Get the app

Cloud Services Agreement

Last updated

On this page 21 sections

PostureCo may update this document at any time without prior notice. The date above shows when it was last updated, so please check back from time to time.

POSTURECO CLOUD SERVICES AGREEMENT(Formerly Known as "SyncScreen")

LAST UPDATED: October 21, 2026

IMPORTANT NOTICE REGARDING CHANGES

PostureCo, Inc. reserves the right to modify, update, revise, or replace this Agreement at any time, in its sole discretion, without prior notice. Any changes are effective immediately upon posting. Your continued use of the Cloud Services constitutes acceptance of the revised Agreement.

1. PARTIES AND ACCEPTANCE#

This PostureCo Cloud Services Agreement ("Agreement") governs your purchase, access to, and use of PostureCo Cloud Services.

"PostureCo Cloud Services" (the "Cloud Services") means the optional, subscription-based cloud services that PostureCo offers, which were formerly branded as SyncScreen, including:

  • Cloud storage, backup, and synchronization within the PostureScreen® software application;
  • The PostureCo Cloud web portal, as and when PostureCo makes it available to your plan;
  • RemoteScreen®, through which clients or patients you invite can submit identifying details, posture photos, movement videos, and other information to your Cloud Services account from a web browser or app, including, where available, through the AI-Guided Health History; and
  • Any related cloud features, updates, and successor services that PostureCo makes available under this Agreement.

"Software" means the PostureScreen® software application and any other PostureCo application, website, or web interface through which you or your clients or patients access or use the Cloud Services, including the PostureCo Cloud web portal and RemoteScreen.

PostureScribe.AI® is governed by the PostureScribe.AI® User Agreement, Indemnification, and Terms of Service (the "PostureScribe.AI User Agreement"), available at https://www.postureanalysis.com/legal/posturescribe-ai-agreement/. This Agreement also applies to any PostureScribe.AI data that is stored in, backed up to, or synchronized through the Cloud Services.

PostureRay® on PostureCo Cloud requires a separate PostureRay® subscription and is also governed by PostureRay's own Product-Specific Terms (as defined in the Terms of Service). This Agreement applies to PostureRay data stored in the Cloud Services in addition to those terms. If they conflict as to PostureRay, PostureRay's own terms control.

The Cloud Services are owned and operated by PostureCo, Inc., a Florida corporation ("PostureCo," "we," "us," or "our").

BY CLICKING TO ACCEPT THIS AGREEMENT, BY SIGNING IT ELECTRONICALLY WHERE POSTURECO REQUIRES A SIGNATURE, OR BY PURCHASING, REGISTERING FOR, ACCESSING, OR USING THE CLOUD SERVICES, YOU AGREE TO BE LEGALLY BOUND BY THIS AGREEMENT AND BY THE TERMS OF SERVICE AND PRIVACY POLICY THAT IT INCORPORATES BY REFERENCE (SECTION 2), AND YOU ACKNOWLEDGE POSTURECO'S HIPAA COMPLIANCE STATEMENT. IF YOU DO NOT AGREE, DO NOT USE THE CLOUD SERVICES.

Your acceptance by purchasing, registering for, accessing, or using the Cloud Services applies by default, even where no click-through or signature is presented to you. PostureCo may also require you to accept this Agreement expressly at any time, by a click-through (a checkbox or button) when you sign up for the Cloud Services, when you log in to the PostureCo Cloud web portal or the Software, or after an update or release of the Software, and, where PostureCo requires it, by an electronic signature. Express acceptance is in addition to acceptance by use, and its absence does not mean that you have not accepted; if you decline it, you must stop using the Cloud Services, and PostureCo may restrict your access until you accept. Electronic acceptance has the same effect as a handwritten signature, and PostureCo may keep records of acceptances as evidence of them, as Section 1 of the Terms of Service describes.

You represent and warrant that you are at least eighteen (18) years of age and that you have the legal authority to bind yourself or the entity on whose behalf you are using the Cloud Services. If you accept this Agreement on behalf of an entity, "you" includes that entity.

Clients or patients who use RemoteScreen only to send information to you at your invitation are not PostureCo's customers and are not parties to this Agreement. The RemoteScreen® Patient App Privacy Policy (Section 7.5) describes how PostureCo handles the information they submit, and Section 4 (Prohibited Uses) of the Terms of Service and PostureCo's intellectual-property rights still apply to their use of RemoteScreen. As between you and PostureCo, you are responsible for inviting them and for the information they submit to your account, as Sections 6 and 7.5 describe.

2. RELATIONSHIP TO OTHER AGREEMENTS#

This Agreement supplements and incorporates by reference PostureCo's Terms of Service and End User License Agreement (the "Terms of Service"), available at https://www.postureanalysis.com/legal/terms-of-service/, and PostureCo's Privacy Policy, available at https://www.postureanalysis.com/privacy-policy/. Capitalized terms used but not defined in this Agreement have the meanings given to them in the Terms of Service. Sections 8 and 9 of the Terms of Service, which address HIPAA and Business Associate Agreements for all of PostureCo's Services, apply to the Cloud Services together with Section 7 of this Agreement.

PostureCo's HIPAA Compliance Statement, available at https://www.postureanalysis.com/legal/hipaa-compliance-statement/, and the RemoteScreen® Patient App Privacy Policy, available at https://www.postureanalysis.com/legal/remotescreen-patient-privacy-policy/, are notices that describe PostureCo's practices. They are not contracts, do not create warranties, and do not amend this Agreement, the Terms of Service, or any Executed BAA (Section 7.2).

In the event of a conflict between this Agreement and any other PostureCo agreement, this Agreement shall control solely with respect to the Cloud Services, except that: (a) an Executed BAA controls as to PHI, as Section 7.4 provides; (b) a data processing agreement executed under Section 8.3, and the Standard Contractual Clauses where Section 8.4 makes them apply, control as to the personal data they cover; (c) subject to clauses (a) and (b), the PostureScribe.AI User Agreement controls as to the PostureScribe.AI features themselves, and its Section 6 (Third-Party AI Provider Terms) controls as to the RemoteScreen AI-Guided Health History, as Section 4.4 provides; (d) PostureRay's own terms control as to PostureRay, as Section 1 provides; and (e) Section 2.2 of the Terms of Service (Apple App Store terms) controls as to a PostureCo app obtained from the Apple App Store, as Sections 1.1 and 2.2 of the Terms of Service provide. Provisions that address the same subject without directly conflicting apply together. Subject to clauses (a) and (b), a provision of the Terms of Service that gives PostureCo greater protection, such as a broader disclaimer, limitation of liability, or indemnity, does not conflict with this Agreement and applies to the Cloud Services.

3. OPTIONAL NATURE OF CLOUD SERVICES#

The Cloud Services are optional and are not required to use PostureScreen® or its other local features. Some features, including RemoteScreen and the PostureCo Cloud web portal, are available only with an active Cloud Services subscription, and features, limits, and availability vary by plan and by location. For example, the RemoteScreen AI-Guided Health History is available in the USA only at this time and only with a Cloud Services Platinum plan or higher, and using it from outside the United States is prohibited (Section 7.5), while RemoteScreen posture photo and movement video uploads are available worldwide on every Cloud Services plan. PostureCo may change its plans, features, limits, and availability at any time.

The Cloud Services are provided as a convenience only and do not constitute a complete, fail-safe, or exclusive data backup solution. You acknowledge that you remain solely responsible for maintaining independent and redundant backups of your data, using only backup methods that meet your legal obligations (Section 10).

