Get the app

Terms of Service & End User License Agreement

Last updated

On this page 23 sections

PostureCo may update this document at any time without prior notice. The date above shows when it was last updated, so please check back from time to time.

POSTURECO, INC. — TERMS OF SERVICE & END USER LICENSE AGREEMENT

LAST UPDATED: October 21, 2026

IMPORTANT NOTICE REGARDING CHANGES TO THESE TERMS: PostureCo, Inc. reserves the right to modify, update, revise, or replace these Terms of Service and End User License Agreement at any time, in its sole discretion, without prior notice. Any changes are effective immediately upon posting. PostureCo will show the new date at the top of the revised Agreement and may also tell you of a change in the Services, by email, or by asking you to accept it (Section 1). Continued access to or use of any PostureCo website, software, or service constitutes binding acceptance of the revised terms. You are responsible for reviewing this Agreement periodically. If you do not agree, you must immediately discontinue all use of the Services. A change to Section 16 does not apply to any dispute that arose, or of which PostureCo had notice, before the change was posted.

IMPORTANT NOTICE REGARDING LOCATION: You may not access or use any of the Services through a virtual private network (VPN), proxy server, or other technology that hides or changes your location (Section 4.1). If you use PostureCo Cloud Services, you choose the region where your cloud data is stored and you are solely responsible for that choice (Section 8.6). PostureScribe.AI® and the RemoteScreen® AI-Guided Health History are authorized only in the United States at this time and may be used only from inside the United States (Sections 8.8 and 8.9). Using a VPN or other location-masking technology, or using PostureScribe.AI® or the AI-Guided Health History from outside the United States, is not authorized by PostureCo and is a material breach of this Agreement that may lead to immediate suspension or termination (Section 18). Anyone who does so anyway does so entirely at their own risk, and you are responsible for the consequences, including under your indemnity (Section 11).

IMPORTANT NOTICE REGARDING BACKUPS OF PATIENT AND CLIENT INFORMATION: Your devices, and the backup and sync services that you or your organization turn on or connect, such as Apple iCloud Backup and iCloud Photos, can copy the patient and client information you keep in PostureCo's apps to servers that PostureCo does not operate or control. Apple's iCloud terms do not allow HIPAA covered entities or business associates to use iCloud for protected health information. If you are a HIPAA covered entity or business associate, you must keep PHI out of every backup, sync, or storage service that does not meet your obligations under HIPAA and the other laws that apply to you, for example by turning off iCloud Backup for PostureCo's apps and turning off the apps' settings that save client photographs and videos to the Photos app, and you must back up your data only by methods that do, such as PostureCo Cloud Services, with a BAA where you need one. If you are not, for example if you work in health and fitness only and are not covered by HIPAA, these precautions are recommended, and whether you take them is your choice, as long as you comply with any other law that applies to you (Sections 7.1 through 7.3). Either way, PostureCo is not responsible for those services or for any information in them; as Section 7.4 provides, you release PostureCo from claims about them, even claims based on PostureCo's negligence, and you are responsible for the consequences, including under your indemnity (Section 11).

1. PARTIES AND SCOPE#

These Terms of Service and End User License Agreement ("Agreement") constitute a legally binding agreement between you ("Client," "User," or "You") and PostureCo, Inc., a Florida corporation ("PostureCo," "Company," "We," or "Us").

This Agreement governs all access to and use of:

  • Any PostureCo-owned or operated website, domain, or online service
  • All software products developed, distributed, or operated by PostureCo, Inc., including but not limited to PostureScreen® and PostureRay®
  • All desktop, mobile, web-based, offline, local-only, cloud-based, or embedded software
  • All updates, upgrades, patches, beta versions, APIs, plugins, modules, integrations, artificial intelligence features, documentation, and support services
  • Any successor, replacement, or related software or service offered now or in the future (collectively, the "Services").

By accessing, downloading, installing, purchasing, registering for, or using any Services, you acknowledge that you have read, understood, and agree to be bound by this Agreement.

Acceptance by use is the default. Accessing, downloading, installing, purchasing, registering for, or using any Service also constitutes your acceptance of the Product-Specific Terms that apply to that Service and of the policies that this Agreement and those terms incorporate, including the Privacy Policy, and your acknowledgment of the HIPAA Compliance Statement (Section 1.1). This applies whether or not PostureCo shows you a click-through, a checkbox, or a request for your signature. If you do not agree, you must not access or use the Services.

PostureCo may also require your express acceptance at any time, for example by asking you to click a button or check a box when you sign up, when you sign in to PostureCo Cloud, in an app, or after an app update or release. PostureCo requires an electronic signature for the PostureScribe.AI® User Agreement, Indemnification, and Terms of Service and may require one for the PostureCo Cloud Services Agreement. Express acceptance is in addition to your acceptance by use: if PostureCo has not asked for it, or you have not yet given it, that does not mean that you have not accepted. If you decline a click-through or signature that PostureCo requires, you must stop using the affected Service, and PostureCo may restrict your access to it until you accept.

Your electronic acceptance by clicking, checking a box, or typing or drawing a signature is your electronic signature and has the same legal effect as a handwritten signature under the Electronic Signatures in Global and National Commerce Act (15 U.S.C. § 7001 et seq.) and the Florida Uniform Electronic Transaction Act (Fla. Stat. § 668.50). Your acceptance by accessing or using a Service is equally binding on you and, to the extent the law allows, has the same effect as your signature. You agree to conduct transactions with PostureCo electronically, and you consent to receive this Agreement, any Product-Specific Terms, any changes to them, and every notice, disclosure, and other communication from PostureCo electronically, by posting on its website or in the Services or by email to the address associated with your account, each of which satisfies any legal requirement that it be in writing, to the extent the law allows; an email notice is given when sent. You may access, save, and print this Agreement at the address in Section 23 and may ask PostureCo for a paper copy. PostureCo may keep records of acceptances, such as the date, the time, the account, and the version or date of the document accepted, and those records are evidence of your acceptance. PostureCo may ask you to accept a newer version of this Agreement or of any Product-Specific Terms, and, as the notice at the top of this Agreement provides, continued use of the Services after a newer version is posted is also acceptance of it.

Except as the next paragraph provides for RemoteScreen® patients and clients, you represent that you are at least eighteen (18) years of age and have the legal capacity to accept this Agreement. If you access or use the Services, or accept this Agreement, for a practice, facility, or other organization, you represent that you are authorized to bind it, "you" includes that organization, and both it and you are bound; if you are not authorized, you are personally bound. Everyone who uses the Services under your account, license, or devices must comply with this Agreement, and you are responsible for them (Section 3).

A patient or client who uses RemoteScreen® only to send information to a professional at that professional's invitation is not a customer of PostureCo, is not a party to this Agreement, and is not "you" under it. As between PostureCo and the professional who invited them, that professional is responsible for their use of RemoteScreen® and for the information they submit, including having any required Business Associate Agreement in place (Sections 8.9 and 11). The RemoteScreen® Patient App Privacy Policy (Section 1.1) is PostureCo's notice to them and describes how PostureCo handles that information. Their use of RemoteScreen® means that they acknowledge that notice and agree to use RemoteScreen® as Section 4 requires, without creating any broader contract between them and PostureCo. Section 4 (Prohibited Uses), including its prohibitions on using a VPN or other location-masking technology (Section 4.1) and on using the RemoteScreen® AI-Guided Health History from outside the United States (Section 8.9), and PostureCo's intellectual-property rights in the Services still apply to that use, and PostureCo may block any use of RemoteScreen® that is unlawful, that Section 4 prohibits, or that threatens the security or operation of the Services.

1.1 PRODUCT-SPECIFIC AGREEMENTS CONTROL. Certain Services, including but not limited to PostureRay®, may be governed by separate product-specific end user license agreements, terms and conditions, addenda, order forms, or policies ("Product-Specific Terms"). In the event of any conflict or inconsistency between this Agreement and applicable Product-Specific Terms, the Product-Specific Terms shall control, except that Section 2.2 controls as to an Apple App (as Section 2.2 defines it). Subject to Section 2.2, this Agreement applies only to the extent it does not conflict with Product-Specific Terms.

Product-Specific Terms apply to the Services they cover in addition to this Agreement and include, without limitation:

  • The PostureCo Cloud Services Agreement (https://www.postureanalysis.com/legal/cloud-services-agreement/), which governs PostureCo Cloud Services. "PostureCo Cloud Services" means PostureCo's optional cloud storage, backup, and synchronization services (formerly "SyncScreen"), the PostureCo Cloud web portal, and RemoteScreen®, and includes PostureRay® on PostureCo Cloud, which requires a separate PostureRay® subscription and may also be subject to other Product-Specific Terms
  • The PostureScribe.AI® User Agreement, Indemnification, and Terms of Service (https://www.postureanalysis.com/legal/posturescribe-ai-agreement/), which governs PostureScribe.AI®

The following policies also apply:

PostureCo's HIPAA Compliance Statement (https://www.postureanalysis.com/legal/hipaa-compliance-statement/) describes PostureCo's HIPAA program for information only. It is not a contract or a Business Associate Agreement and creates no warranty, representation, or obligation. The HIPAA rules in this Agreement, including Sections 4, 6, 8, and 9, are intended to match it, and Section 9.4 governs any difference.

2. LICENSED SERVICES — NOT A SALE#

All Services are licensed, not sold. Subject to your compliance with this Agreement and all applicable Product-Specific Terms, PostureCo grants you a limited, revocable, non-exclusive, non-transferable, non-sublicensable license to access and use the Services solely for your internal business or personal use.

All licenses are conditioned upon timely payment of all applicable fees. Fees are fully earned upon receipt and are not refundable by PostureCo unless expressly stated otherwise in applicable Product-Specific Terms; refunds of purchases made through an app store are decided by that app store (Sections 2.1 and 3.1). All rights not expressly granted are reserved by PostureCo.

2.1 APP STORES. PostureCo's apps may be obtained from third-party app stores, such as the Apple App Store and Google Play, as well as online from PostureCo. This Agreement, together with any applicable Product-Specific Terms, is the end user license agreement for every PostureCo app, however you obtain it, including when an app store listing links to it. If an app store applies its own standard end user license agreement to a PostureCo app (for example, Apple's Licensed Application End User License Agreement), this Agreement also applies to that app and to your use of the Services, as a separate agreement between you and PostureCo that you accept as Section 1 describes, and you must comply with both. If you obtain an app from an app store, that app store's own terms and usage rules also apply to your download, purchase, and use of the app, and you must comply with them as well as with this Agreement. The app store provider is not a party to this Agreement and, except as its own terms or Section 2.2 provide, has no obligation or responsibility to you for the app, including its content, maintenance, or support, or any claim relating to it. Purchases, subscriptions, renewals, cancellations, and refunds made through an app store are governed by that app store's terms (Section 3.1). If you obtain an app from Google Play, Google's terms also apply, and Google is not responsible for the app. When you use any PostureCo app, you must also comply with any third-party terms that apply to that use, such as your wireless data service agreement. PostureCo cannot verify who obtains or uses its apps (Section 9.6).

