Get the app

HIPAA Compliance Statement

Last updated

On this page 14 sections

PostureCo may update this document at any time without prior notice. The date above shows when it was last updated, so please check back from time to time.

HIPAA COMPLIANCE STATEMENT

LAST UPDATED: October 21, 2026

IMPORTANT NOTICE: PostureCo, Inc., a Florida corporation ("PostureCo," "we," or "us"), provides this HIPAA Compliance Statement (this "Statement") for information only. It is a notice, not a contract, a Business Associate Agreement, a warranty, or legal advice, and it amends no PostureCo agreement or policy (Section 13). Using any Service constitutes your acknowledgment of this Statement (Terms of Service, Section 1).

1. PURPOSE AND SCOPE#

1.1 PURPOSE. This Statement summarizes PostureCo's approach to the Health Insurance Portability and Accountability Act of 1996, as amended, and its regulations at 45 C.F.R. Parts 160 and 164 (together, "HIPAA"). "Protected health information" ("PHI"), "covered entity," and "business associate" have the meanings in 45 C.F.R. § 160.103. "You" means the professional or organization that uses PostureCo's software and services (the "Services"); Section 12 speaks to patients and clients. This Statement addresses HIPAA only; for other privacy laws, see the Privacy Policy.

1.2 SERVICES THIS STATEMENT COVERS. The Services include PostureScreen® and its apps; PostureCo Cloud Services, formerly "SyncScreen" (cloud storage, backup, and synchronization, the PostureCo Cloud web portal, RemoteScreen®, and PostureRay® on PostureCo Cloud, which requires a separate PostureRay® subscription; together, "Cloud Services"); PostureScribe.AI®; and PostureRay®.

1.3 RELATED DOCUMENTS. In this Statement, these names mean PostureCo's current documents:

2. ACCESS TO YOUR RECORDS; BUSINESS ASSOCIATE ROLE#

2.1 NOT A BUSINESS ASSOCIATE BY DEFAULT. PostureCo is not a business associate by default. Using any Service, accepting or signing any PostureCo agreement, requesting a Business Associate Agreement ("BAA"), or reading this Statement does not by itself create a BAA. PostureCo agrees to act as your business associate only under a BAA you requested and both you and PostureCo fully executed (an "executed BAA"), and only for the PHI it handles through the Services that BAA covers (a BAA covering only PostureScribe.AI® does not cover Cloud Services, and vice versa). You must not provide PHI to PostureCo without one (Terms of Service, Section 8.4).

2.2 OTHERWISE, POSTURECO NEVER HAS ACCESS TO YOUR RECORDS. PostureScreen® and its apps, and PostureRay® used without PostureCo Cloud or a support plan that includes cloud backup, are local-first: the records you enter are kept on your own device and are not sent to PostureCo, they are outside PostureCo's access, custody, and control, and PostureCo does not enter into a BAA for them alone (Terms of Service, Sections 6, 8.2, and 8.3). Unless you use PostureCo Cloud Services or PostureScribe.AI® (or choose to send records to PostureCo yourself, or use a support plan that includes cloud backup), PostureCo never has access to your patient or client records. Your device, and any backup or sync service you turn on or connect, such as Apple iCloud Backup or iCloud Photos, may still copy those records off the device; such copies are outside PostureCo's control and are not covered by any BAA with PostureCo (Section 11.1; Terms of Service, Sections 7.1 through 7.4).

2.3 DE-IDENTIFIED AND AGGREGATED DATA. PostureCo automatically collects anonymized, aggregated technical and usage data and de-identified measurement data that contain no PHI and identify no one. Your agreements with PostureCo also authorize it to create de-identified data from customer content (from PHI, only as 45 C.F.R. § 164.514 allows and an executed BAA permits; otherwise, only as applicable law and those agreements permit) and to use and disclose de-identified and aggregated data, including for product improvement and AI model development (Terms of Service, Section 6; Cloud Services Agreement, Section 4.2; Privacy Policy, Sections 2.3 and 13.4). PostureCo will not create de-identified data under this authorization from records first uploaded or submitted before October 15, 2026, unless you have affirmatively accepted (for example, by clicking to accept) a version of the Terms of Service, the Cloud Services Agreement, or the PostureScribe.AI User Agreement dated October 15, 2026 or later. Otherwise, PostureCo accesses identifiable customer content only to provide, secure, and support the Services, as you authorize, as Section 8.7 of the Terms of Service describes, or as the law requires.