4. SERVICE DESCRIPTION, HOSTING, AND REGIONS#

4.1 AMAZON WEB SERVICES; REGIONAL HOSTING; YOU CHOOSE YOUR REGION. The storage, backup, and synchronization infrastructure of the Cloud Services runs on Amazon Web Services ("AWS"), under a signed Business Associate Addendum between PostureCo and AWS. Cloud Services data, including PHI, is stored and processed in AWS services that AWS designates as HIPAA-eligible; information sent to an AI provider for the artificial intelligence features described in Section 4.4 is processed by that provider under its own Business Associate Agreement with PostureCo (Section 6 of the PostureScribe.AI User Agreement). PostureCo operates no data centers of its own. AWS provides the physical and environmental security of its data centers, which are covered by AWS's own independent attestations, such as SOC and ISO reports.

PostureCo uses regional AWS infrastructure. During setup, you choose, directly in the Software, the location (AWS region) where your Cloud Services data is stored, from the regions that PostureCo offers at the time (for example, the United States, Europe, or Asia, where offered). PostureCo stores your Cloud Services data in the region you select and relies on your selection. If the Software does not offer you a choice, or you do not make one, your Cloud Services data is stored in the United States. PostureCo does not promise that any particular region, or a region in or for every country, is or will remain available, or that storage in any region satisfies any data-residency or data-localization requirement that applies to you, and PostureCo may add, change, or retire regions. PostureCo may move Cloud Services data out of the region where it is stored if that region becomes unavailable or is retired, or as needed to provide, secure, or support the Cloud Services or to comply with law; where applicable data protection law or a data processing agreement limits such a move, PostureCo will make it only as that law or agreement permits. Otherwise, PostureCo does not move Cloud Services data to another region on its own initiative; it moves data between regions only at your verified request, as described below in this Section 4.1.

Choosing the correct region for your location, and for the laws that apply to you and to your clients and patients (including data-residency, data-protection, and health-information laws such as HIPAA, the GDPR, and the UK GDPR), is your sole responsibility. PostureCo has no obligation to determine, verify, or monitor where you (or your clients or patients) are located, and it cannot reliably tell, for example because a user may connect through a virtual private network (VPN) in breach of Section 8.5; any location or VPN check it chooses to make is for its own protection, may be inaccurate, and does not make PostureCo responsible for your choice of region. Except as Section 8.3, the Standard Contractual Clauses (Section 8.4), or applicable law requires, PostureCo has no obligation to ask where you are located, to recommend a region, or to tell you that a region may be wrong for you.

If you selected the wrong region, set up Cloud Services data outside your country by mistake, or later need your Cloud Services data moved to another region that PostureCo offers, you must contact PostureCo support promptly once you realize it, by email to info@postureco.com, toll free at 866-577-7297 (+1-866-577-7297 from outside the United States), or through the contact form at https://www.postureanalysis.com/postureco-support/, and you must not include any PHI in your request. After verifying your request (as Section 6 of the Privacy Policy describes), PostureCo will assist you: it will manually move your Cloud Services data to the region you designate from those that PostureCo then offers and delete it from the region it is moved from, including a region where it was created by mistake, within a reasonable time, subject to secure backup retention cycles (copies in backups are kept beyond use, meaning that they are not restored to the Cloud Services or otherwise used except as you direct or as the law requires, expire on their normal cycle, and remain protected until then; on request, PostureCo will tell you when they are expected to expire). If no region that PostureCo then offers is suitable for you, PostureCo's only obligation under this paragraph is to delete the data at your verified request (Section 5). PostureCo does not guarantee any completion time, and the affected Cloud Services may be limited or unavailable while the move takes place. Until the move is completed, and for any period before you tell PostureCo, you are solely responsible for your Cloud Services data being stored and processed in the region you selected (or in the United States, if you did not select one), including any legal consequence of it (Section 13). To the maximum extent permitted by law, and except for PostureCo's own obligations under an Executed BAA, Section 8.3, the Standard Contractual Clauses, or applicable law (including acting on your verified request within a reasonable time), PostureCo has no liability for that storage or processing.

Whatever region you select, PostureScribe.AI and the RemoteScreen AI-Guided Health History are offered and authorized only in the United States at this time, and using either of them from outside the United States is a breach of the Terms of Service (Section 8.1); the information sent to an AI provider for them is processed in the United States (Sections 4.4 and 7.5); and PostureCo's personnel and service providers in the United States may access your Cloud Services data as needed to provide, secure, and support the Cloud Services (Sections 4.2 and 8.1).

AWS stores Cloud Services data redundantly across multiple availability zones within the AWS region where it is stored. That redundancy is part of how the Cloud Services operate. It is not a separate backup that you control, and it does not replace your own backups (Sections 3 and 10).

4.2 YOUR CONTROL; BLIND STORAGE; WHEN POSTURECO HAS ACCESS. Data is uploaded to the Cloud Services only after you subscribe to and set up the Cloud Services in the Software (including choosing your region, as Section 4.1 describes), or when a client or patient whom you have invited to RemoteScreen submits information to your account. Once you have set up the Cloud Services, the Software may upload client and patient records automatically whenever you add or change them, as its features and settings provide; those uploads are made at your direction. Unless you use PostureCo Cloud Services or PostureScribe.AI (or choose to send records to PostureCo yourself), PostureCo never has access to your patient or client records. Separately, as described in Section 6 of the Terms of Service and Section 2.3 of the Privacy Policy, PostureCo automatically collects anonymized, aggregated technical and usage data and de-identified measurement data that contain no PHI and identify no one. You also authorize PostureCo to create de-identified data from Cloud Services data, for PHI only as 45 C.F.R. § 164.514 allows and only as an Executed BAA permits, and for other personal data only as applicable law and your agreements with PostureCo (including any data processing agreement under Section 8.3) permit, and to use and disclose (including by license or sale) de-identified and aggregated data, which identify no one, as Section 6 of the Terms of Service and Sections 2.3 and 13.4 of the Privacy Policy allow, including to improve PostureCo's products and to develop artificial intelligence models. PostureCo will not create de-identified data under this authorization from records first uploaded or submitted before October 15, 2026, unless you have affirmatively accepted (for example, by clicking to accept) a version of the Terms of Service, this Cloud Services Agreement, or the PostureScribe.AI User Agreement dated October 15, 2026 or later. This authorization does not affect the anonymized, aggregated, and de-identified data that PostureCo collects automatically as described above. PostureCo accesses identifiable Cloud Services data only as the next paragraph describes.

In the ordinary course of providing the Cloud Services, PostureCo's personnel do not view, review, or interpret your uploaded content, and PostureCo's systems process it automatically only as Section 5 (blind storage) describes. PostureCo's personnel and service providers may access stored data only as needed to provide, maintain, secure, and support the Cloud Services (for example, when you ask for support), to investigate or address a security incident, a technical problem, or a suspected breach of this Agreement or the Terms of Service, to comply with law or legal process, as Section 8.7 of the Terms of Service describes, as an Executed BAA or a data processing agreement permits, or as you otherwise direct or authorize. Production access is limited to designated senior technology staff. Section 21 governs any transfer of Cloud Services data to a successor.

4.3 SERVICE PROVIDERS AND SUBPROCESSORS. PostureCo uses service providers, also called subprocessors, to operate the Cloud Services, including AWS for hosting, storage, backup, and synchronization infrastructure and, for the artificial intelligence features described in Section 4.4, the AI providers identified in Section 6 of the PostureScribe.AI User Agreement. Every third-party vendor whose services could create, receive, maintain, or transmit PHI on PostureCo's behalf has signed a Business Associate Agreement with PostureCo, and each new vendor of that kind must sign one before it is engaged. Other service providers are bound by written agreements that restrict their use of the information they receive. PostureCo may add, replace, or remove service providers at any time, without prior notice except where Section 6, Section 8.3, Section 8.4, or applicable law requires notice, while maintaining equivalent or better protection. A current list of the service providers that may process PHI or other personal data about your clients or patients in the Cloud Services is available on request to info@postureco.com.