2.2 APPLE APP STORE TERMS. This Section 2.2 applies to each PostureCo app that you obtain from the Apple App Store (an "Apple App"). If it conflicts with any other term of this Agreement or of any Product-Specific Terms, this Section 2.2 controls as to the Apple App; however, to the extent applicable law permits, nothing in this Section 2.2 expands PostureCo's obligations or liability to you beyond what the rest of this Agreement and the applicable Product-Specific Terms provide. You and PostureCo acknowledge and agree that:

  • This Agreement is concluded between you and PostureCo only, and not with Apple Inc. ("Apple"), and PostureCo, not Apple, is solely responsible for the Apple App and its content. The usage rules in this Agreement are not intended to conflict with the Apple Media Services Terms and Conditions in effect when you accept this Agreement, and, to the extent that any usage rule in this Agreement conflicts with the Usage Rules in those terms, Apple's Usage Rules control as to the Apple App
  • Your license to the Apple App under Section 2 is a non-transferable license to use the Apple App on Apple-branded products that you own or control, as permitted by the Usage Rules in the Apple Media Services Terms and Conditions, except that other accounts associated with you as the purchaser may access and use the Apple App through Family Sharing or volume purchasing, where available. The license remains subject to every other condition and restriction of this Agreement, and everyone who uses the Apple App through your purchase must comply with this Agreement
  • PostureCo alone is responsible for providing any maintenance and support services for the Apple App, only as this Agreement specifies or as applicable law requires, and Apple has no obligation whatsoever to furnish any maintenance or support services for the Apple App
  • To the extent any warranty, whether express or implied by law, is not effectively disclaimed (Section 12), PostureCo, not Apple, is solely responsible for it. If the Apple App fails to conform to any applicable warranty, you may notify Apple, and Apple will refund the purchase price of the Apple App to you. To the maximum extent permitted by applicable law, Apple has no other warranty obligation whatsoever with respect to the Apple App, and, as between PostureCo and Apple, any other claims, losses, liabilities, damages, costs, or expenses attributable to any failure to conform to any warranty are PostureCo's sole responsibility, subject to Sections 12 and 13
  • PostureCo, not Apple, is responsible for addressing any claim by you or any third party relating to the Apple App or your possession or use of it, including (i) product liability claims, (ii) any claim that the Apple App fails to conform to any applicable legal or regulatory requirement, and (iii) claims arising under consumer protection, privacy, or similar legislation, including in connection with any use of Apple's HealthKit or HomeKit frameworks. Being responsible for addressing a claim is not an admission that the claim has merit or that PostureCo is liable on it. This Agreement does not limit PostureCo's liability to you beyond what applicable law permits, and, to the extent applicable law permits, Sections 5, 11, 12, and 13 continue to apply
  • In the event of any third-party claim that the Apple App, or your possession and use of it, infringes that third party's intellectual property rights, PostureCo, not Apple, will be solely responsible, as between PostureCo and Apple, for the investigation, defense, settlement, and discharge of that claim
  • You make the representations and warranties in Section 9.6 regarding embargoes, sanctions, and restricted-party lists, including that you are not located in a country that is subject to a U.S. Government embargo, or that the U.S. Government has designated as a "terrorist supporting" country, and that you are not listed on any U.S. Government list of prohibited or restricted parties
  • Questions, complaints, and claims about the Apple App should be directed to PostureCo, Inc., 3152 Little Road, Suite 161, Trinity, FL 34655; toll free telephone 866-577-7297 (+1-866-577-7297 from outside the United States); email info@postureco.com (Section 23)
  • You must comply with applicable third-party terms of agreement when using the Apple App; for example, you must not be in violation of your wireless data service agreement when you use it (Section 2.1)
  • Apple and Apple's subsidiaries are third-party beneficiaries of this Agreement as it relates to the Apple App, and, upon your acceptance of this Agreement, Apple will have the right (and will be deemed to have accepted the right) to enforce this Agreement against you as a third-party beneficiary of it (Section 21)

3. ACCOUNT AND ACCESS RESPONSIBILITY#

You are solely responsible for all activity occurring under your account, whether authorized or unauthorized. You must safeguard your login credentials and immediately notify PostureCo of any suspected misuse or security breach.

You must not, and must not allow anyone using your account to, access or use the Services through a virtual private network ("VPN"), proxy server, anonymizing network, or any other technology that hides, masks, or changes the location from which the Services are accessed (Section 4.1). Everything done through your account, including from outside the United States or through such a technology, is treated as your own act, and you are responsible for it. When you set up PostureCo Cloud Services, choosing the correct region for your data is also your responsibility (Section 8.6).

3.1 PAYMENTS; TRIALS; NO REFUNDS. Certain Services may include limited trial periods, installment payments, or deferred activation as defined in applicable Product-Specific Terms. All payments are non-refundable by PostureCo. Refunds of purchases made through an app store are decided by that app store under its own terms (Section 2.1), and Section 2.2 applies to Apple Apps. Failure to satisfy payment obligations may result in immediate suspension or deactivation of Services, loss of access to exports or cloud features, and collection efforts, including recovery of attorneys' fees and costs.

4. PROHIBITED USES#

You may not, directly or indirectly:

  • Use the Services as a medical device or diagnostic tool
  • Use the Services to diagnose, treat, cure, or prevent disease
  • Rely on the Services for clinical decision-making or patient care
  • Represent outputs as medical, diagnostic, or therapeutic conclusions
  • Establish or imply a standard of care using the Services
  • Reverse engineer, decompile, disassemble, or attempt to derive source code or otherwise use the Services or any output of the Services for competitive analysis, benchmarking, or developing a competing product or service
  • Circumvent licensing, encryption, security, or usage controls
  • Perform or permit vulnerability scanning, penetration testing, load testing, or any other security testing of the Services or of PostureCo's systems without PostureCo's prior written authorization
  • Permit unauthorized third-party access
  • Share credentials across unauthorized users, locations, or facilities
  • Access or use any of the Services, or allow anyone to access or use them, through a VPN, proxy server, anonymizing network, or any other technology that hides, masks, or changes the location from which the Services are accessed (Section 4.1)
  • Access or use PostureScribe.AI® or the RemoteScreen® AI-Guided Health History from outside the United States, or allow anyone using your account or devices, or invite or allow any patient, client, or other person, to use either of them from outside the United States, unless and until PostureCo formally releases that feature for the country or region concerned (Sections 8.8 and 8.9)
  • Upload protected health information ("PHI," as defined under HIPAA at 45 C.F.R. § 160.103) to, or store or transmit PHI on or through, PostureCo's servers or systems unless expressly permitted under a separately executed Business Associate Agreement ("BAA") and the applicable Product-Specific Terms
  • Use any Service in violation of any law that applies to you or to the information you handle, including HIPAA and laws like it anywhere in the world (Sections 9.5 and 9.6)

4.1 NO VPNS, PROXIES, OR LOCATION MASKING. No one may access or use any of the Services, including PostureCo's websites, mobile and desktop applications, the PostureCo Cloud web portal, RemoteScreen®, PostureScribe.AI®, and any API, through a virtual private network (VPN), proxy server, anonymizing network, or any other technology that hides, masks, or changes the location from which the Services are accessed, including a VPN provided by an employer or a practice. Doing so is prohibited and is a material breach of this Agreement. PostureCo may not be able to detect the use of a VPN or other location-masking technology, has no obligation to monitor for it or to detect it, and may (but need not) block, suspend, or terminate access to any or all of the Services, without notice, if it suspects such use (Section 18). You are solely responsible for every consequence of any such use by you, by your workforce, by anyone using your account, or by any patient or client you invite to RemoteScreen®, including the use of a feature where it is not available (such as PostureScribe.AI® or the RemoteScreen® AI-Guided Health History outside the United States, Sections 8.8 and 8.9), data stored in a region that is wrong for you (Section 8.6), and any resulting violation of law. To the maximum extent permitted by law, and except for PostureCo's own obligations under any executed BAA or data processing agreement or that applicable law imposes on it directly, PostureCo has no liability for any of those consequences, and they are covered by your indemnity (Section 11).

5. NO MEDICAL ADVICE; THE POSTURESCREEN® SUITE AND POSTURERAY®#

None of the Services provides medical advice. The PostureScreen® suite of fitness and wellness assessment applications (the "PostureScreen® Suite," described in Section 5.2) is not a medical device, is not FDA-regulated, and is not intended to diagnose, treat, cure, or prevent any disease or medical condition. All output of the PostureScreen® Suite is informational, observational, and non-clinical only. PostureRay® for X-ray documentation (Section 5.3) is sold only to licensed healthcare practitioners who have completed training in radiology as part of their professional coursework, either in school or in postgraduate studies. It is documentation software and does not diagnose, treat, cure, or prevent any disease or medical condition. Professional judgment and responsibility rest solely with the licensed provider or user.

5.1 PURPOSE AND USERS. PostureCo's software tools are intended for objective postural, movement, body composition, and radiographic measurement, documentation, and education purposes. They are designed for use by fitness professionals and licensed healthcare providers. These software tools are not medical devices and are not intended to diagnose, treat, cure, or prevent any disease or medical condition. All markings, landmark placements, and digitizations, whether manual or AI-assisted, must be reviewed and validated by the professional using the software. The user remains solely responsible for all interpretations, clinical judgments, diagnoses, and treatment decisions.

5.2 THE POSTURESCREEN® SUITE: FITNESS AND WELLNESS ASSESSMENT APPLICATIONS. The PostureScreen® Suite consists of PostureScreen® with its screening modules, including but not limited to its LeanScreen® body composition, SquatScreen® movement, range of motion, and seated posture modules, and the standalone LeanScreen® and SquatScreen® applications. It is a suite of fitness and wellness assessment applications. It is not a medical device, is not FDA-regulated, and is not intended to diagnose, treat, cure, or prevent any disease or medical condition. All of its output is informational, observational, and non-clinical only. The PostureScreen® Suite provides objective postural, body composition, and movement screening assessments and documentation tools for use by licensed healthcare professionals and fitness professionals, and it assists in measuring and recording postural alignment and movement patterns. All markings, landmark placements, and digitizations made in any part of the PostureScreen® Suite, whether manual or AI-assisted, must be reviewed and validated by the professional user, who retains sole responsibility for interpretation, clinical decision-making, and any diagnosis or treatment.