2.4 BLIND STORAGE; NOT A RECORDS CUSTODIAN. In the ordinary course of providing the Cloud Services, PostureCo's personnel do not view, review, or interpret your uploaded content (blind storage). PostureCo's systems process it automatically only to provide, secure, and support the Services and, where Section 6 of the Terms of Service permits, to create de-identified data. With or without a BAA, PostureCo is not a medical-records custodian or a system of record and does not provide care to your patients or clients (Terms of Service, Sections 7, 8.7, and 8.9).

3. BUSINESS ASSOCIATE AGREEMENTS: WHO NEEDS ONE AND HOW TO REQUEST ONE#

3.1 THE DECISION AND THE REQUEST ARE YOURS. It is your sole responsibility to determine whether you need a BAA with PostureCo and, if you do, to request one; PostureCo has no obligation to ask, offer, or remind you. Fitness and wellness professionals who are not covered entities or business associates generally do not need a BAA, but the decision is yours. The BAA must be fully executed by both you and PostureCo BEFORE any PHI is uploaded, transmitted, recorded, or dictated, which includes before you turn on cloud backup or synchronization for records that contain PHI, before you use PostureScribe.AI® with PHI, and before you invite any patient to RemoteScreen®. Sending PHI to PostureCo by any means without one is prohibited and at your sole risk (Terms of Service, Sections 8.1, 8.2, 8.4, and 8.9).

3.2 WHO MAY REQUEST A BAA. PostureCo enters into BAAs only with healthcare providers, covered entities, and business associates in the United States that use Cloud Services, PostureScribe.AI®, or the cloud backup and online ViewBox included in a PostureRay® technical support plan, and only at their request; it may consider a Cloud Services request from a practitioner outside the United States case by case, in its sole discretion (Terms of Service, Sections 8.2 and 8.5). Outside the United States, it is your sole responsibility to identify and comply with the laws that apply to you and to request from PostureCo any agreement those laws require (including one analogous to a BAA) before you upload information they protect; without it, you must not use Cloud Services for that information (Terms of Service, Section 9.5).

3.3 HOW TO REQUEST A BAA; A REQUEST ALONE CREATES NOTHING. Email info@postureco.com or use the contact form at https://www.postureanalysis.com/postureco-support/, with no PHI. You may supply your own BAA form for review or ask for PostureCo's standard BAA. A request creates no BAA; PostureCo may accept, negotiate, or decline any proposed BAA, and may delete PHI it receives without an executed BAA, without liability (Terms of Service, Sections 8.4 and 22.5; Cloud Services Agreement, Section 7.3).

3.4 UNDER AN EXECUTED BAA. Section 9.3 of the Terms of Service and Section 7.4 of the Cloud Services Agreement summarize what PostureCo does under an executed BAA. The executed BAA controls over this Statement and any PostureCo agreement, but only as to PHI.

4. ADMINISTRATIVE SAFEGUARDS#

Sections 4 to 6 summarize PostureCo's safeguards for Cloud Services and PostureScribe.AI® as of the date of this Statement. Administrative safeguards include designated Privacy and Security Officers (PostureCo's Chief Executive Officer and Chief Technology Officer); a documented, risk-driven security program, with privacy and security obligations communicated to personnel; production access limited to designated senior technology staff, for maintenance; blind storage (Section 2.4); incident-response and breach-notification procedures (Section 10); and signed BAAs with vendors (Section 9).

5. PHYSICAL SAFEGUARDS#

PostureCo operates no data centers of its own. Cloud Services' storage, backup, and synchronization infrastructure runs on Amazon Web Services ("AWS") (Section 7). AWS provides the physical and environmental security of its data centers, under AWS's own independent attestations (such as SOC and ISO reports), which describe AWS, not PostureCo. AWS stores Cloud Services data redundantly across multiple availability zones within its region, which does not replace your own backups; PostureCo does not guarantee the availability or recoverability of any data (Cloud Services Agreement, Sections 3, 9, and 10).