4.4 ARTIFICIAL INTELLIGENCE FEATURES. Some features that work with the Cloud Services use artificial intelligence provided by third parties:

  • PostureScribe.AI®, available and authorized in the USA only at this time (using it from outside the United States is not authorized by PostureCo and is a breach, as Section 3.2 of the PostureScribe.AI User Agreement describes), which is governed by the PostureScribe.AI User Agreement, including its Section 6 (Third-Party AI Provider Terms); and
  • The RemoteScreen AI-Guided Health History, available in the USA only at this time (using it from outside the United States is prohibited, as Section 7.5 describes), which uses SpaceXAI LLC, the company formerly known as xAI ("SpaceX AI"), to process your client's or patient's spoken answers, including by transcribing them, and delivers the intake results to your Cloud Services account.

SpaceX AI, PostureCo's primary AI provider, provides AI services to PostureCo under a signed Business Associate Agreement and with zero data retention, meaning that it does not retain the data it processes for PostureCo. PostureCo's fallback AI provider for PostureScribe.AI is Amazon Bedrock, which PostureCo uses inside its own AWS account under its Business Associate Addendum with AWS. For the AI-Guided Health History, PostureCo may also use other AI providers bound by a Business Associate Agreement with PostureCo, such as AWS, including Amazon Bedrock. Under PostureCo's arrangements, neither SpaceX AI nor AWS may use PostureScribe.AI inputs or outputs to train its models, and SpaceX AI's enterprise terms, which apply to the content PostureCo sends it for PostureScribe.AI and for the AI-Guided Health History, state that it will not use customer content to train its models. PostureCo sends PHI only to AI providers bound by a Business Associate Agreement (or an equivalent subcontractor agreement) with PostureCo, and designs these features to send an AI provider only the information needed for the task requested. PostureCo may add, change, or replace AI providers or models at any time without prior notice, except where Section 6, Section 8.3, Section 8.4, or applicable law requires notice.

AI output, including transcripts, generated documentation, and intake results, may be inaccurate, incomplete, fabricated ("hallucinations"), or offensive. You must review, edit, and verify every AI output before you use or rely on it. AI output is not medical advice, a diagnosis, or a treatment recommendation. The AI-Guided Health History does not give medical advice and is not for emergencies. Before the intake, RemoteScreen asks your client or patient to confirm that they are not having a medical emergency, that the AI does not give medical advice, and that they consent to being recorded for transcription; those prompts do not replace any notice, consent, or authorization that you are required to give or obtain (Section 7.5). PostureCo's personnel do not monitor or review RemoteScreen submissions or AI-Guided Health History results, and PostureCo is not responsible for responding to anything they contain. You are solely responsible for reviewing them and for any follow-up. You must use the AI features only in compliance with this Agreement, the PostureScribe.AI User Agreement (for PostureScribe.AI), and applicable law. Section 6 of the PostureScribe.AI User Agreement (Third-Party AI Provider Terms), including its disclaimer of warranties for AI output (Section 6.5), its prohibited uses (Section 6.6), your responsibility for Inputs (Section 6.7), and the third-party terms and policies listed in its Section 6.8, also applies to your use of the AI-Guided Health History, including everything your clients or patients provide to it, as if set out in this Agreement, whether or not you use PostureScribe.AI. For that purpose, its references to the AI Features include the AI-Guided Health History, its references to Section 1.1 of the PostureScribe.AI User Agreement are read as references to Section 7.3 of this Agreement, and its references to Section 1.9 of that agreement are read as references to Sections 6 and 7.5 of this Agreement.

5. SECURITY, ENCRYPTION, BLIND STORAGE, AND DELETION#

Data transmitted to and stored within the Cloud Services is encrypted in transit using TLS and at rest using AES-256 encryption.

PostureCo maintains administrative, physical, and technical safeguards designed to protect Cloud Services data. In addition to encryption, they currently include:

  • Per-organization (per-practice) data segregation enforced server-side, with storage locations segmented per account;
  • Authentication of requests to the Cloud Services, using short-lived, practice-scoped temporary credentials and access tokens;
  • Multi-factor authentication on the PostureCo Cloud web portal, automatic session expiry, and rate-limited sign-in;
  • Infrastructure and application logging of access and administrative events;
  • Integrity checks (checksums) on cloud writes;
  • Production access limited to designated senior technology staff, for maintenance;
  • A documented, risk-driven security program, under which privacy and security obligations are communicated to personnel, and incident-response and breach-notification procedures are maintained in line with the HIPAA Breach Notification Rule and the Florida Information Protection Act; and
  • Signed Business Associate Agreements with every third-party vendor whose services could touch customer PHI, with each new vendor of that kind required to sign before it is engaged.

PostureCo uses and discloses customer PHI in the Cloud Services only as an Executed BAA permits or the law requires (and, for PHI uploaded without an Executed BAA, as Section 7.3 allows). PostureCo's service providers that receive PHI act for PostureCo under Business Associate Agreements with PostureCo.

PostureCo's Chief Executive Officer and Chief Technology Officer are its designated Privacy and Security Officers. PostureCo may change its safeguards and service providers at any time while maintaining equivalent or better protection. The descriptions in Sections 4 and 5 of PostureCo's hosting, regions, redundancy, service providers, AI providers (including their agreements with PostureCo and their own published terms), and safeguards describe PostureCo's current practices and arrangements. They are not a warranty or a guarantee of any third party's performance; PostureCo does not operate the infrastructure of AWS or the systems of any AI provider; and PostureCo may change these practices and arrangements as those Sections allow. NO METHOD OF TRANSMISSION OR STORAGE IS COMPLETELY SECURE, AND POSTURECO DOES NOT GUARANTEE THE SECURITY OF ANY DATA OR THAT UNAUTHORIZED ACCESS, USE, DISCLOSURE, OR LOSS WILL NOT OCCUR. PostureCo will notify you of a breach of security affecting your Cloud Services data as and when applicable law, an Executed BAA, or a data processing agreement requires.

In the ordinary course of providing the Cloud Services, PostureCo's personnel do not view, review, or interpret your uploaded content (blind storage). PostureCo's systems process it automatically only to provide, secure, and support the Cloud Services, to comply with law, and, as Section 4.2 describes, to create or collect de-identified, anonymized, and aggregated data. Processing that you, or a client or patient you invite, start through the Software (such as synchronization or the artificial intelligence features described in Section 4.4) is performed automatically, at your direction, as part of providing the Cloud Services, and is not a review of your content by PostureCo's personnel. PostureCo's personnel and service providers access stored data only as Section 4.2 describes.

Upon receipt of a notarized written request (or equivalent legal attestation), which PostureCo requires in order to confirm that a deletion request is legitimate and authorized, PostureCo will permanently delete stored data from its servers, subject to reasonable processing time, secure backup retention cycles, and any retention that applicable law or legal process requires. Where a law that applies to a request does not permit PostureCo to require notarization, or requires PostureCo to bear its cost, PostureCo will verify the request by another reasonable method that law permits (Section 6 of the Privacy Policy). Where the Software lets you delete data yourself, you are solely responsible for any data you delete.

As Section 7 of the Terms of Service provides, any data stored in the Cloud Services may be permanently deleted thirty (30) days after termination or expiration of the applicable subscription, without notice and without liability. You are solely responsible for retrieving any data you wish to keep before then. PostureCo does not provide archival services and is not a medical-records custodian, and the Cloud Services are not a system of record for any legal record-retention obligation (Section 11).