5.3 POSTURERAY® IS A DOCUMENTATION SYSTEM SOLD ONLY TO LICENSED HEALTHCARE PRACTITIONERS. PostureRay® for X-ray documentation is separate from the PostureScreen® Suite and is sold and licensed separately. PostureRay® is sold and licensed only to licensed healthcare practitioners who have completed training in radiology as part of their professional coursework, either in school or in postgraduate studies. By purchasing or licensing PostureRay®, you represent that you are such a practitioner, or a practice acting through one. PostureCo relies on that representation and has no obligation to verify it. PostureCo may ask for proof of licensure and training, and may decline, suspend, or terminate a PostureRay® license if it is not provided or the requirement is not met. PostureRay® is a radiographic mensuration documentation software system. It is not a replacement for clinical interpretation, and it does not diagnose. All markings, landmark placements, and digitizations, whether manual or computer vision-assisted (AI-assisted), must be reviewed and validated by the clinician using PostureRay®, and all clinical judgment, including all interpretations, diagnoses, and treatment decisions, is made solely by that clinician and not by PostureCo or PostureRay®. PostureRay® does not acquire X-rays from your x-ray machine nor replace PACS systems. It is a specialized documentation software system designed to enhance your existing imaging documentation workflow.

5.4 PROFESSIONAL RESPONSIBILITY FOR ALL MARKINGS, DIGITIZATIONS, AND OUTCOMES. The software provided as part of the Services is documentation software that can measure and record. With respect to your patients, clients, and professional work, PostureCo's role is limited to providing that software and any related optional services described in this Agreement. PostureCo does not provide medical, clinical, or other professional services to your patients or clients; does not examine, interpret, diagnose, or treat any patient or client; and does not review, check, verify, or approve any marking, digitization, measurement, report, or other output for you, including any AI-assisted output. You retain full and sole responsibility for each of the following:

  • Every marking, landmark, digitization point, calibration, measurement, line, angle, annotation, and other entry made in or with the Services, whether it was placed manually, placed by the Services' artificial intelligence features (including computer vision), or placed by those features and then accepted, edited, or left unchanged by you or by anyone using your account
  • Reviewing and validating every marking, landmark placement, digitization, calibration, and measurement for accuracy and appropriateness before you use, save, report, export, or share it for any purpose
  • All reports, exports, notes, images, and other communications you create, sign, send, or share using the Services, and anything you tell a patient, client, payer, referral source, or other professional about them
  • All interpretations, clinical judgments, diagnoses, treatment and care decisions, recommendations, referrals, and other professional decisions, and all outcomes of those decisions, of the care, services, and advice you provide, and of your use of the Services
  • The training, supervision, and conduct of your staff and of anyone else who uses the Services under your account or license, whose actions are treated as your own

Accepting, saving, or leaving unchanged any AI-assisted marking, landmark placement, digitization, or other output means that you adopt it as your own work. The fact that a marking or digitization was suggested or placed by the Services, by their artificial intelligence features (including computer vision), or by a default setting does not shift any responsibility to PostureCo. Nothing in the Services, including any measurement, comparison, graphic, score, report, or educational content, is a diagnosis, a treatment recommendation, or a substitute for your own independent professional judgment.

5.5 NO WARRANTY; OTHER SECTIONS UNCHANGED. Sections 5.1 through 5.4 describe the purpose of the Services and who is responsible for their use. They are not a representation or warranty that any measurement, marking, digitization, landmark placement, estimate, report, or other output is accurate, precise, complete, reliable, valid, or suitable for any clinical purpose. They do not expand the uses permitted by Section 2, narrow the uses prohibited by Section 4, or limit Sections 12 and 13. "AI-assisted" means generated or suggested by the Services' artificial intelligence features, including computer vision.

6. DATA OWNERSHIP AND ACCESS#

You retain ownership of all data you input into the Services. Unless you subscribe to optional cloud-based services or support plans, use PostureScribe.AI®, or choose to send data to PostureCo yourself (as the next paragraph describes):

  • Data is kept locally on your device, subject to your device's own backup and sync settings (Section 7.1)
  • PostureCo has no access, custody, or control
  • PostureCo cannot retrieve, view, restore, or recover your data.

To be explicit: PostureCo's software applications that run on your own devices, such as PostureScreen® and PostureRay®, are local-first, and the patient and client records you enter in them are kept on your own devices and systems and are not sent to PostureCo unless you send them to PostureCo in one of the ways this paragraph describes. Unless you use PostureCo Cloud Services or PostureScribe.AI®, subscribe to a support plan that includes cloud backup, or choose to send or show records to PostureCo yourself (for example, in a support request or a remote support session), PostureCo never has access to your patient or client records. PostureCo stores or processes patient or client records only in those cases, and only as this Agreement, the applicable Product-Specific Terms, and any executed BAA allow (Sections 8.7 and 9.3). You must not send or show PHI to PostureCo yourself, including for support, except as Section 8.4 allows.

Your device's operating system, and any backup, sync, or storage service that you, your organization, or anyone using your devices turns on or connects, such as Apple iCloud Backup, may copy those records off the device. Such copies are not sent to PostureCo, remain outside PostureCo's access, custody, and control, and are governed by Sections 7.1 through 7.4.

Notwithstanding the same, PostureCo reserves the right to automatically collect and use anonymized and aggregated technical and usage data (e.g., non-PHI metadata, feature usage statistics) derived from the Services for product improvement, analysis, research, and artificial intelligence model development. PostureCo may also collect and use de-identified measurement data, as described in Sections 2.3 and 13.4 of the Privacy Policy. Such data contains no PHI, does not identify any individual, and is not patient or client records for purposes of this Section 6.

In addition, you authorize PostureCo to create de-identified data from the patient and client records it stores or processes for you in the cases described above: from PHI, only in accordance with 45 C.F.R. § 164.514 and only as an executed BAA permits (Section 9.3); and from other personal information, only as applicable law, this Agreement, and the applicable Product-Specific Terms permit. PostureCo will not create de-identified data under this authorization from records first uploaded or submitted before October 15, 2026, unless you have affirmatively accepted (for example, by clicking to accept) a version of this Agreement, the PostureCo Cloud Services Agreement, or the PostureScribe.AI® User Agreement, Indemnification, and Terms of Service dated October 15, 2026 or later. PostureCo may use and disclose (including by license or sale) de-identified and aggregated data for the purposes described in this Section 6 and in Sections 2.3 and 13.4 of the Privacy Policy, including product improvement and artificial intelligence model development. PostureCo keeps de-identified data in de-identified form, does not attempt to re-identify it except as the law permits, and, where the law requires, contractually prohibits anyone to whom it discloses de-identified data from re-identifying it. Otherwise, PostureCo accesses identifiable patient or client records only to provide, secure, and support the Services, as you authorize, as Section 8.7 describes, or as the law requires.

6.1 SHARING WITH PARTNERS. PostureCo shares information about you only as described in its Privacy Policy, which forms part of this Agreement. PostureCo's partners are CBP Seminars, Inc., CBP Non-Profit, Inc., WebExercises, Inc., 3D Practice, and any company with which PostureCo later establishes an integration or partnership, as listed in Section 7.1 of the Privacy Policy. PostureCo does not share your information with any other third party for that third party's own marketing. PostureCo never sells or shares mobile telephone numbers or text-messaging consent with its partners or any other third party (Section 22.7).

7. DATA LOSS, BACKUPS, AND DELETION#

PostureCo is not responsible for data loss, corruption, deletion, or overwriting arising from device failure, operating system or application updates, sync failures, encryption failures, cloud outages, third-party services, malware, ransomware, hacking, or user error. You are solely responsible for maintaining independent, redundant backups of your data, using only backup methods that meet your legal obligations (Section 7.3).

Any data stored on PostureCo servers pursuant to optional cloud services or technical support plans may be permanently deleted thirty (30) days after termination or expiration of the applicable subscription, without notice and without liability.

PostureCo does not provide archival services and is not a medical-records custodian, and none of the Services, including PostureCo Cloud Services, is a system of record for any legal record-retention obligation. You are solely responsible for keeping complete records in your own system of record for as long as the law requires, and for retrieving any data you wish to keep before it is deleted.

7.1 THIRD-PARTY BACKUP, SYNC, AND STORAGE SERVICES, INCLUDING APPLE iCLOUD. PostureCo's apps run on phones, tablets, computers, and operating systems that PostureCo does not make, operate, or control, such as Apple iPhone, iPad, and Mac devices and Microsoft Windows computers. Those devices and operating systems, and the backup, synchronization, storage, file-sharing, email, and device-management services that you, your organization, or anyone using your devices turns on or connects, can copy, back up, synchronize, or store the information you keep in or export from the Services on servers that third parties operate (each, a "Third-Party Backup Service"). That information can include patient and client records, demographics, photographs, videos, measurements, notes, reports, signed forms, and audio recordings. Third-Party Backup Services include, for example, Apple iCloud Backup, iCloud Photos, iCloud Drive, and iCloud Mail; Google Drive and other Google backup and storage services; Microsoft OneDrive and Windows Backup; Dropbox and Box; other cloud backup software and services; and backups of a device made to a computer, server, or storage service that you do not control. They also include any third-party service that you choose to connect through the Services, such as Google Drive (through the "Allow Google Drive Storage" option) or a third-party electronic health record system (through an electronic health record connection), which, once you turn the connection on, may receive records automatically. No Service that PostureCo itself provides, and no service provider that PostureCo uses to provide one, such as Amazon Web Services, is a Third-Party Backup Service; this includes PostureCo Cloud Services (and the Cloud Backup feature in PostureCo's apps), PostureScribe.AI®, and the cloud backup and online ViewBox included in a PostureRay® technical support plan.

For example, if iCloud Backup is turned on for an iPhone or iPad, Apple's backup can include the information that PostureScreen® and PostureCo's other apps keep on that device, unless you turn off iCloud Backup for those apps or for the device. PostureScreen® can save copies of the client photographs you take, and, if you choose, client videos, to the device's Photos app (the "Save images to device Photos app" and "Save videos to device Photos app" settings, or any similar setting), and, on a new installation, the setting for photographs may be on until you turn it off in PostureScreen® itself, whatever any other settings screen shows. Photographs and videos in the Photos app are uploaded to iCloud when iCloud Photos is turned on, and, when iCloud Photos is off, they can be included in iCloud Backup. A file that you export or share, for example through the device's share sheet, may be saved to iCloud Drive or to another service you choose. Whether and when any of this happens is controlled by your device settings, your accounts, and your organization's systems, under each provider's own terms, and not by PostureCo.

Apple's iCloud terms, as of the date shown at the top of this Agreement, state that a covered entity or business associate, as HIPAA defines those terms, or a representative of either, must not use iCloud to create, receive, maintain, or transmit protected health information, or use iCloud in any way that would make Apple (or an Apple subsidiary) its or any third party's business associate. Many other consumer backup and cloud services do not offer, or will not sign, a business associate agreement. Under guidance from the U.S. Department of Health and Human Services, a cloud service provider that stores electronic PHI on behalf of a covered entity or business associate is generally a business associate even if it stores only encrypted PHI and does not have the key to decrypt it, so encrypting a backup, including with an end-to-end encryption option that a provider offers (such as Apple's Advanced Data Protection), does not by itself make a service appropriate for PHI. PostureCo makes no representation that any Third-Party Backup Service, or any setting of one, is suitable or lawful for PHI or for any other patient or client information. PostureCo is not affiliated with, or endorsed by, Apple or the provider of any other Third-Party Backup Service.