6. TECHNICAL SAFEGUARDS#

6.1 SAFEGUARDS. PostureCo's technical safeguards include TLS encryption in transit and AES-256 encryption at rest; per-organization (per-practice) data segregation enforced server-side, with storage locations segmented per account; authentication of API requests with short-lived, practice-scoped temporary credentials; multi-factor authentication, automatic session expiry, and rate-limited sign-in on the PostureCo Cloud web portal; logging of access and administrative events; and integrity checks (checksums) on cloud writes.

6.2 ENCRYPTION UNDER HIPAA. HIPAA mandates no particular encryption product; the Security Rule (45 C.F.R. § 164.312) addresses encrypting electronic PHI at rest and in transmission, and PostureCo encrypts Cloud Services data in both.

6.3 SECURITY TESTING. Vulnerability scanning, penetration testing, and any other security testing of PostureCo's services are not permitted without PostureCo's prior written authorization.

6.4 NO GUARANTEE OF ABSOLUTE SECURITY. No method of transmission or storage is completely secure; PostureCo does not guarantee that its safeguards will prevent every security incident and may change them at any time while maintaining equivalent or better protection.

7. HOSTING AND DATA LOCATION#

7.1 AMAZON WEB SERVICES; REGIONS. Cloud Services' AWS infrastructure runs under a signed Business Associate Addendum between PostureCo and AWS. Cloud Services data, including PHI, is stored and processed in AWS services that AWS designates as HIPAA-eligible; information sent to an AI provider for the AI features is processed by that provider under its own BAA with PostureCo (Section 8; PostureScribe.AI User Agreement, Section 6). During setup, you choose the AWS region for your Cloud Services data from the regions PostureCo offers (such as the United States, Europe, or Asia, where offered); absent a choice, it is stored in the United States. Choosing the correct region for your location and the laws that apply to you is your sole responsibility; PostureCo has no obligation to determine, verify, or monitor your location and relies on your selection. If you chose the wrong region or need your data moved, contact PostureCo promptly (Section 14, never with PHI); after verifying the request, PostureCo will assist by moving it to the region you designate from those PostureCo then offers and deleting it from the original region, within a reasonable time and subject to secure backup retention cycles; PostureCo does not guarantee a completion time and does not move data on its own initiative except as Section 4.1 of the Cloud Services Agreement allows. Until the move is completed, you remain solely responsible for where your data is stored (Terms of Service, Section 8.6; Cloud Services Agreement, Section 4.1). Wherever it is stored, PostureCo personnel and service providers in the United States may access it as needed to provide, secure, and support the Services (Cloud Services Agreement, Sections 4.1 and 8.1).

7.2 RETENTION AND DELETION. Cloud Services data may be permanently deleted, without notice, thirty (30) days after the applicable subscription ends, so export what you need before then (Terms of Service, Section 7). Deletion requests (subject to secure backup retention cycles) and their verification follow Section 5 of the Cloud Services Agreement and Section 6 of the Privacy Policy.

8. AI FEATURES AND THIRD-PARTY AI PROVIDERS#

8.1 AI PROVIDERS. PostureScribe.AI® is designed to send its AI providers only what is needed: the audio you record, for transcription, and the findings, notes, and instructions needed for the documentation you request. Its primary provider is SpaceXAI LLC, formerly known as xAI and now part of SpaceX ("SpaceX AI"), which serves PostureCo under a signed BAA and with zero data retention; its fallback is Amazon Bedrock, which PostureCo uses in its own AWS account under its BAA with AWS. Audio recordings are deleted when you sign off on or generate the note. The RemoteScreen® AI-Guided Health History uses SpaceX AI, and PostureCo may also use other AI providers bound by a BAA with PostureCo for it, such as AWS, including Amazon Bedrock. Both features may be used only from inside the United States at this time; using either from outside the United States (including through a VPN), or inviting anyone outside the United States to use the AI-Guided Health History, breaches the Terms of Service (Sections 4, 8.8, and 8.9) and, for PostureScribe.AI®, the PostureScribe.AI User Agreement (Section 3.2), until PostureCo formally releases that feature there, which it will do only by publishing updated terms or a written release notice on its website or in the Services (no statement by PostureCo support or sales personnel releases it). RemoteScreen® photos and videos may be sent from anywhere. Under PostureCo's arrangements, neither SpaceX AI nor AWS may use PostureScribe.AI® inputs or outputs to train its models. PostureCo sends PHI only to AI providers bound by a BAA (or an equivalent subcontractor agreement) with PostureCo and may change providers or models without prior notice, except where Section 8.3 of the Cloud Services Agreement or applicable law requires notice (PostureScribe.AI User Agreement, Sections 1.2, 1.3, and 6).