You are solely and exclusively responsible for:

  • All content uploaded to the Cloud Services, including content submitted by clients or patients you invite to RemoteScreen;
  • Determining whether such content includes Protected Health Information (PHI), Personally Identifiable Information (PII), consumer health data, or other regulated data;
  • Compliance with all applicable local, state, federal, and international laws, including but not limited to HIPAA, GDPR, UK GDPR, U.S. state privacy and consumer-health-data laws (such as the California Consumer Privacy Act and Washington's My Health My Data Act), recording-consent laws, the Telephone Consumer Protection Act, the Children's Online Privacy Protection Act, and data residency requirements, and identifying and requesting from PostureCo any agreement those laws require and having it fully executed before you upload the information it concerns (Sections 7.2 and 8.6);
  • Choosing the correct region for your Cloud Services data, and contacting PostureCo promptly if it needs to be moved (Section 4.1);
  • Not accessing or using the Cloud Services through a VPN, proxy server, or other location-masking technology, making sure that no one using your account does so, and telling the clients or patients you invite to RemoteScreen not to do so (Section 8.5);
  • Not accessing or using PostureScribe.AI from outside the United States, and making sure that no one using your account or devices does so (Section 3.2 of the PostureScribe.AI User Agreement);
  • Making sure that no client or patient who is outside the United States uses the AI-Guided Health History (Section 7.5);
  • Giving every notice, and obtaining every consent and authorization, that the law requires before you or your clients or patients collect, upload, record, transcribe, or process information through the Cloud Services, including the consent of all parties to a recorded conversation where the law requires it (as some states, such as Florida and California, do) and any consent of a parent or legal guardian that the law requires for a minor;
  • Making sure that a child under thirteen (13) does not use RemoteScreen on their own and that a parent or legal guardian completes it on the child's behalf, and that a minor aged thirteen (13) to seventeen (17) uses it only with a parent's or legal guardian's permission and as you allow;
  • Uploading only the information you need, and keeping your own complete records in your own systems;
  • Keeping PHI, and other client and patient information that the law protects, out of every Third-Party Backup Service (as Section 7.1 of the Terms of Service defines it), such as Apple iCloud Backup, iCloud Photos, and iCloud Drive, unless the laws that apply to you permit that service to hold it and any business associate agreement those laws require is in place, including the copies of Cloud Services data that are synchronized to your devices (Section 10);
  • Safeguarding your login credentials and devices, using multi-factor authentication where the Software offers it, controlling who in your organization has access under your account, promptly removing access for anyone who should no longer have it, and notifying PostureCo immediately of any suspected unauthorized access to your account or data; and
  • The acts and omissions of everyone who uses the Cloud Services under your account.

RemoteScreen is not directed to children under thirteen (13), and PostureCo does not knowingly collect personal information directly from a child under thirteen (13).

PostureCo does not provide legal advice and makes no representations regarding your compliance obligations. You are strongly advised to consult your own legal counsel.

Where a U.S. state privacy or consumer-health-data law applies to personal information about your clients or patients that PostureCo processes for you through the Cloud Services, PostureCo acts as your service provider or processor (as that law defines those terms) and, to the extent that law requires: processes that information only to provide the Cloud Services to you and for the other purposes that this Agreement and that law permit; does not sell or share it (as that law defines those terms) or use it for targeted advertising; does not retain, use, or disclose it outside the direct business relationship between you and PostureCo, or combine it with personal information from other sources, except as that law permits; provides the level of privacy protection that law requires; notifies you if it determines that it can no longer meet its obligations under that law; taking into account the nature of the processing, assists you by appropriate technical and organizational measures, insofar as possible, in responding to requests from consumers exercising their rights under that law and in meeting your other obligations under it; binds each person who processes that information for PostureCo to a duty of confidentiality; engages a subcontractor to process it only under a written contract that binds the subcontractor to the obligations that law places on service providers or processors, and tells you of its subcontractors through the list available under Section 4.3 and, where that law requires notice of a new subcontractor, as Section 8.3 describes; and permits you, on written notice, to take reasonable and appropriate steps to help ensure that it uses that information consistently with your obligations under that law and to stop and remediate any unauthorized use. You will tell PostureCo of any consumer request under that law with which PostureCo must comply and give PostureCo the information it needs to comply with it. To the extent that the anonymized, aggregated, and de-identified data described in Section 4.2 meets that law's definition of de-identified or aggregate information, it is not subject to this paragraph; PostureCo maintains and uses that data only in de-identified form, does not attempt to re-identify it except as that law permits, and, where that law requires, contractually prohibits anyone to whom it discloses that data from re-identifying it.

7. HIPAA AND BUSINESS ASSOCIATE AGREEMENT (U.S. USERS)#

7.1 NOT A BUSINESS ASSOCIATE BY DEFAULT. PostureCo is not a Business Associate by default. A Business Associate Agreement ("BAA") is not automatic: purchasing, accessing, or using the Cloud Services does not by itself create a BAA. PostureCo agrees to act as your business associate only under a fully executed BAA that covers the Service in question (for the Cloud Services, an Executed BAA, as Section 7.2 defines it), and you must not provide PHI to PostureCo without one (Section 7.3 of this Agreement and Section 8.4 of the Terms of Service). Unless you use PostureCo Cloud Services or PostureScribe.AI (or choose to send records to PostureCo yourself), PostureCo never has access to your patient or client records (Section 4.2), and PostureCo does not enter into a BAA for the use of its mobile applications alone (Section 8.3 of the Terms of Service).

7.2 WHO MAY REQUEST A BAA; YOUR SOLE RESPONSIBILITY. PostureCo enters into BAAs only on the user's request, and only with healthcare providers, covered entities, and business associates located in the United States that use the Cloud Services (including RemoteScreen and PostureRay® on PostureCo Cloud), PostureScribe.AI, or the cloud backup and online ViewBox included in a PostureRay® technical support plan (Section 8.2 of the Terms of Service). The only exception is that PostureCo may consider a request from a healthcare practitioner outside the United States who wishes to use the Cloud Services, case by case and in its sole discretion, as Section 8.5 of the Terms of Service and Section 8.6 of this Agreement describe; identifying, requesting, and supplying any agreement that practitioner's law requires is the practitioner's sole responsibility. If you are a U.S.-based healthcare provider, facility, covered entity, or business associate, it is your sole responsibility to determine whether a BAA is required and, if it is, to initiate and request a BAA from PostureCo and to have it fully executed by both you and PostureCo before any PHI is uploaded, transmitted, recorded, or dictated, which includes before you turn on cloud backup or synchronization for records that contain PHI, before you use PostureScribe.AI with PHI, and before you invite any patient to RemoteScreen. You may supply your own BAA form for PostureCo's review or ask for PostureCo's standard BAA. Send your request to info@postureco.com or through the contact form at https://www.postureanalysis.com/postureco-support/, and do not include any PHI in it. PostureCo has no obligation to ask whether you need a BAA, to offer one, or to remind you. A request alone does not create a BAA, and no BAA exists unless and until it is fully executed by both you and PostureCo. PostureCo may accept, negotiate, or decline any proposed BAA or term. A BAA between you and PostureCo that both of you have fully executed and that covers your use of the Cloud Services is an "Executed BAA," whether you requested it under this Section 7.2, Section 8.2 of the Terms of Service, or Section 1.8 of the PostureScribe.AI User Agreement. A BAA that covers only PostureScribe.AI or another service, and not the Cloud Services, is not an Executed BAA under this Agreement and does not permit you to upload, store, transmit, record, or dictate any PHI to or through the Cloud Services. Fitness and wellness professionals who are not covered entities or business associates under HIPAA generally do not need a BAA, but deciding whether you need one is your responsibility, and nothing in this Agreement is legal advice.