7.2 KEEPING PHI OUT OF THIRD-PARTY BACKUPS IS YOUR RESPONSIBILITY. Each Third-Party Backup Service is provided to you by its provider under your own agreement with that provider. Copies made by or in a Third-Party Backup Service are made through your devices, settings, accounts, and choices, and are held by that provider. PostureCo does not receive, access, view, store, or control those copies, and any copy that PostureCo's software sends to a service you connect, such as Google Drive, is sent from your device, under your own account with that service, because you turned that connection on. PostureCo does not select, review, approve, configure, or monitor any Third-Party Backup Service; is not a party to your agreement with its provider; and does not act for you in any dealing with it. No Third-Party Backup Service is PostureCo's service provider or subcontractor, no BAA with PostureCo covers any information in one, and PostureCo is not your business associate for it.

If you are subject to HIPAA, or to any other law that protects health or personal information, you are solely responsible for determining whether each Third-Party Backup Service that can reach your devices or records may lawfully hold PHI or other patient or client information; for obtaining, before it does, any business associate agreement or other agreement that the law requires; and, where it may not lawfully hold that information, for keeping the information out of it. You must do so on every device and account you use with the Services, before you enter PHI in the Services and for as long as PHI remains on the device. The steps you should take include, for example:

  • Turning off iCloud Backup for PostureScreen® and for every other PostureCo app that holds PHI, or turning off iCloud Backup for the device, in the device's iCloud settings; on an iPhone or iPad, for example, Apple's settings let you turn off iCloud Backup for an app and remove that app's information from iCloud at the same time
  • Turning off the "Save images to device Photos app" and "Save videos to device Photos app" settings in PostureScreen®, not using "Save Image" or any other option that saves patient or client images to the Photos app, and checking the Photos app itself to confirm that no patient or client images are being saved there, unless no Third-Party Backup Service, such as iCloud Photos, a photo-sharing service, or a backup that includes the photo library, can copy the Photos app's contents off that device
  • Not exporting, sharing, emailing, or saving PHI to iCloud Drive, iCloud Mail, or any other Third-Party Backup Service that does not meet your obligations, and turning on a connected service, such as the "Allow Google Drive Storage" option, only under an account and an agreement with its provider that meet them
  • Letting a device trust, synchronize with, or back up to a computer only if you control and secure that computer and its storage, and backing a device up to a computer only with the backup's encryption turned on
  • Removing, under the provider's own procedures, any PHI that a Third-Party Backup Service already holds and may not lawfully hold
  • Checking these settings again whenever you set up, restore, replace, or update a device or its operating system, or sign in to it with a different account, because those events can change them
  • Using mobile device management, where your practice uses it, to apply these settings to the devices it manages
  • Making sure that your workforce, and anyone else who uses your devices or accounts, follows these steps

If you are a HIPAA covered entity or business associate, you should take these steps, or other steps that are at least as protective, to meet that responsibility. If you are not, for example if you work in health and fitness only and are not covered by HIPAA, these steps are recommended, and whether you take them is your choice, as long as you comply with any other law that applies to you, such as a state health-privacy or consumer-health-data law. In either case, the choice and its consequences are yours, and Sections 7.3 and 7.4 apply.

These steps are examples only, and they are not a complete list. Device settings, menu names, and providers' terms change, and you must follow the current instructions of your device and service providers and the advice of your own legal counsel. Any reminder, instruction, help article, or setting that PostureCo provides about Third-Party Backup Services is for your convenience only and does not make PostureCo responsible for them.

7.3 YOUR BACKUPS MUST BE INDEPENDENT AND LAWFUL. Keeping PHI out of a Third-Party Backup Service does not relieve you of your responsibility to back up your data (Section 7), or of any data backup plan that the HIPAA Security Rule or any other law requires of you, and any loss of data that you have not backed up is your responsibility. Your backups must be both independent and lawful. PostureCo's own backup for this purpose is PostureCo Cloud Services (the Cloud Backup feature in PostureCo's apps) or, for PostureRay®, the cloud backup included in a PostureRay® technical support plan, used as Sections 8 and 9 require, including, for a U.S. healthcare company that needs one, under a fully executed BAA that covers them; a U.S. healthcare company may request PostureCo's standard BAA for them (Section 8.2). Depending on your circumstances, other backup methods that may meet your obligations include encrypted backups on computers and storage devices that you control and secure; your own electronic health record or other system of record; and any other service that you have confirmed meets your obligations, including through any business associate agreement they require. PostureCo Cloud Services are not a complete or exclusive backup solution (Section 7 and Section 3 of the PostureCo Cloud Services Agreement). Information that PostureCo Cloud Services synchronize to your devices is again on those devices, and Section 7.2 applies to it there.

7.4 POSTURECO IS NOT RESPONSIBLE FOR THIRD-PARTY BACKUP SERVICES; YOUR RELEASE AND INDEMNITY. PostureCo may, but need not, offer settings, reminders, or features that affect what its apps save to a device's Photos app or what a device backs up or synchronizes; it may change or remove them at any time; and it does not promise that any of them prevents every copy. Their presence, absence, or default value, including any default that saves photographs to the Photos app or leaves app data in a device backup, does not shift any responsibility to PostureCo.

AS BETWEEN YOU AND POSTURECO, AND TO THE MAXIMUM EXTENT PERMITTED BY LAW, POSTURECO IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD-PARTY BACKUP SERVICE OR FOR ANY INFORMATION IN IT OR SENT THROUGH IT, INCLUDING ANY BACKUP, SYNCHRONIZATION, COPYING, STORAGE, RESTORATION, RETENTION, ACCESS, USE, DISCLOSURE, LOSS, CORRUPTION, OR SECURITY INCIDENT, OR FOR ANY FAILURE TO KEEP PHI OUT OF ONE (EACH, A "BACKUP MATTER"). YOU RELEASE POSTURECO AND ITS OFFICERS, DIRECTORS, EMPLOYEES, CONTRACTORS, AGENTS, LICENSORS, AND AFFILIATES (TOGETHER, THE "RELEASED PARTIES") FROM, AND AGREE NOT TO BRING AGAINST ANY OF THE RELEASED PARTIES, ANY CLAIM ARISING OUT OF OR RELATED TO ANY BACKUP MATTER, WHETHER BASED ON CONTRACT, TORT, STATUTE, OR ANY OTHER THEORY, AND EVEN IF THE BACKUP MATTER OR THE CLAIM IS CAUSED, OR IS ALLEGED TO BE CAUSED, IN WHOLE OR IN PART BY THE NEGLIGENCE OF POSTURECO OR OF ANY OTHER RELEASED PARTY, BY ANY SETTING OR DEFAULT OF THE SERVICES, BY YOU OR ANYONE USING YOUR ACCOUNT OR DEVICES, OR BY THE PROVIDER OF THE THIRD-PARTY BACKUP SERVICE, AND WHETHER OR NOT YOU TOOK THE STEPS THAT SECTION 7.2 DESCRIBES. YOU MUST ALSO DEFEND, INDEMNIFY, AND HOLD HARMLESS THE RELEASED PARTIES, AS SECTION 11 PROVIDES, AGAINST EVERY CLAIM BY ANYONE ELSE, INCLUDING YOUR PATIENTS AND CLIENTS AND ANY GOVERNMENT AUTHORITY, AND EVERY FINE, PENALTY, LOSS, AND EXPENSE, ARISING OUT OF OR RELATED TO ANY BACKUP MATTER.

This Section 7.4 does not exclude PostureCo's liability for, release, or bar you from bringing under Section 16, any claim to the extent that it arises from PostureCo's gross negligence, willful misconduct, or fraud, and asking an arbitrator under Section 16 to decide whether a claim is released is not a breach of this Section 7.4. Your indemnity for Backup Matters does not apply to the extent that a final decision of an arbitrator or court determines that a loss was caused by PostureCo's gross negligence, willful misconduct, or fraud. This Section 7.4 does not limit PostureCo's own obligations under an executed BAA as to PHI that PostureCo itself creates, receives, maintains, or transmits through the Services that the BAA covers (including through PostureCo Cloud Services), any obligation that applicable law imposes on PostureCo directly and that cannot be waived or limited by contract, or any right of a government authority. If this Section 7.4 conflicts with an executed BAA, the BAA controls, but only as to PHI that PostureCo creates, receives, maintains, or transmits on your behalf through the Services the BAA covers (Section 9.3). Sections 7.1 through 7.4 survive termination.

8. CLOUD SERVICES (OPTIONAL)#

Cloud-based services, including backups, virtual viewbox access, artificial intelligence modules, and browser-based tools, are optional, subscription-based, and provided "AS IS" and "AS AVAILABLE." Discontinuation of the applicable subscription or support plan will result in loss of access to these features without affecting local software functionality.

8.1 HIPAA POSITION. PostureCo is not a Business Associate by default. Using any Service, including PostureCo Cloud Services or PostureScribe.AI®, does not by itself create a BAA. PostureCo agrees to act as your business associate only under an executed BAA, and you must not provide PHI to PostureCo without one (Section 8.4). It is your sole responsibility to determine whether a BAA is required and, if it is, to affirmatively request one from PostureCo, supplying your own proposed BAA or asking for PostureCo's standard BAA, and to make sure it is fully executed by both you and PostureCo before any PHI reaches PostureCo, including before you turn on cloud sync or invite patients to RemoteScreen® (Section 8.2). Any unauthorized upload of PHI is at your sole risk.