8.2 YOUR DUTIES WHEN YOU USE AI. Without an executed BAA, include no PHI in any AI input; even with one, include only the identifiers you need. AI output may be inaccurate, incomplete, or fabricated and is not medical advice, a diagnosis, or a treatment recommendation; you must review, edit, and verify every output before you use it. You must obtain every consent the law requires to record or transcribe a conversation (some states, such as Florida and California, require all parties' consent) or to process information with AI, which the confirmations RemoteScreen® asks of a patient do not replace, and follow the AI provider terms and prohibited-use rules (Terms of Service, Sections 8.8, 8.9, and 9.2; Cloud Services Agreement, Sections 4.4 and 7.5; PostureScribe.AI User Agreement, Sections 1.1, 1.9, and 6).

9. SUBCONTRACTORS AND VENDORS#

PostureCo uses and discloses customer PHI only as an executed BAA permits or the law requires. PostureCo's service providers that receive PHI act for PostureCo under BAAs with PostureCo; every third-party vendor whose services could touch customer PHI, including AWS and SpaceX AI, has signed one, and a new vendor must sign one before it is engaged. PostureCo may change vendors without prior notice, except where Section 8.3 of the Cloud Services Agreement or applicable law requires notice, while maintaining equivalent or better protection; a current list of the subcontractors that may handle PHI in Cloud Services is available on request to info@postureco.com (Cloud Services Agreement, Section 4.3). Services you choose or your devices use, such as an electronic health record, an email service, or a device or cloud backup service such as Apple iCloud, are not PostureCo's subcontractors, and any BAA they require is yours to obtain (Terms of Service, Sections 7.1 through 7.4 and 9.1).

10. SECURITY INCIDENTS AND BREACH NOTIFICATION#

10.1 PROCEDURES AND NOTICE. PostureCo maintains documented incident-response and breach-notification procedures aligned with the HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–164.414) and the Florida Information Protection Act (Fla. Stat. § 501.171). Under an executed BAA, PostureCo reports security incidents and breaches of unsecured PHI to you as the BAA provides (Terms of Service, Section 9.3), without unreasonable delay and no later than sixty (60) calendar days after discovery, or within any shorter period that the BAA or applicable law requires. Unless the executed BAA provides otherwise, notifying affected individuals, the U.S. Department of Health and Human Services ("HHS"), and, where required, the media is your responsibility. Without an executed BAA, PostureCo gives any notice that applicable law requires. Notices go to your account's contact information, so keep it current.

10.2 REPORTING A SUSPECTED INCIDENT. Report any suspected security incident involving Cloud Services, PostureScribe.AI®, or your account, such as a lost or stolen signed-in device, immediately, and in any event within five (5) business days after you discover it, to info@postureco.com or toll free at 866-577-7297, without any PHI (Terms of Service, Sections 3 and 9.2). Your report does not satisfy, or transfer to PostureCo, any notification duty you have.

11. YOUR RESPONSIBILITIES#

HIPAA compliance is a shared responsibility: a BAA with PostureCo and PostureCo's safeguards cover only PostureCo's part and do not make you compliant. Your responsibilities apply with or without a BAA and are set out in Sections 9.1 and 9.2 of the Terms of Service, which control over this summary. They include securing your own devices, accounts, exports, and backups; sending PHI to PostureCo only as Section 8.4 of the Terms of Service allows, and never by unencrypted email; using only the minimum necessary PHI; and your own notices, consents, records, risk analysis, workforce training, responses to patients' requests, and breach notifications. PostureCo cannot tell what kind of professional you are or which laws apply to you. Complying with HIPAA and similar laws that apply to you is your obligation; using any Service in violation of them is a material breach, and you must stop at once (Terms of Service, Section 9.6). Using any Service through a VPN, proxy, or other location-masking tool is a material breach of the Terms of Service; PostureCo may not detect it, and you bear every consequence of its use by you, your workforce, anyone using your account, or any patient or client you invite (Terms of Service, Sections 4.1 and 11). Nothing in this Statement limits your obligations, including your indemnification obligations, under the Terms of Service (Section 11), the Cloud Services Agreement (Section 13), or the PostureScribe.AI User Agreement (Section 2).