7.3 NO PHI WITHOUT AN EXECUTED BAA. Unless an Executed BAA is in effect, you must not upload, store, transmit, record, or dictate any PHI to or through the Cloud Services, and you must not send PHI to PostureCo by any other means, including for support, except as Section 8.4 of the Terms of Service allows under a fully executed BAA that covers that means. Because the Software may upload client and patient records automatically once the Cloud Services are set up (Section 4.2), if you are a covered entity or business associate under HIPAA, you must not set up or turn on the Cloud Services on any device or account that holds PHI until an Executed BAA is in effect.

USE OF THE CLOUD SERVICES WITHOUT AN EXECUTED BAA IS AT YOUR SOLE RISK. PostureCo assumes no liability for PHI uploaded without an Executed BAA.

PostureCo has no obligation to detect PHI uploaded in breach of this Section 7.3. If PostureCo learns of such an upload, it may suspend the affected Cloud Services, require you to remove the PHI promptly and in any event within thirty (30) days, or, after notice to you, securely return or delete that PHI, which you agree PostureCo may do without liability, and you remain solely responsible for it.

7.4 WHAT POSTURECO DOES UNDER AN EXECUTED BAA. Under an Executed BAA, and as it provides, PostureCo:

  • Uses and discloses PHI only as the Executed BAA permits or requires (including, where it permits, to de-identify PHI as Section 4.2 describes) and as needed to provide the contracted services, limited to the minimum necessary where HIPAA requires;
  • Applies the administrative, physical, and technical safeguards required by the HIPAA Security Rule to electronic PHI, including those described in Section 5;
  • Reports to you security incidents of which it becomes aware, and breaches of unsecured PHI, without unreasonable delay and no later than sixty (60) calendar days after discovery, or within any shorter period that the Executed BAA or applicable law (such as the Florida Information Protection Act) requires;
  • Requires its subcontractors that create, receive, maintain, or transmit PHI on its behalf, such as AWS and its AI providers, to agree, under their own Business Associate Agreements, to the restrictions and conditions on that PHI that HIPAA requires;
  • Makes PHI available as needed to support your obligations to give individuals access to their PHI, to amend it, and to account for disclosures of it (45 C.F.R. §§ 164.524, 164.526, and 164.528), although you hold and control your own records in the ordinary course;
  • Makes its internal practices, books, and records relating to PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance with HIPAA; and
  • At termination, returns or destroys PHI where feasible, which for Cloud Services data takes place through the deletion described in Section 5 after the thirty (30) day post-termination period, and extends the Executed BAA's protections to any PHI that cannot feasibly be returned or destroyed at once, such as copies in secure backup retention cycles, limiting further uses and disclosures of it to the purposes that make its return or destruction infeasible.

This list summarizes the Executed BAA and does not add to it. To the extent the Executed BAA permits, this Section 7.4 is notice of the ongoing existence of unsuccessful security incidents, such as pings, port scans, and blocked sign-in attempts, that do not result in unauthorized access to, or use, disclosure, modification, or destruction of, PHI, and no further report of them is required.

The Executed BAA controls over any conflicting term of this Agreement, the Terms of Service, or any other PostureCo agreement, but only as to PHI; in all other respects, this Agreement and the Terms of Service control. PostureCo is not a medical-records custodian or a system of record, and you must keep your own records (Section 11).

7.5 REMOTESCREEN AND YOUR PATIENTS. RemoteScreen collects information directly from the clients or patients you invite, such as their name, date of birth, telephone number, email address, posture photos, movement videos, and, where you use the AI-Guided Health History, their spoken answers and intake results, and delivers it to your Cloud Services account. RemoteScreen is drop-off only: your client's or patient's browser cannot read back your records. If you are a U.S. covered entity or business associate, you must have an Executed BAA in effect before you invite any patient to RemoteScreen. You are solely responsible for:

  • Deciding whom to invite, sending each invitation only to the intended person, and complying with the Telephone Consumer Protection Act and every other law that applies to any invitation, text message, call, or email that you send, or cause to be sent, to your clients or patients, including obtaining any consent that law requires;
  • Making sure that no client or patient who is outside the United States is invited or allowed to use the AI-Guided Health History, and telling your clients and patients not to use a VPN or other location-masking technology with RemoteScreen (Section 8.5);
  • Giving your clients and patients every notice, and obtaining every consent and authorization, that the law applicable to you requires, including your notice of privacy practices where HIPAA applies, any consent required to record or transcribe them or to process their information with artificial intelligence, and any consent required by consumer-health-data laws;
  • Responding to your clients' and patients' requests to access, correct, amend, or delete their information; and
  • Reviewing everything they submit, and any follow-up care or communication.

The AI-Guided Health History is available only in the United States at this time. Accessing or using it from outside the United States, whether by you, by anyone using your account, or by a client or patient you invite, and including through a VPN or other location-masking technology, is prohibited and is a breach of this Agreement and of the Terms of Service until PostureCo formally releases it outside the United States, which PostureCo will do only by publishing updated terms or a written release notice on its website or in the Software; no other statement, including one by support or sales personnel, releases it. You must not invite or allow any client or patient who is outside the United States to use the AI-Guided Health History, and you are responsible for your invitees' compliance with this Section 7.5 (Section 13). RemoteScreen's posture photo and movement video features may be used outside the United States, subject to your own legal responsibilities, including your choice of region (Section 4.1) and the laws that apply to you and to your clients and patients. PostureCo may block or disable the AI-Guided Health History for any account, client, or patient, including where it suspects use from outside the United States, without liability, and PostureCo is not responsible for any use of it outside the United States.

PostureCo makes the RemoteScreen® Patient App Privacy Policy available to your clients and patients at https://www.postureanalysis.com/legal/remotescreen-patient-privacy-policy/ and may display or link to it in RemoteScreen. You are responsible for making sure that your clients and patients receive every notice the law requires. That policy does not replace your own notice of privacy practices or any notice, consent, or authorization that you must give or obtain. PostureCo may refer to you any request about RemoteScreen information that it receives from one of your clients or patients, and it is not responsible for responding to that request on your behalf.

7.6 YOUR HIPAA RESPONSIBILITIES; HIPAA COMPLIANCE STATEMENT. Sections 9.1 through 9.4 of the Terms of Service, which set out your HIPAA responsibilities, what applies when a BAA is in effect, and the status of PostureCo's HIPAA Compliance Statement, apply to your use of the Cloud Services. Those responsibilities remain yours even when an Executed BAA is in effect, including your own risk analysis, policies, workforce training, and access controls; using and disclosing only the minimum necessary PHI; the notices you give and the authorizations you obtain; and any breach notifications that HIPAA requires you to give to individuals, the Secretary of the U.S. Department of Health and Human Services, or the media. The HIPAA Compliance Statement (Section 2) describes how PostureCo safeguards health information; it is informational only, does not create a BAA, and does not replace or amend an Executed BAA or this Agreement. No government agency certifies HIPAA compliance, and nothing in this Agreement, the HIPAA Compliance Statement, or any other PostureCo material is a certification or a guarantee that your use of the Cloud Services complies with HIPAA.