8.2 WHO MAY REQUEST A BAA; REQUESTING ONE IS YOUR RESPONSIBILITY. Section 8.1 applies to every user. Except as Section 8.5 provides for practitioners outside the United States, PostureCo enters into a BAA only with a healthcare provider, covered entity, or business associate under HIPAA that is located in the United States (a "U.S. healthcare company"), only for its use of PostureCo Cloud Services (including RemoteScreen® and PostureRay® on PostureCo Cloud), PostureScribe.AI®, the cloud backup and online ViewBox included in a PostureRay® technical support plan, or any combination of them, and only at its request. PostureCo does not enter into a BAA for any other Service, including the mobile applications used alone (Section 8.3). If you are a U.S. healthcare company, or are otherwise subject to HIPAA, and you use PostureCo Cloud Services, PostureScribe.AI®, or a PostureRay® technical support plan's cloud backup or online ViewBox, the onus is entirely on you to determine whether a BAA is required and, if it is, to request one from PostureCo by email to info@postureco.com or through the contact form on PostureCo's website (https://www.postureanalysis.com/postureco-support/), without including any PHI in your request. You may supply your own proposed BAA for PostureCo's review or ask for PostureCo's standard BAA. The BAA must be fully executed by both you and PostureCo before any PHI is uploaded, transmitted, recorded, or dictated, which includes before you set up or turn on cloud backup or synchronization for records that contain PHI (once it is on, the Services may upload your records automatically; Section 7.3 of the PostureCo Cloud Services Agreement), before you use PostureScribe.AI® with PHI, and before you invite any patient to RemoteScreen® (Section 8.9). PostureCo has no obligation to ask whether you need a BAA, to offer one, or to remind you. A request alone does not create a BAA, and no BAA exists unless and until it is fully executed by both you and PostureCo. PostureCo may accept, negotiate, or decline any proposed BAA, except to the extent the applicable Product-Specific Terms expressly provide otherwise. A BAA covers only the Services it names. For example, a BAA that covers PostureScribe.AI® but not PostureCo Cloud Services does not permit PHI in PostureCo Cloud Services, and a BAA that covers PostureCo Cloud Services but not PostureScribe.AI® does not permit PHI in PostureScribe.AI®. Until a BAA that covers the Service in question is fully executed, you must not upload, transmit, record, or dictate any PHI to or through PostureCo's servers or systems, including through PostureCo Cloud Services, RemoteScreen®, or PostureScribe.AI®, and any PHI you do upload, transmit, record, or dictate is at your sole risk (Sections 4, 8.1, and 8.4). The applicable Product-Specific Terms, including the PostureScribe.AI® User Agreement, Indemnification, and Terms of Service and the PostureCo Cloud Services Agreement, may set further conditions on whether a BAA is available and on what terms.

8.3 NO BAA FOR MOBILE APPS ALONE. PostureCo does not enter into a BAA for the use of its iOS, iPadOS, or Android mobile applications alone, such as PostureScreen® and its screening modules used without a PostureCo Cloud Services subscription, PostureScribe.AI®, or a support plan, because, as described in Section 6, the data you enter in those applications is kept locally on your device, subject to your device's own backup and sync settings (Section 7.1), and, except for data you choose to send to PostureCo through optional cloud-based services, PostureScribe.AI®, or a support plan, PostureCo has no access, custody, or control of it. Data kept only on your own device in this way is not uploaded to or stored on PostureCo's systems. Whether a BAA is available for PostureCo Cloud Services, PostureScribe.AI®, or any other optional service is governed by Section 8.2 and the applicable Product-Specific Terms. Protecting the data on your device, including device security, passcodes, encryption, exports, and backups, is your sole responsibility, including deciding whether your device or any Third-Party Backup Service, such as Apple iCloud Backup, may copy it; no BAA with PostureCo covers any such copy (Sections 7.1 through 7.4).

8.4 DO NOT SEND PHI TO POSTURECO WITHOUT A BAA, INCLUDING FOR SUPPORT. Unless a BAA between you and PostureCo is fully executed and in effect, you must not send, upload, show, or otherwise transmit any PHI to PostureCo, by any means. This includes every request for technical support or troubleshooting, whether by email, support ticket, the website contact form, chat, text message, telephone, file upload, or remote screen-sharing session. Unless such a BAA is in effect, before you send PostureCo any documentation, report, export, image, X-ray, screenshot, recording, log, or other file, or start a remote support session, you must remove, redact, or hide all patient and client identifiers and other PHI, and you must never simply email patient or client documentation that has not been redacted. Even when a BAA is in effect, you may send PHI to PostureCo only through secure, encrypted means: the Services' encrypted features that the BAA covers, or another secure, encrypted method that PostureCo has approved in writing for that purpose, and never by unencrypted email. PostureCo may delete any PHI it receives in breach of this Section 8.4 and is not responsible for it, and you remain solely responsible for any such transmission.

8.5 BAAS ONLY IN THE UNITED STATES. Except as this Section 8.5 provides, PostureCo enters into BAAs only with persons and organizations located in the United States, and it does not sign BAAs or similar health-information agreements with persons or organizations outside the United States, other than the data processing terms, standard contractual clauses, and data processing agreement described in Section 9.5 and Section 8 of the PostureCo Cloud Services Agreement. If a healthcare practitioner outside the United States wishes to use PostureCo Cloud Services, or the cloud backup or online ViewBox included in a PostureRay® technical support plan, PostureCo may consider a request on a case-by-case basis, in its sole discretion. The onus is on that practitioner to supply PostureCo with all documentation PostureCo needs to verify the request, including any proposed agreement for PostureCo to review and, where PostureCo considers it appropriate, sign. PostureCo has no obligation to agree to any such request. You must state accurately where you and your practice are located in any BAA request, and PostureCo may rely on that statement without verifying it. For Sections 8.2 and 8.5, your location is where you and your practice actually are, not where you appear to access the Services from, and using a VPN or other location-masking technology (Section 4.1) does not change it. If you are a healthcare provider or other professional outside the United States, Section 9.5 also applies, including your sole responsibility to identify, request, and supply any agreement or other requirement that your own law imposes before you upload any information it covers.

8.6 WHERE CLOUD DATA IS STORED; YOU CHOOSE THE REGION. PostureCo Cloud Services' storage, backup, and synchronization infrastructure runs on Amazon Web Services ("AWS"), under a signed Business Associate Addendum between PostureCo and AWS. PostureCo Cloud Services data, including PHI, is stored and processed in AWS services that AWS designates as HIPAA-eligible; information sent to an AI provider for the artificial intelligence features is processed by that provider under its own BAA with PostureCo (Section 8.8 and Section 6 of the PostureScribe.AI® User Agreement, Indemnification, and Terms of Service). PostureCo uses regional AWS infrastructure. During setup, you choose, directly in the Services, the location (AWS region) where your PostureCo Cloud Services data is stored, from the regions PostureCo offers at the time (for example, the United States, Europe, or Asia, where offered). PostureCo does not promise that any particular region, or a region for every country, is available, and it may add, change, or retire regions. Choosing the correct region for your location and for the laws that apply to you and to your patients and clients, including data-residency, data-protection, and health-information laws such as HIPAA, the GDPR, and the UK GDPR, is your sole responsibility. PostureCo is not required to, and does not undertake to, determine, verify, or monitor where you, your workforce, or your patients or clients are located, and it cannot reliably tell, for example because someone may connect through a VPN in breach of Section 4.1. Any location, network, or VPN check that PostureCo chooses to use is for its own protection only, may be inaccurate or incomplete, and does not make PostureCo responsible for anyone's location, for your choice of region, or for any use of the Services or of a feature where it is not available. PostureCo stores your cloud data in the region you select and relies on your selection. If the Services offer you no choice, or you make none, your cloud data is stored in the United States.

If you selected the wrong region, set up your data outside your country by mistake, or later need your data moved to another region, you must contact PostureCo support promptly once you realize it, by email to info@postureco.com, toll free at 866-577-7297 (+1-866-577-7297 from outside the United States), or through the contact form on PostureCo's website (https://www.postureanalysis.com/postureco-support/), without including any PHI in your request. After verifying your request (as Section 6 of the Privacy Policy describes), PostureCo will assist you: it will manually move your data to the correct region, which you designate from the regions PostureCo then offers, and delete it from the previous region, including any region where it was created by mistake, within a reasonable time, subject to secure backup retention cycles (copies in backups expire on their normal cycle and remain protected until then). By asking PostureCo to move your data, you instruct and authorize PostureCo to transfer it between the regions concerned. If no region that PostureCo then offers is suitable for you, PostureCo has no obligation to offer another one, its only obligation as to that data is to delete it at your verified request (subject to the same backup retention cycles), and you must stop storing that data in PostureCo Cloud Services; retrieving any data you wish to keep before it is deleted is your responsibility (Section 7). PostureCo does not guarantee any completion time. Except as Section 4.1 of the PostureCo Cloud Services Agreement allows (for example, if a region becomes unavailable or is retired, or as needed to provide, secure, or support the Services or to comply with law), PostureCo does not move your data to another region on its own initiative. Until the move is completed, and for any period before you tell PostureCo, you are solely responsible for your data being stored and processed in the region you selected (or in the United States, if you made no selection), including every legal consequence of it, and, to the maximum extent permitted by law and except for PostureCo's own obligations under any executed BAA or data processing agreement or that applicable law imposes on it directly, PostureCo has no liability for it (Section 11).

Within a region, AWS stores data redundantly across multiple availability zones. Wherever your data is stored, PostureCo's personnel and service providers in the United States may access it as needed to provide, secure, and support the Services, subject to Section 8.7 and any executed BAA. PostureScribe.AI® and the RemoteScreen® AI-Guided Health History are processed in the United States, whatever region you choose, and are offered and authorized only in the United States at this time. The PostureCo Cloud Services Agreement (Sections 4 and 8) and the Privacy Policy (Section 10) describe hosting and international transfers in more detail. You are solely responsible for determining whether storing and accessing your data as this Section 8.6 describes complies with the laws that apply to you, and use of the Services outside the United States is at your sole risk. PostureScribe.AI® and the AI-Guided Health History, however, are not merely at your risk outside the United States: accessing or using either of them from outside the United States is not authorized by PostureCo, is prohibited, and is a material breach of this Agreement (Sections 4, 8.8, and 8.9), and any such use is also entirely at your own risk.

8.7 WHEN POSTURECO HAS ACCESS TO YOUR DATA. PostureCo has access to patient or client records only in the cases Section 6 describes. In those cases, PostureCo stores and processes them only as this Agreement, the applicable Product-Specific Terms, and any executed BAA allow and, for PHI covered by an executed BAA, only as that BAA permits. In the ordinary course of providing PostureCo Cloud Services, PostureCo's personnel do not view, review, or interpret your uploaded content (blind storage). PostureCo's systems process it automatically only to provide, secure, and support the Services and, where Section 6 permits, to create de-identified data. Access to production systems is limited to designated senior technology staff, for maintenance. PostureCo may also access, use, or disclose stored data when you ask it to (for example, for support, subject to Section 8.4); when needed to secure the Services or to investigate a security incident or a suspected breach of this Agreement; when the law requires it; where the law permits, to establish, exercise, or defend legal claims, to protect the rights, property, or safety of PostureCo, you, or others, and for PostureCo's proper management and administration, including by disclosure to PostureCo's legal, insurance, and accounting advisers under a duty of confidentiality; and, in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of PostureCo's business or assets, to the successor or acquirer, subject to the same protections that this Agreement provides and to any executed BAA. In every case, PostureCo uses and discloses customer PHI only as an executed BAA permits or the law requires, and PostureCo's service providers that receive PHI act for PostureCo under BAAs with PostureCo.