11.1 DEVICE AND CLOUD BACKUPS. PostureCo's apps keep your records on your own devices, and those devices, and the services you turn on, can copy them to third parties. For example, iCloud Backup can include an app's data on an iPhone or iPad, photographs saved to the Photos app are uploaded to iCloud when iCloud Photos is on, and files you export can be saved to iCloud Drive. Apple's iCloud terms do not allow covered entities or business associates to use iCloud for PHI, and encryption alone does not make a backup service appropriate for PHI. If you are a HIPAA covered entity or business associate, take these precautions on every device you use with the Services:

  • Turn off iCloud Backup for PostureCo's apps, or for the device; Apple's settings let you remove an app's information from iCloud when you turn its backup off
  • Turn off the apps' settings that save photographs and videos to the Photos app, do not save client images there yourself, and check the Photos app to confirm, unless no third-party service, such as iCloud Photos or a backup that includes the photo library, can copy the Photos app's contents off the device
  • Keep exports, and any service you connect, such as Google Drive storage, out of services that do not meet your obligations
  • Back up only by methods that do. PostureCo's backup for this is PostureCo Cloud Services (Cloud Backup in the apps), under an executed BAA where you need one; U.S. healthcare companies may request PostureCo's standard BAA (Section 3). Depending on your circumstances, other methods may include encrypted backups on computers you control and secure, or your own system of record; whether a method meets your obligations is for you and your own counsel to decide
  • Check these settings again whenever you set up, restore, or replace a device

If you work in health and fitness only and are not covered by HIPAA, these precautions are recommended but optional: whether you take them is up to you, as long as you comply with any other privacy law that applies to you.

These are examples, not a complete list. Keeping PHI out of third-party services, and any copy of it that reaches one, remain your responsibility (Terms of Service, Sections 7.1 through 7.4).

12. PATIENTS AND CLIENTS#

If you are a patient or client of a professional who uses the Services (your "provider"), your provider controls your records. PostureCo has access to them only if your provider uses Cloud Services (including RemoteScreen®) or PostureScribe.AI®, or sends them to PostureCo, and then only on your provider's behalf or as your provider's agreements with PostureCo allow (Section 2.3). Send requests about your records to your provider (PostureCo may refer them there), and do not send your health information to PostureCo. The RemoteScreen Patient App Privacy Policy (https://www.postureanalysis.com/legal/remotescreen-patient-privacy-policy/) explains what RemoteScreen® collects and how it is handled.

13. NO CERTIFICATION; INFORMATIONAL ONLY#

13.1 THERE IS NO OFFICIAL HIPAA CERTIFICATION. HHS does not certify any company, product, or service as "HIPAA certified" or "HIPAA compliant," and PostureCo claims no HIPAA certification.

13.2 NOT A WARRANTY; WHICH DOCUMENTS GOVERN. This Statement is not a warranty, guarantee, or service-level commitment and does not expand PostureCo's obligations or liability; the disclaimers and limitations of liability in the Terms of Service (Sections 12 and 13), the Cloud Services Agreement (Sections 15 and 16), and the PostureScribe.AI User Agreement apply to the fullest extent the law allows. Those agreements, the Privacy Policy, and any executed BAA (as to PHI) control over this Statement, which creates no rights for any third party, including any patient or client.

13.3 CHANGES; GOVERNING LAW; NOT LEGAL ADVICE. PostureCo may modify or replace this Statement at any time without prior notice, effective when posted. It is governed by Florida law and creates no right, claim, or obligation of its own; any dispute between PostureCo and a customer about the Services is resolved under the agreement that governs them (for example, Sections 16 and 20 of the Terms of Service: binding arbitration in Pasco County, Florida). It is not legal advice; consult your own legal counsel.

14. CONTACT#

Questions about this Statement, BAA requests, and reports of suspected security incidents (never with PHI) may be sent to PostureCo's Privacy and Security Officers:

PostureCo, Inc., Attn: Privacy and Security Officers 3152 Little Road, Suite 161, Trinity, FL 34655

Email: info@postureco.com

Phone (toll free): 866-577-7297 · International: +1-866-577-7297

Website contact form (never include PHI): https://www.postureanalysis.com/postureco-support/

Current version available at: https://www.postureanalysis.com/legal/hipaa-compliance-statement/