8. INTERNATIONAL USE, REGIONAL HOSTING, AND GDPR#

8.1 INTERNATIONAL USE AND REGIONAL HOSTING. If you access or use the Cloud Services outside the United States, you are solely responsible for choosing, during setup, the region where your Cloud Services data is stored, and for that choice being correct for your location and for the laws that apply to you and to your clients and patients, as Section 4.1 describes. PostureCo has no obligation to determine, verify, or monitor where you (or your clients or patients) are located; any location or VPN check it chooses to make is for its own protection, may be inaccurate, and does not make PostureCo responsible for your choice of region. PostureCo stores your data in the region you select. If you select the United States, or if no region is selected, your data is stored in the United States, and you acknowledge and agree that it will be transferred to and stored in the United States. If you selected the wrong region, set up data outside your country by mistake, or need your data moved, you must contact PostureCo support promptly, and PostureCo will assist you in moving it and deleting it from the other region, as Section 4.1 describes; until then, the responsibility for where your data is stored remains yours. Even when your data is stored in a region outside the United States, PostureCo's personnel and service providers located in the United States may access it as needed to provide, secure, and support the Cloud Services, subject to Section 4.2. PostureScribe.AI and the RemoteScreen AI-Guided Health History are offered and authorized only in the United States at this time. Accessing or using either of them from outside the United States, including through a VPN or other location-masking technology, is not allowed or authorized by PostureCo, is prohibited, and is a breach of Section 4 of the Terms of Service and of the agreement that governs that feature (Section 3.2 of the PostureScribe.AI User Agreement for PostureScribe.AI, and Section 7.5 of this Agreement for the AI-Guided Health History), until PostureCo formally releases that feature outside the United States as those Sections describe. Any such access or use by you or by anyone using your account or devices is entirely at your own risk, is not excused by any failure of PostureCo to detect or block it, and is covered by your indemnity (Section 13). You must not access or use the Cloud Services through a VPN or other location-masking technology (Section 8.5). You may not use the Cloud Services where doing so would violate U.S. export-control or sanctions laws. If you are a healthcare provider or other professional outside the United States, Section 8.6 also applies to you.

8.2 ROLES UNDER THE GDPR AND SIMILAR LAWS. Where the EU General Data Protection Regulation ("GDPR"), the UK GDPR, the Swiss Federal Act on Data Protection, or a similar law applies, you are the controller of the personal data about your clients or patients that you, or the clients or patients you invite to RemoteScreen, upload to the Cloud Services, and PostureCo processes that personal data as your processor, on your behalf and on your documented instructions. This Agreement, including the storage, access, and transfers that Sections 4.1, 8.1, and 8.4 describe, and your use and configuration of the Cloud Services, including your choice of region, are your documented instructions. PostureCo is the controller of its own account, billing, support, website, and security data, which the Privacy Policy describes.

8.3 DATA PROCESSING TERMS; DATA PROCESSING AGREEMENT. On request to info@postureco.com, PostureCo may provide its standard data processing agreement for signature; PostureCo may accept, negotiate, or decline any other form or any proposed change, case by case and in its sole discretion, and whether or not a separate agreement is signed, this Section 8.3 and Section 8.4 are the processor and transfer terms where the law requires them. If a data processing agreement is executed by both you and PostureCo, it controls over this Section 8.3, to the extent of any conflict, as to the personal data it covers. This Section 8.3 applies where PostureCo processes personal data as your processor and the law requires a contract containing processor terms (such as Article 28 of the GDPR or of the UK GDPR). The subject matter and nature of that processing are the storage, backup, synchronization, display, and transmission of personal data through the Cloud Services and, where you use them, the artificial intelligence features described in Section 4.4; its purpose is to provide the Cloud Services to you; its duration is the term of your subscription, the post-termination period described in Section 5, and any further period for which the data remains in secure backup retention cycles or the law requires PostureCo to keep it; the types of personal data are those that you, and the clients or patients you invite, upload, such as identification and contact details, dates of birth, photographs, videos, voice recordings and transcripts, measurements, notes, and health data; and the data subjects are your clients and patients and any other individuals whose personal data you or they upload. PostureCo will, to the extent that law requires:

  • Process that personal data only on your documented instructions, including with regard to transfers of personal data to a third country, unless the law requires otherwise, in which case PostureCo will tell you of that legal requirement before processing unless the law prohibits it, and tell you if, in its opinion, an instruction infringes that law;
  • Ensure that the persons it authorizes to process that personal data are bound by an obligation of confidentiality;
  • Apply the security measures described in Section 5;
  • Engage other processors (subprocessors) only under written terms that impose the data protection obligations that the law requires, and remain responsible to you for their performance as the law requires. You give PostureCo general authorization to engage subprocessors. PostureCo will inform you of any intended addition or replacement of a subprocessor that will process that personal data, by email or by another reasonable means, so that you may object on reasonable data protection grounds, in which case your sole remedy is to stop using the affected Cloud Services and end your subscription;
  • Taking into account the nature of the processing and the information available to it, assist you by appropriate technical and organizational measures, insofar as possible, in responding to requests from individuals exercising their rights, and in meeting your obligations regarding security, personal data breach notification, data protection impact assessments, and prior consultation;
  • Notify you without undue delay after becoming aware of a personal data breach affecting that personal data;
  • At the end of the Cloud Services, delete that personal data as Section 5 describes, after the period in which you may retrieve it, unless the law requires PostureCo to keep it; and
  • Make available the information necessary to demonstrate its compliance with these obligations, and allow for and contribute to audits, which PostureCo may satisfy by providing documentation of its safeguards and its infrastructure providers' independent attestations, with any further audit or inspection only as the law requires, on reasonable advance written notice, during business hours, at your expense, and subject to confidentiality.

Where the law permits, PostureCo may charge reasonable fees for assistance that goes beyond the standard features of the Cloud Services.

8.4 INTERNATIONAL TRANSFERS; YOUR RESPONSIBILITIES. Where the law requires a transfer mechanism for personal data that is transferred to, or accessed from, the United States or another country, PostureCo relies on a mechanism permitted by that law, such as standard contractual clauses approved by the relevant authority, as Section 10.4 of the Privacy Policy describes. Where the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection requires such a mechanism for personal data that you, or the clients or patients you invite to RemoteScreen, transfer to PostureCo through the Cloud Services (including personal data stored in a region outside the United States and accessed from the United States), and no data processing agreement executed under Section 8.3 provides one, the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 (the "Standard Contractual Clauses") are incorporated into this Agreement by reference and apply to that transfer, and by accepting this Agreement you and PostureCo agree to them, as follows:

  • You are the data exporter and PostureCo is the data importer; Module Two applies where you act as a controller, and Module Three where you act as a processor;
  • Clause 7 and the optional wording in Clause 11(a) do not apply;
  • Option 2 of Clause 9(a) (general written authorization) applies; the agreed list of subprocessors is the list available under Section 4.3; and PostureCo will inform you of any intended addition or replacement of a subprocessor, as Section 8.3 describes, at least ten (10) days in advance;
  • Under Option 1 of Clause 17 and under Clause 18, the Standard Contractual Clauses are governed by the law of Ireland, and disputes arising from them are resolved by the courts of Ireland;
  • In Annex I, the parties are you, as identified in your Cloud Services account, and PostureCo, Inc., 3152 Little Road, Suite 161, Trinity, FL 34655, info@postureco.com; the description of the transfer is the description of the processing in Section 8.3, which includes sensitive data such as health data, protected by the measures in Section 5, and the transfer is continuous for as long as that processing lasts; and the competent supervisory authority is the one determined under Clause 13. Annex II is completed by Section 5;
  • For transfers subject to the UK GDPR, the International Data Transfer Addendum to the Standard Contractual Clauses issued by the UK Information Commissioner also applies, completed with the information in this Section 8.4, and PostureCo, as importer, may end it as its Section 19 allows; and
  • For transfers subject to Swiss law, references in the Standard Contractual Clauses to the GDPR are read as references to the Swiss Federal Act on Data Protection, the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for those transfers, and the term "Member State" is not read to prevent data subjects in Switzerland from bringing claims in their place of habitual residence.

If the Standard Contractual Clauses conflict with this Agreement, they control as to the transfers they cover; otherwise, this Agreement, including Sections 16 and 17, applies to them to the extent they permit.