For the patient and client information you upload or submit through the Services, you decide why and how it is processed, and PostureCo processes it on your behalf: as your business associate where an executed BAA is in effect, and as your service provider or processor under U.S. state privacy and consumer-health-data laws, the GDPR, and the UK GDPR, to the extent those laws apply. PostureCo does not sell or share that information (as those laws define those terms). De-identified data is governed by Section 6. A data processing agreement is available on request (Section 8 of the PostureCo Cloud Services Agreement). PostureCo's safeguards include encryption in transit (TLS) and at rest (AES-256), per-practice data segregation enforced on the server, multi-factor authentication on the PostureCo Cloud web portal, and logging of access and administrative events, as the HIPAA Compliance Statement describes. PostureCo may change its safeguards and service providers at any time while maintaining equivalent or better protection, giving any notice of a new or replacement subprocessor that Section 8.3 of the PostureCo Cloud Services Agreement or applicable law requires. No method of storage or transmission is completely secure, and PostureCo does not guarantee that data will never be accessed, disclosed, altered, or lost without authorization. PostureCo is not a medical-records custodian, and PostureCo Cloud Services are not a system of record (Section 7).

8.8 THIRD-PARTY AI PROVIDERS. PostureScribe.AI® and the RemoteScreen® AI-Guided Health History use third-party artificial intelligence providers. PostureCo's primary provider for them is SpaceXAI LLC, the company formerly known as xAI and now part of SpaceX, which provides the Grok models ("SpaceX AI"). SpaceX AI provides AI services to PostureCo under a signed Business Associate Agreement and with zero data retention, meaning that it does not retain the data it processes for PostureCo. PostureCo's fallback provider for PostureScribe.AI® is Amazon Bedrock, which PostureCo uses within its own AWS account under PostureCo's BAA with AWS. Under PostureCo's arrangements, neither provider may use PostureScribe.AI® inputs or outputs to train its models. PostureScribe.AI® sends the AI provider the audio you record, for transcription, and the exam and assessment findings, notes, prompts, and instructions needed to produce the documentation you request, and PostureCo designs it to send only what is needed for that purpose. PostureCo may add, change, or replace AI providers or models at any time without prior notice, except where Section 8.3 of the PostureCo Cloud Services Agreement or applicable law requires notice, but it sends PHI only to AI providers bound by a BAA (or an equivalent subcontractor agreement) with PostureCo. The PostureScribe.AI® User Agreement, Indemnification, and Terms of Service names PostureCo's current AI providers and, in Section 6, the third-party AI provider terms that apply to your use, including the SpaceX AI Acceptable Use Policy, the AWS Acceptable Use Policy, and the AWS Responsible AI Policy. You must comply with those terms. You must not use any AI feature for an unlawful or harmful purpose, to infringe anyone's privacy or intellectual property, to generate false or misleading clinical documentation, or to reverse engineer or extract any model, and you must not access or use any AI feature through a VPN or other location-masking technology (Section 4.1). PostureScribe.AI® and the RemoteScreen® AI-Guided Health History may be used only from inside the United States (the next paragraph and Section 8.9). PostureCo may suspend or disable your access to AI features if it suspects that any of these rules has been broken. AI output may be inaccurate, incomplete, fabricated, or offensive. You must review, edit, and verify every output before you use it, and no AI output is medical advice, a diagnosis, or a treatment recommendation (Sections 5.4 and 12). Unless a BAA that covers the feature you are using is in effect (Section 8.2), you must not include PHI in any input to an AI feature (Section 8.4), and even when such a BAA is in effect, you should not dictate or enter identifiers that are not needed.

PostureScribe.AI® is offered and authorized only in the United States at this time. Accessing or using PostureScribe.AI® from outside the United States, whether by you, by your workforce, or by anyone using your account or devices, and including through a VPN or other location-masking technology, is not allowed or authorized by PostureCo, is prohibited (Section 4), and is a material breach of this Agreement and of Section 3.2 of the PostureScribe.AI® User Agreement, Indemnification, and Terms of Service, unless and until PostureCo formally releases PostureScribe.AI® outside the United States, which PostureCo will do only by publishing updated terms or a written release notice on its website or in the Services; no other statement, including one by PostureCo support or sales personnel, releases it. A release applies only to the countries or regions, and only on the terms, that the published updated terms or release notice expressly name; any access to or use of PostureScribe.AI® from anywhere else outside the United States, or otherwise than on those terms, remains a material breach of this Agreement and of the PostureScribe.AI® User Agreement, Indemnification, and Terms of Service. Except as such a release expressly provides, nothing in this Agreement or in any Product-Specific Terms licenses or permits the use of PostureScribe.AI® outside the United States. Anyone who circumvents this restriction does so entirely at their own risk, and you must defend, indemnify, and hold harmless PostureCo completely, as Section 11 provides, for any such use by you, by your workforce, or by anyone using your account or devices, and for that breach. PostureCo makes no claim, representation, or warranty that PostureScribe.AI® complies with any law outside the United States, including the GDPR or any similar law. PostureCo has no obligation to determine or verify where PostureScribe.AI® is used, and its failure to detect or block a use from outside the United States does not excuse or waive the breach. PostureCo may suspend, terminate, or disable PostureScribe.AI®, or your access to it, for any such use, with or without notice and, to the extent the law allows, without refund (Sections 3.1 and 18).

Sections 8.6 through 8.8 describe PostureCo's current hosting, safeguards, service providers, and AI providers, including what those providers have agreed with PostureCo and what they state about their own services, on which PostureCo relies. They are not a warranty, and they do not guarantee the performance of AWS, of any AI provider, or of any other third party. PostureCo does not operate the infrastructure of AWS or the systems of any AI provider, and it may change these practices as those Sections allow. Sections 12 and 13 apply.

8.9 REMOTESCREEN® AND YOUR PATIENTS. RemoteScreen® is part of PostureCo Cloud Services and requires your PostureCo Cloud Services subscription. It lets you send a patient or client a link that they open in a web browser on their phone, or in a RemoteScreen® app where one is offered, to enter identifying details, take guided posture photographs and a guided movement video, and, where your plan includes it and only from inside the United States, complete the AI-Guided Health History by voice. The in-browser posture guidance runs on the patient's own device. The photographs, videos, and intake results are uploaded to your PostureCo Cloud account, and the patient cannot read back your records through RemoteScreen®. PostureCo handles this information on your behalf, as Sections 6 and 8.7 describe. PostureCo is not your patients' or clients' healthcare provider, does not provide them with care or advice, and directs their requests about their records to you. The RemoteScreen® Patient App Privacy Policy (Section 1.1) is PostureCo's notice to them, and your own notice of privacy practices governs your use of their information. You are solely responsible for:

  • Having a fully executed BAA with PostureCo that covers PostureCo Cloud Services before you invite any patient to RemoteScreen®, if you are a covered entity or business associate under HIPAA (Section 8.2)
  • Giving every notice, and obtaining every consent and authorization, that the law requires before a patient or client uses RemoteScreen®, including for photographs and videos, for recording and transcribing the AI-Guided Health History, and for processing their information with artificial intelligence. The confirmations RemoteScreen® asks a patient for before the AI-Guided Health History (that they are not having a medical emergency, that the AI does not give medical advice, and that they consent to being recorded for transcription) do not replace them
  • Sending each link only to the intended person, and obtaining any consent that the Telephone Consumer Protection Act or any other law requires before you send a link or other message by text message or place a call
  • Telling every patient and client you invite not to use a VPN, proxy server, or other location-masking technology with RemoteScreen® (Section 4.1), and not inviting or allowing any patient or client who is outside the United States to use the AI-Guided Health History (as described below)
  • Making sure, because RemoteScreen® is not directed to children under thirteen (13) and PostureCo does not knowingly collect personal information directly from a child under thirteen (13), that a parent or legal guardian completes RemoteScreen® on behalf of any child under thirteen (13), so that the child does not use it on their own, and that the parent or legal guardian, not the child, gives every consent and confirmation RemoteScreen® asks for; that a minor aged thirteen (13) to seventeen (17) uses RemoteScreen® only with the permission of a parent or legal guardian and as you allow; and that every consent of a parent or legal guardian that the law requires, including any parental consent the Children's Online Privacy Protection Act requires, is obtained before the minor uses RemoteScreen®
  • Reviewing every submission, following up with the patient or client, and making every clinical judgment yourself (Section 5.4)

RemoteScreen® is not for emergencies or real-time monitoring, and a submission may be delayed, incomplete, or not received. You are responsible for telling your patients and clients to call their local emergency number, and not to use RemoteScreen®, in an emergency.

The RemoteScreen® AI-Guided Health History (the artificial intelligence voice medical and patient-history intake with the AI assistant) is available only in the United States at this time, and only on the PostureCo Cloud Services plans that include it. Any access to or use of it from outside the United States, whether by you, by anyone using your account, or by any patient or client you invite, and including through a VPN or other location-masking technology, is prohibited and is a material breach of this Agreement (including Section 4, which applies to patients and clients as Section 1 describes) unless and until PostureCo formally releases it outside the United States, which PostureCo will do only by publishing updated terms or a written release notice on its website or in the Services; no other statement, including one by PostureCo support or sales personnel, releases it. A release applies only to the countries or regions, and only on the terms, that the published updated terms or release notice expressly name; any access to or use of the AI-Guided Health History from anywhere else outside the United States, or otherwise than on those terms, remains a material breach of this Agreement. You must not invite or allow any patient or client who is outside the United States to use the AI-Guided Health History, and you are responsible for your invitees' compliance with this Section 8.9 and with Section 4, including under your indemnity in Section 11. RemoteScreen®'s posture photograph and movement video features may be used outside the United States, subject to your own legal responsibilities, including your choice of region (Section 8.6) and the laws that apply to you and to your patients and clients. PostureCo has no obligation to determine or verify where you or a patient or client is located when RemoteScreen® is used (Section 8.6), may (but need not) block or disable the AI-Guided Health History for any account, invitation, or use, and is not responsible for any use of it outside the United States.

9. REGULATORY COMPLIANCE#

You are solely responsible for compliance with all applicable laws and regulations, including HIPAA, HITECH, GDPR, state privacy laws, data-residency laws (including through your choice of cloud region, Section 8.6), professional licensing rules, and record retention requirements. PostureCo assumes no regulatory responsibility.

