritative registries and licensing bodies. These sources help establish identity and credentials; they don’t guarantee contactability.

• NPPES NPI Registry (identity and NPI context)
• CMS: National Provider Identifier (NPI) overview
• Federation of State Medical Boards (FSMB) (licensure context)

Channel rules are governed by laws and guidance that vary by jurisdiction and use case. For primary references, start with official sources:

• FTC: CAN-SPAM Act compliance guide
• FCC: Telemarketing and robocalls (TCPA-related overview)

How Heartbeat evaluates and communicates trust: Trust methodology.

FAQs

What does acceptable use mean for recruiting contact data?

It means using contact data for relevant recruiting outreach with transparency, reasonable frequency, and a clear opt-out, enforced through a centralized suppression process.

What counts as an opt-out?

Any message that reasonably indicates “stop” — “remove me,” “don’t contact,” “unsubscribe,” “STOP.” Treat it as immediate and apply it across channels via your suppression list.

Can I contact clinicians by text?

SMS can be higher-risk than email. If your organization allows it, keep it minimal, identify yourself, include STOP language, and honor opt-outs immediately. Align your process with policies reviewed for TCPA considerations.

How fast should opt-outs be applied?

Same business day is the operational standard so you don’t re-contact someone who already told you to stop. Make it automatic via a centralized suppression list, not dependent on individual recruiters remembering.

Is it acceptable to call a clinician’s workplace line?

It can be, when the outreach is relevant and respectful and you follow your stop rules. Expect gatekeepers, keep the message short, and don’t keep calling once you’re told to stop or route elsewhere. If the clinician opts out directly or through their office, capture it and enforce it via your suppression list.

What should I say if a candidate asks where I got their information?

Keep it factual and brief: you recruit in their specialty and region, you use professional identity context to confirm you’re contacting the right person, and you use business contact channels for outreach. Offer an easy opt-out and enforce it via your suppression list.

How do I keep outreach ethical without killing speed?

Make relevance and suppression automatic: tight targeting rules, short templates, frequency caps, and centralized opt-out enforcement. That reduces wasted touches and keeps recruiters focused on reachable candidates.

Next steps

• Operationalize opt-outs: implement or fix your suppression list and opt-out management workflow.
• Standardize templates and guardrails: pull from recruiting templates and scripts, and enforce relevance and stop rules.
• Document trust: align your internal policy with the Heartbeat trust methodology so ops can audit it.
• If you want verification, refresh, and suppression handled in one workflow, create a Heartbeat account.

About the Author

Ben Argeband is the Founder and CEO of Swordfish.ai and Heartbeat.ai. With deep expertise in data and SaaS, he has built two successful platforms trusted by over 50,000 sales and recruitment professionals. Ben’s mission is to help teams find direct contact information for hard-to-reach professionals and decision-makers, providing the shortest route to their next win. Connect with Ben on LinkedIn.