Medals are only intended for games, unless you've received special permission for medals in a movie.
Medals are not allowed in Adult rated content, with the exception of a few rare cases such as the Street Fighter Collab.
Remember to put a proper points value to the medals, depending on their difficulty and/or effort needed for obtaining them. For example don't award 100 point medals for doing easy tasks in the game. Moderators may consider this "medal spam" and take action. The maximum point value per project is 500 medals, with a few special exceptions.
Be sure to test your medals, preferably before publishing your game. Broken medals will be removed by moderators.
If your medals stop working at some point for whatever reason, you will generally be given one month to fix them before they are removed by a moderator.
Secret medals do not mean that users cannot see that they exist. It is only the fact that the players cannot see their description.
Medals can never be awarded for anything that requires in-game payments.
If your game utilizes save data, consider saving unlocked medals to the save data as well. This way you can give users the option to re-send / re-sync their medals with NG, in the off chance that something goes wrong at the moment they earn the medal (e.g. NG has a server hiccup during their game session).