9.1 HIPAA AND HEALTH INFORMATION ARE YOUR RESPONSIBILITY. If you are a healthcare provider, a covered entity or business associate under HIPAA, or are otherwise subject to HIPAA, HITECH, or any other law that protects health information, the onus is entirely on you to determine whether and how those laws apply to you and to your use of the Services, and to understand and follow them. That includes deciding how you collect, use, share, store, export, and transmit any patient or client information, and using only services, devices, and channels that meet your legal obligations. You must not use any service, whether provided by PostureCo or by anyone else (for example email, text messaging, cloud storage, device or cloud backup and synchronization, including Apple iCloud, file sharing, electronic health record, or messaging services), to share, store, back up, or transmit protected health information unless that service, and the way you use it, complies with those laws, including any business associate agreement they require. PostureCo does not decide whether you are a covered entity or business associate, does not review or approve the services you choose, and is not responsible for any use, disclosure, storage, or transmission of information through services outside its control, including any service you export to, share with, or connect to the Services, and any Third-Party Backup Service that backs up or synchronizes your devices (Sections 7.1 through 7.4). Section 8 governs BAAs with PostureCo. Nothing in this Agreement is legal advice; you should consult your own legal counsel about your obligations.

9.2 YOUR HIPAA RESPONSIBILITIES. Without limiting Section 9.1, if you are subject to HIPAA, you are solely responsible for each of the following, and PostureCo does not perform any of them for you:

  • Deciding whether you are a covered entity or a business associate under HIPAA and whether you need a BAA with PostureCo (fitness and wellness professionals who are not covered entities or business associates may not need one, but the decision is yours), and, if you are a business associate, meeting your own business associate agreements, including any requirement to obtain your covered entity's permission before you use PostureCo as a subcontractor
  • Where a BAA is required, requesting one from PostureCo, and making sure it covers each Service you use with PHI and is fully executed by both you and PostureCo before any PHI is uploaded, transmitted, recorded, or dictated, which includes before you set up or turn on cloud backup or synchronization for records that contain PHI (once it is on, the Services may upload your records automatically; Section 7.3 of the PostureCo Cloud Services Agreement), before you use PostureScribe.AI® with PHI, and before you invite any patient to RemoteScreen® (Section 8.2)
  • Using, disclosing, and requesting only the minimum necessary PHI, and entering, recording, or dictating only the identifiers you need
  • Giving your patients your notice of privacy practices, and obtaining every consent and authorization the law requires, including for taking and storing photographs and videos, for recording or transcribing conversations, for processing their information with artificial intelligence, and for any disclosure about your use of artificial intelligence that the law of your state requires healthcare providers to make
  • Obtaining the consent of every party to a conversation before you record or transcribe it where the law requires the consent of all parties, as the laws of some states, including Florida and California, do
  • Giving each person who uses the Services under your account a unique user account where the Services offer one, never sharing credentials, and protecting every device you use with the Services with a strong passcode, multi-factor authentication where available, device encryption, automatic screen lock, and the Services' app lock or your device's biometric lock
  • Training, supervising, and, where appropriate, sanctioning your workforce for their handling of PHI, and promptly removing the access of anyone who leaves your practice or no longer needs it
  • Safeguarding every export, report, email, file, and transfer you make from the Services, including transfers to electronic health record systems and to file-sharing, messaging, and other third-party services, and having a business associate agreement in place with each of those vendors where HIPAA requires one (Section 9.1)
  • Configuring every device, account, and setting you use with the Services, including through mobile device management where you use it, so that PHI is not backed up, synchronized, or copied to Apple iCloud or any other Third-Party Backup Service unless that service, and your use of it, complies with HIPAA, including any business associate agreement HIPAA requires, and keeping a data backup plan that uses only backup methods that comply (Sections 7.1 through 7.4)
  • Responding to your patients' requests to exercise their rights, such as access, amendment, an accounting of disclosures, restrictions, and confidential communications
  • Performing your own risk analysis and breach risk assessments, and giving every breach notification the law requires of you as a covered entity, including to affected individuals, the U.S. Department of Health and Human Services, the media, and state authorities
  • Reporting to PostureCo any suspected security incident involving PostureCo Cloud Services, PostureScribe.AI®, or your account, such as a lost or stolen device that is signed in to them or a suspected compromise of your credentials, immediately as Section 3 requires and in any event within five (5) business days after you discover it, by email to info@postureco.com or toll free at 866-577-7297, without including any PHI in your report unless a BAA is in effect, and then only by a secure means that PostureCo has approved (Section 8.4). A report to PostureCo does not satisfy, or transfer to PostureCo, any notification duty you have
  • Keeping complete records in your own system of record for as long as the law requires, because PostureCo is not a medical-records custodian (Section 7)
  • Complying with every state or other law that is more stringent than HIPAA, such as state medical-privacy, consumer-health-data (for example, Washington's My Health My Data Act), biometric, recording-consent, and artificial-intelligence-disclosure laws

These responsibilities are yours whether or not a BAA is in effect, and PostureCo does not review or verify how you meet them.

9.3 WHEN A BAA IS IN EFFECT. Your BAA with PostureCo exists only when you have requested it and both you and PostureCo have fully executed it, which must happen before any PHI reaches PostureCo, including before you turn on cloud sync or invite patients to RemoteScreen® (Section 8.2). If you and PostureCo have fully executed a BAA, the BAA controls over any conflicting term of this Agreement or of the Product-Specific Terms, but only as to the PHI that PostureCo creates, receives, maintains, or transmits on your behalf through the Services the BAA covers; in every other respect, this Agreement and the Product-Specific Terms control. PostureCo's obligations as a business associate are only those stated in the executed BAA and those that HIPAA imposes on business associates directly; apart from them, the first paragraph of this Section 9 applies. As the executed BAA provides, PostureCo uses and discloses PHI only as the BAA permits or the law requires, including as needed to provide the contracted Services; applies the safeguards the HIPAA Security Rule requires; reports security incidents and breaches of unsecured PHI to you without unreasonable delay and no later than sixty (60) calendar days after discovery, or within any shorter period that the executed BAA or applicable law (such as the Florida Information Protection Act) requires; requires its subcontractors that handle PHI, such as AWS and PostureCo's AI providers, to agree to the same restrictions under their own business associate agreements; supports your obligations to give patients access to, amendment of, and an accounting of disclosures of their PHI; and, at termination, returns or destroys PHI where feasible, with cloud data deleted after the thirty (30) day post-termination period described in Section 7, and extends the BAA's protections to any PHI that cannot feasibly be returned or destroyed at once, such as copies held in secure backup retention cycles, limiting further uses and disclosures to the purposes that make return or destruction infeasible. This summary does not add to the executed BAA, and notifying affected individuals, the U.S. Department of Health and Human Services, and the media remains your responsibility unless the executed BAA expressly provides otherwise. To the extent the executed BAA permits, this Section 9.3 is notice of the ongoing existence of unsuccessful security incidents, such as pings, port scans, and blocked sign-in attempts, that do not result in unauthorized access to, or use, disclosure, modification, or destruction of, PHI, and no further report of them is required. To the extent the BAA permits, and subject to the limit in Section 6 for records first uploaded or submitted before October 15, 2026, you authorize PostureCo to de-identify PHI in accordance with 45 C.F.R. § 164.514 and to use and disclose the resulting de-identified data as Section 6 allows. A BAA does not change your responsibilities under Sections 9.1 and 9.2 and does not cover any Service, data, or channel outside its stated scope (Sections 8.2 and 8.4). Nothing in this Agreement or in any BAA makes PostureCo a covered entity, a medical-records custodian, a bailee, a trustee, or a fiduciary, or your agent, partner, or joint venturer.

9.4 HIPAA COMPLIANCE STATEMENT. PostureCo's HIPAA Compliance Statement (https://www.postureanalysis.com/legal/hipaa-compliance-statement/) describes PostureCo's HIPAA program, including its safeguards, when it enters into BAAs, and the responsibilities this Section 9 gives you. It is provided for information only. It is not a contract or a BAA, does not amend this Agreement, any Product-Specific Terms, or any executed BAA, and creates no warranty, representation, or obligation of PostureCo. PostureCo intends the HIPAA terms of this Agreement to match it, and PostureCo may update it at any time without notice. If the HIPAA Compliance Statement conflicts with this Agreement, the applicable Product-Specific Terms, or an executed BAA, those documents govern. No government agency certifies a company or its software as "HIPAA compliant"; whether health information is protected as HIPAA requires depends on how each organization, including yours, uses the Services.

9.5 HEALTHCARE PROVIDERS OUTSIDE THE UNITED STATES. If you are a healthcare provider or other professional located outside the United States and you use PostureCo Cloud Services or any other Service through which PostureCo stores or processes your patients' or clients' information (including the cloud backup and online ViewBox included in a PostureRay® technical support plan), including if you use them only to back up health information, the onus is entirely on you: you are solely responsible for identifying, understanding, and complying with every law that applies to you and to your patients' and clients' information, including data-protection, health-information, professional-secrecy, data-residency, health-data-hosting, and record-retention laws.

Where the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection applies, the processor terms in Section 8.3 of the PostureCo Cloud Services Agreement (which address Article 28 of the GDPR and of the UK GDPR) and, where Section 8.4 of that agreement makes them apply, the standard contractual clauses it incorporates are built into that agreement and apply automatically, as those Sections provide, when you accept it, without a separate signature; a separately signed data processing agreement is available on request (Section 8.3 of that agreement). Under those laws, they are the counterpart of a HIPAA BAA. They are not a BAA, and they do not address any other requirement of those laws or of any other law. For any Service described in the previous paragraph that the PostureCo Cloud Services Agreement does not govern, any processor terms that your law requires are your responsibility to request under the next paragraph.

Anything else that your law requires, including any other contract (such as an agreement similar to a HIPAA BAA) and any registration, notification, authorization, certification, or approval (for example, a country-specific requirement for hosting health data), is your sole responsibility to identify, to request from PostureCo, and to supply to PostureCo for review before you upload any information it covers, without including any PHI or other patient or client information in your request. PostureCo has no obligation to ask whether you need one, to offer one, or to remind you, and it may accept, negotiate, or decline any such request, case by case and in its sole discretion (Section 8.5). PostureCo makes no representation that the Services, PostureCo, or its service providers meet any legal requirement outside the United States, or hold any country-specific certification, unless PostureCo expressly confirms it in a writing signed by PostureCo.

If an agreement or other requirement that your law imposes is not in place, you must not use PostureCo Cloud Services, or any other Service, for the information it covers. Using them anyway is a material breach of this Agreement, as well as of your own law, and is entirely at your own risk. PostureCo is not responsible for any consequence of that use, including where you never sent PostureCo any document to sign or review, and you must defend, indemnify, and hold harmless PostureCo completely, as Section 11 provides. Sections 8.6 (your choice of region), 9.1, and 9.6 also apply.

9.6 POSTURECO CANNOT TELL WHO YOU ARE; YOU MUST FOLLOW THE LAWS THAT APPLY TO YOU. PostureCo distributes its apps worldwide through app stores, such as the Apple App Store and Google Play, and online (Section 2.1). It cannot vet or verify who downloads, buys, or uses the Services; whether a user is a healthcare provider, a covered entity or business associate under HIPAA, a fitness or wellness professional, or a consumer; where a user, or a user's patients or clients, are located; or which laws apply to them. PostureCo relies on you for all of this and has no obligation to verify it.