You are solely responsible for your lawful basis for processing; for the notices you give and the consents you obtain, including explicit consent to the processing of health data where the law requires it; for any data protection impact assessment that the law requires of you; for choosing the region where your Cloud Services data is stored (Section 4.1); and for determining whether you may use the Cloud Services, including their regional hosting and any access from the United States, under the laws that apply to you.

Except for the obligations that Section 8.3, the Standard Contractual Clauses, or applicable law places directly on PostureCo as a processor or data importer, you are solely responsible for compliance with GDPR, UK GDPR, and any other applicable international data protection or privacy laws. PostureCo makes no claims, representations, or warranties regarding compliance with laws outside the United States, and international use of the Cloud Services is at your sole risk.

To the maximum extent permitted by law, PostureCo disclaims all liability arising from your international use of the Cloud Services.

8.5 NO VPNS OR LOCATION MASKING. No one may access or use the Cloud Services, including the PostureCo Cloud web portal, RemoteScreen, and the Software, through a virtual private network (VPN), proxy server, anonymizing network, or any other technology that hides, masks, or changes the location from which the Cloud Services are accessed, including a VPN provided by an employer or practice. You must not do so, you must make sure that no one using your account does so, and you must tell the clients or patients you invite to RemoteScreen not to do so. Any such use by you or under your account is a material breach of this Agreement and of the Terms of Service (Section 4 of the Terms of Service). PostureCo may not be able to detect VPN or other location-masking use, has no obligation to monitor for or detect it, and may (but need not) block, suspend, or terminate access to the Cloud Services if it suspects it. You are solely responsible for every consequence of VPN or location-masking use by you, by anyone using your account, or by a client or patient you invite, including the use of a feature where it is not available (such as PostureScribe.AI outside the United States, Section 3.2 of the PostureScribe.AI User Agreement, or the AI-Guided Health History outside the United States, Section 7.5), Cloud Services data stored in a region that is wrong for you (Section 4.1), and any resulting violation of law (Section 13). To the maximum extent permitted by law, and except for PostureCo's own obligations under an Executed BAA, Section 8.3, the Standard Contractual Clauses, or applicable law, PostureCo has no liability for any of those consequences.

8.6 HEALTHCARE PROVIDERS OUTSIDE THE UNITED STATES; LAWS THAT APPLY TO YOU. If you are a healthcare provider or other professional outside the United States and you use the Cloud Services, including if you use them only to back up health information, you are solely responsible for identifying and complying with every law that applies to you and to your clients' and patients' information, including data-protection, health-information, professional-secrecy, data-residency, health-data-hosting, and record-retention laws (see also Section 9.5 of the Terms of Service).

Where the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection applies, the processor terms in Section 8.3 (which address Article 28 of the GDPR and of the UK GDPR) and, where Section 8.4 makes them apply, the Standard Contractual Clauses are built into this Agreement: they apply, as those Sections provide, when you accept this Agreement, without a separate signature, and a separately signed data processing agreement is available on request (on PostureCo's standard form; Section 8.3). Under those laws, they are the counterpart of a HIPAA Business Associate Agreement. They are not a BAA, and they do not address any other requirement of those laws or of any other law.

Anything else that a law that applies to you requires, including any other contract (such as an agreement similar to a HIPAA Business Associate Agreement) and any registration, notification, authorization, certification, or approval (for example, a country-specific requirement for hosting health data), is solely your responsibility to identify, to request from PostureCo, and to supply to PostureCo for review, before you upload any information it concerns to the Cloud Services; any such agreement exists only once it is fully executed by both you and PostureCo. Send your request to info@postureco.com or through the contact form at https://www.postureanalysis.com/postureco-support/, and do not include any client or patient information in it. PostureCo has no obligation to ask about, identify, offer, or remind you of any such requirement. A request alone creates nothing, and PostureCo may accept, negotiate, or decline any request or term, case by case and in its sole discretion (Section 8.5 of the Terms of Service). PostureCo makes no representation that the Cloud Services, PostureCo, or its service providers meet any requirement of a law outside the United States, or hold any country-specific certification, registration, or approval, unless PostureCo expressly confirms it in a writing signed by PostureCo.

If a law that applies to you requires an agreement, registration, or other step that is not in place, you must not use the Cloud Services for the information concerned. Using them anyway is a material breach of this Agreement and of the Terms of Service (and may violate that law) and is entirely at your own risk; PostureCo is not responsible for any consequence of it, including where you never asked PostureCo for an agreement or never sent PostureCo any document to sign; and you will defend, indemnify, and hold harmless PostureCo completely from it (Section 13).

PostureCo makes its apps available worldwide through app stores and online, and it cannot vet or verify who downloads, buys, or uses the Software or the Cloud Services, what kind of professional or organization you are (for example, a healthcare provider, covered entity, business associate, fitness or wellness professional, or consumer), where you are, or which laws apply to you, and it relies on you; wherever you are, you must determine and comply with every law that applies to you and to the information you handle, including HIPAA and laws like it elsewhere in the world (Section 9.6 of the Terms of Service). Using the Cloud Services in violation of any such law is a material breach of this Agreement and of the Terms of Service: your right to use the affected Cloud Services ends automatically for that use, you must stop that use immediately, PostureCo may suspend or terminate your access, without refund to the extent the law allows (Section 18 of the Terms of Service), and your indemnity applies (Section 13). PostureCo makes no representation that the Cloud Services are appropriate, lawful, or available for use in any particular location, and it may restrict their availability in any country. Nothing in this Section 8.6 limits any right that applicable consumer law gives you and that cannot be waived by contract.

9. DATA INTEGRITY, CORRUPTION, AND LOSS DISCLAIMER#

PostureCo shall not be responsible or liable for any data corruption, loss, deletion, or inaccessibility arising from or related to:

  • Software updates or upgrades;
  • Operating system, firmware, or device updates;
  • Device failure, replacement, or storage limitations;
  • Network interruptions or degraded connectivity;
  • Conflicts with third-party software or security tools;
  • Any Third-Party Backup Service (Section 7.1 of the Terms of Service), such as Apple iCloud, and any backup that you make, restore, or fail to make (Section 10);
  • User error or misuse;
  • Partial, interrupted, or incomplete uploads;
  • Your choice of region and, to the maximum extent permitted by law and subject to any Executed BAA, any move of data between regions (Section 4.1);
  • Events beyond PostureCo's reasonable control.

PostureCo strongly recommends, but does not require, that you maintain independent and redundant backups of your data, using only backup methods that meet your legal obligations. Depending on your circumstances, those may include encrypted backups on computers and storage devices that you control and secure, and your own electronic health record or other system of record; whether a method meets your obligations is for you to decide.

Cloud backups of your devices and consumer cloud services, such as Apple iCloud Backup and iCloud Photos, are Third-Party Backup Services (Section 7.1 of the Terms of Service). They are provided by their providers under their own terms, they are not part of the Cloud Services, PostureCo does not control them, and no BAA with PostureCo covers them. Apple's iCloud terms do not allow HIPAA covered entities or business associates to use iCloud for protected health information. If your data includes PHI, or other client or patient information that the law protects, you must keep it out of every Third-Party Backup Service unless that service, and your use of it, meet your legal obligations, including any business associate agreement those obligations require. This includes the copies of Cloud Services data that are synchronized to your devices (Sections 7.1 through 7.4 of the Terms of Service). If you are not a HIPAA covered entity or business associate and no other such law applies to your data, for example if you work in health and fitness only, whether you also use a Third-Party Backup Service is your choice, and Section 7.4 of the Terms of Service still applies.

You acknowledge that failure to maintain independent and redundant backups that meet your legal obligations materially increases the risk of data loss, which you voluntarily assume. PostureCo is not responsible for any Third-Party Backup Service or for any information in it, as Section 7.4 of the Terms of Service provides, and your indemnity applies (Section 13).

11. NO FIDUCIARY RELATIONSHIP; NO BAILMENT#

Nothing in this Agreement creates a fiduciary relationship, agency, partnership, joint venture, bailment, or trust relationship between you and PostureCo.

PostureCo is not a data custodian, medical records custodian, or trustee of your data.

You expressly waive any claim that PostureCo owes heightened duties of care beyond those expressly stated in this Agreement.

12. FORCE MAJEURE; THIRD-PARTY INFRASTRUCTURE DEPENDENCIES#

PostureCo shall not be liable for any failure, delay, interruption, data loss, or unavailability resulting from events beyond its reasonable control, including but not limited to:

  • Natural disasters or acts of God;
  • Power, utility, or telecommunications outages;
  • Governmental actions or restrictions;
  • Cybersecurity incidents not caused by PostureCo's willful misconduct;
  • Failures or outages of third-party infrastructure providers, including Amazon Web Services (AWS);
  • Failures, outages, errors, changes, or discontinuation of third-party artificial intelligence providers or models, including SpaceX AI and Amazon Bedrock;
  • Failures of the internet, of mobile carriers, or of the devices, browsers, or networks used by you or by the clients or patients you invite to RemoteScreen.

13. INDEMNIFICATION#

You agree to defend, indemnify, and hold harmless PostureCo, its officers, directors, employees, contractors, licensors, and affiliates from and against any and all claims, damages, losses, liabilities, penalties, fines, costs, and expenses (including attorneys' fees) arising out of or related to:

  • Your use of the Cloud Services;
  • Data loss, corruption, or inaccessibility;
  • Alleged violations of HIPAA, GDPR, or other privacy or security laws;
  • Failure to obtain or maintain a required BAA;
  • Third-party claims related to stored data;
  • Your use of artificial intelligence features, any AI output, and any failure to review, edit, and verify it;
  • The clients or patients you invite to RemoteScreen, the information they submit, and any invitation, text message, call, email, or other communication that you send, or cause to be sent, to them;
  • Any failure to give a notice, or to obtain a consent or authorization, that the law requires, including for recording, transcription, or processing with artificial intelligence;
  • Your choice of the region where your Cloud Services data is stored, any failure to choose the correct region or to contact PostureCo promptly when your data needs to be moved, and the storage and processing of your data in the region you selected (or in the United States, if you did not select one) before any move is completed (Section 4.1);
  • Any access to or use of the Cloud Services through a VPN, proxy server, or other location-masking technology by you, by anyone using your account, or by a client or patient you invite (Section 8.5);
  • Any access to or use of a feature from a place where it is not available, including any access to or use of PostureScribe.AI from outside the United States by you or by anyone using your account or devices (Section 3.2 of the PostureScribe.AI User Agreement), and any use of the AI-Guided Health History from outside the United States, by you, by anyone using your account, or by a client or patient you invite (Section 7.5);
  • Any use of the Cloud Services for any information without an agreement, registration, notification, authorization, certification, or approval that a law that applies to you requires for it, whether or not you ever asked PostureCo for it or sent PostureCo any document to sign (Section 8.6);
  • Any use of the Cloud Services, by you or by anyone using your account, in violation of a law that applies to you or to the information you handle, including HIPAA and laws like it anywhere in the world (Section 8.6);
  • Any Third-Party Backup Service (Section 7.1 of the Terms of Service), including Apple iCloud, and any backup, synchronization, copying, storage, use, disclosure, loss, or security incident involving Cloud Services data or other client or patient information, including PHI, in or through one, and any failure to keep PHI out of one (Section 10);
  • Your breach of this Agreement or of any third-party AI provider terms that apply to your use.

This obligation survives termination of this Agreement.

14. WAIVER OF SUBROGATION#

To the fullest extent permitted by law, you waive any and all rights of subrogation against PostureCo for losses covered by insurance maintained by you.

You agree to ensure that any applicable insurance policies include a waiver of subrogation in favor of PostureCo, where permitted.

15. DISCLAIMER OF WARRANTIES#

THE CLOUD SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE."

POSTURECO DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT, TO THE MAXIMUM EXTENT PERMITTED BY FLORIDA LAW.

16. LIMITATION OF LIABILITY#

TO THE MAXIMUM EXTENT PERMITTED BY LAW, POSTURECO'S TOTAL LIABILITY ARISING OUT OF OR RELATED TO THE CLOUD SERVICES SHALL NOT EXCEED THE AMOUNT PAID BY YOU FOR THE CLOUD SERVICES IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM.

IN NO EVENT SHALL POSTURECO BE LIABLE FOR INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, OR EXEMPLARY DAMAGES.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THESE LIMITATIONS APPLY TO ALL CLAIMS ARISING OUT OF OR RELATED TO THE CLOUD SERVICES, INCLUDING CLAIMS ARISING OUT OF OR RELATED TO PHI, ANY SECURITY INCIDENT, ANY DATA LOSS, OR ANY EXECUTED BAA OR DATA PROCESSING AGREEMENT, UNLESS THAT EXECUTED BAA OR DATA PROCESSING AGREEMENT EXPRESSLY PROVIDES OTHERWISE. THE DAMAGES EXCLUDED ABOVE INCLUDE LOST PROFITS, LOST DATA, PATIENT CLAIMS, REGULATORY PENALTIES, AND COSTS OF INVESTIGATION, BREACH NOTIFICATION, AND CREDIT MONITORING.

17. NO RELIANCE; SOLE AND EXCLUSIVE REMEDIES#

You acknowledge that you have not relied on any representations or statements not expressly set forth in this Agreement.

Your sole and exclusive remedies for any claim arising out of or relating to the Cloud Services are those expressly provided in this Agreement.

18. ARBITRATION; CLASS ACTION WAIVER#

Except where inconsistent with or expressly superseded by the Terms of Service or applicable End User License Agreement, any dispute, claim, or controversy arising out of or relating specifically to the Cloud Services or this Agreement shall be resolved by final and binding arbitration conducted in Pasco County, Florida, consistent with Section 16 of the Terms of Service, on an individual basis only.

YOU EXPRESSLY WAIVE ANY RIGHT TO PARTICIPATE IN A CLASS ACTION, COLLECTIVE ACTION, OR REPRESENTATIVE PROCEEDING AGAINST POSTURECO WITH RESPECT TO THE CLOUD SERVICES.

Judgment on the arbitration award may be entered in any court of competent jurisdiction.

19. GOVERNING LAW#

This Agreement shall be governed by and construed in accordance with the laws of the State of Florida, without regard to conflict-of-law principles.

20. ENTIRE AGREEMENT#

This Agreement, together with the Terms of Service, the Privacy Policy, any Executed BAA, any data processing agreement executed under Section 8.3, any other agreement that both you and PostureCo sign under Section 8.6, and, where they apply, the PostureScribe.AI User Agreement and PostureRay's own terms, constitutes the entire agreement between you and PostureCo with respect to the Cloud Services and supersedes all prior agreements or understandings relating to SyncScreen or cloud-based storage services.

If any provision of this Agreement is held invalid or unenforceable, it will be enforced to the maximum extent permitted by law, and the remaining provisions remain in full force and effect.

21. ASSIGNMENT#

PostureCo may assign or transfer this Agreement, in whole or in part, without your consent, to a successor to all or part of PostureCo's business or assets in a merger, acquisition, reorganization, bankruptcy, or sale, and may transfer Cloud Services data to that successor as part of the transaction, subject to the same protections that this Agreement provides, any Executed BAA, and applicable law. You may not assign or transfer this Agreement or your Cloud Services account without PostureCo's prior written consent. This Agreement binds and benefits the parties and their permitted successors and assigns.