You must determine, and comply with, every law that applies to you and to the information you handle, including HIPAA and laws like it anywhere in the world, for example the GDPR, the UK GDPR, Canada's Personal Information Protection and Electronic Documents Act and provincial health-information laws, and Australia's Privacy Act 1988. These are examples only; the list is not complete, and PostureCo does not tell you which laws apply to you (Section 9.1).

Using any Service in violation of a law that applies to you or to the information you handle is prohibited (Section 4) and is a material breach of this Agreement. Your license and your right to use the affected Service end automatically for that use, without notice and whether or not PostureCo has detected it, and you must stop that use immediately. PostureCo may also suspend or terminate your access to any or all of the Services (Section 18), and you must defend, indemnify, and hold harmless PostureCo as Section 11 provides.

PostureCo makes no representation that the Services are appropriate, lawful, or available for use in any particular location. Anyone who accesses or uses the Services from outside the United States does so on their own initiative and is responsible for complying with local law, and some features may be used only from inside the United States (Sections 8.8 and 8.9). PostureCo may restrict or withdraw the availability of any Service or feature in any country or region at any time.

You represent and warrant that you are not located in a country that is subject to a U.S. Government embargo, or that the U.S. Government has designated as a "terrorist supporting" country, and that you are not listed on any U.S. Government list of prohibited or restricted parties. You must not access, use, export, re-export, or transfer the Services, or allow anyone else to do so, in violation of U.S. export-control or sanctions laws or any other export-control or sanctions law that applies, and PostureCo may refuse, suspend, or terminate access as needed to comply with those laws.

Nothing in this Agreement limits any right you have under applicable consumer-protection law that cannot lawfully be waived or limited by contract.

10. FAIR USE AND LICENSE RESTRICTIONS#

Licenses are issued to a single customer or facility. Excessive, abnormal, automated, or unauthorized usage may result in suspension or permanent restriction of access. PostureCo reserves the right to enforce fair usage limits.

11. INDEMNIFICATION#

You agree to defend, indemnify, and hold harmless PostureCo, Inc., its officers, directors, employees, contractors, agents, licensors, and affiliates from and against all claims, damages, liabilities, losses, fines, penalties, and expenses, including attorneys' fees, arising out of or related to your use of the Services, your breach of this Agreement (including Sections 3, 4, 7.1 through 7.4, 8, 9.1, 9.2, 9.5, and 9.6), or any use, disclosure, storage, or transmission of patient or client information by you, or by anyone using your account, through any service, whether or not provided by PostureCo. This includes, without limitation, any claim, fine, or penalty arising out of or related to: your upload, transmission, recording, or dictation of PHI without a fully executed BAA; your failure to give any notice, or to obtain any consent or authorization, that the law requires, including for photographs, videos, recordings, transcription, text messages, calls, and artificial intelligence processing; your failure to meet your responsibilities under Section 9.2, including any breach notification the law requires of you; your violation of any third-party AI provider terms or policies (Section 8.8); any access to or use of the Services through a VPN or other location-masking technology by you, by anyone using your account, or by any patient or client you invite (Section 4.1); your choice of cloud region, and the storage and processing of your data in the region you selected (or in the United States, if you made no selection), including before any move you request is completed (Section 8.6); any access to or use of PostureScribe.AI® from outside the United States, and any circumvention of that restriction, by you, by your workforce, or by anyone using your account or devices, and your resulting breach of this Agreement and of the PostureScribe.AI® User Agreement, Indemnification, and Terms of Service (Section 8.8); any access to or use of the RemoteScreen® AI-Guided Health History from outside the United States by you, by anyone using your account, or by any patient or client you invite (Section 8.9); any use of any Service in violation of any law that applies to you or to the information you handle, by you or by anyone using your account or devices (Section 9.6); any use of PostureCo Cloud Services, or of any other Service, for information without an agreement, registration, notification, authorization, certification, or approval that the law that applies to you requires, including where you never sent PostureCo any document to sign or review (Section 9.5); any breach of your representations and warranties in Section 9.6 regarding embargoes, sanctions, and restricted-party lists, and any access to, use, export, re-export, or transfer of the Services in violation of export-control or sanctions laws; any Third-Party Backup Service, including Apple iCloud Backup, iCloud Photos, and iCloud Drive, and any backup, synchronization, copying, storage, restoration, retention, access, use, disclosure, loss, or security incident involving PHI or other patient or client information in or through one, whether caused by you, by anyone using your account or devices, by a device or its settings, by any setting or default of the Services, or by the service's provider, and any failure to keep PHI out of one (Sections 7.1 through 7.4, subject to the last paragraph of Section 7.4); and any claim by a patient or client whose information you enter in the Services or whom you invite to submit information through RemoteScreen®. To the fullest extent permitted by law, this obligation applies even if the claim, damage, liability, loss, fine, penalty, or expense arises, or is alleged to arise, in whole or in part from the negligence of PostureCo or any other indemnified party, except to the extent that a final decision of an arbitrator or court determines that it was caused by PostureCo's gross negligence or willful misconduct. PostureCo may assume the exclusive defense and control of any matter for which you must indemnify it, at your expense and with counsel of its choice, and you will cooperate fully with PostureCo in that defense. You must not settle any such matter without PostureCo's prior written consent if the settlement would admit fault by, or impose any obligation, restriction, or payment on, PostureCo or any other indemnified party. Your obligations under this Section 11 survive termination.

12. DISCLAIMER OF WARRANTIES#

THE SERVICES ARE PROVIDED "AS IS," "AS AVAILABLE," AND "WITH ALL FAULTS." POSTURECO DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, RELIABILITY, AND NON-INFRINGEMENT.

12.1 NO GUARANTEE OF ERROR-FREE SOFTWARE. SOFTWARE, INCLUDING THE SERVICES, MAY CONTAIN BUGS, ERRORS, DEFECTS, INACCURACIES, AND OTHER PROBLEMS, SOME OF WHICH MAY AFFECT MEASUREMENTS, MARKINGS, DIGITIZATIONS, CALCULATIONS, REPORTS, EXPORTS, STORED DATA, OR THE AVAILABILITY OF FEATURES. POSTURECO DOES NOT REPRESENT, WARRANT, OR GUARANTEE THAT THE SERVICES, OR ANY VERSION, UPDATE, FEATURE, OR OUTPUT OF THEM, WILL BE BUG-FREE, ERROR-FREE, UNINTERRUPTED, OR COMPATIBLE WITH ANY PARTICULAR DEVICE, OPERATING SYSTEM, BROWSER, OR OTHER SOFTWARE, OR THAT ANY BUG, ERROR, OR DEFECT WILL BE CORRECTED, WHETHER IN A PARTICULAR VERSION, ON A PARTICULAR DEVICE, OR AT ALL. POSTURECO MAKES NO CLAIMS ABOUT, AND ASSUMES NO RESPONSIBILITY FOR, ANY BUG, ERROR, OR DEFECT IN THE SERVICES OR ANY CONSEQUENCE OF ONE. You are responsible for reviewing every output before you use it (Section 5.4), for keeping the Services updated (Section 19.1), and for maintaining independent backups of your data, using only backup methods that meet your legal obligations (Sections 7 and 7.3).

13. LIMITATION OF LIABILITY#

TO THE MAXIMUM EXTENT PERMITTED BY LAW, POSTURECO'S TOTAL LIABILITY SHALL NOT EXCEED THE AMOUNT PAID BY YOU TO POSTURECO IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM. POSTURECO SHALL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOST PROFITS, LOST DATA, PATIENT CLAIMS, OR REGULATORY PENALTIES. THESE LIMITATIONS APPLY TO ALL CLAIMS, INCLUDING CLAIMS ARISING OUT OF OR RELATED TO PHI, ANY SECURITY INCIDENT, ANY THIRD-PARTY BACKUP SERVICE (INCLUDING APPLE ICLOUD), OR ANY BAA, UNLESS THE EXECUTED BAA EXPRESSLY PROVIDES OTHERWISE, AND THE DAMAGES EXCLUDED ABOVE INCLUDE COSTS OF INVESTIGATION, BREACH NOTIFICATION, AND CREDIT MONITORING.

14. WAIVER OF SUBROGATION#

To the extent you maintain insurance coverage, you waive any right of subrogation against PostureCo.

15. INJUNCTIVE RELIEF#

Unauthorized clinical reliance, unauthorized PHI upload (including any upload, transmission, recording, or dictation of PHI without a fully executed BAA), use of RemoteScreen® or PostureScribe.AI® without the notices, consents, or BAA that Sections 8.9 and 9.2 require, misuse of artificial intelligence features in violation of Section 8.8, access to or use of the Services through a VPN or other location-masking technology in violation of Section 4.1, use of PostureScribe.AI® or the RemoteScreen® AI-Guided Health History from outside the United States in violation of Sections 4, 8.8, and 8.9, or circumvention of licensing or location restrictions causes irreparable harm. PostureCo is entitled to injunctive relief and all available legal remedies.

16. DISPUTE RESOLUTION#

Except where applicable Product-Specific Terms expressly provide otherwise, any dispute shall be resolved by binding arbitration in Pasco County, Florida. You waive the right to a jury trial and any class or representative action.

17. ATTORNEYS' FEES#

The prevailing party is entitled to recover all attorneys' fees and costs.

18. TERMINATION#

PostureCo may suspend or terminate access at any time, with or without notice. Without limiting that right, PostureCo may immediately, and without notice, suspend or terminate your access to any or all of the Services, or block or disable any feature, including PostureScribe.AI® and the RemoteScreen® AI-Guided Health History, if it suspects that you, anyone using your account or devices, or any patient or client you invite has accessed or used the Services through a VPN or other location-masking technology (Section 4.1), has used PostureScribe.AI® or the AI-Guided Health History from outside the United States (Sections 8.8 and 8.9), or has used any Service in violation of a law that applies to you or to the information you handle (Sections 9.5 and 9.6). PostureCo has no obligation to do so, and not doing so is not a waiver of any of its rights. In addition, if you, or anyone using your account or devices, use any Service in violation of such a law, your license and right to use the affected Service end automatically for that use, without notice and whether or not PostureCo has detected it or taken any action, and you must stop that use immediately (Section 9.6). To the extent the law allows, fees paid for any Service or feature that is suspended, terminated, blocked, or disabled, or whose right of use ends, for any of these reasons are not refunded (Section 3.1). Upon termination, access to software features, exports, cloud services, and data retrieval may be immediately disabled. All disclaimers, indemnities, arbitration provisions, and liability limitations survive termination.

19. SOFTWARE LIFECYCLE AND END-OF-LIFE#

PostureCo reserves the right to retire or declare end-of-life for any software version. Continued use of legacy or unsupported versions is at your sole risk. PostureCo has no obligation to maintain compatibility with future laws, operating systems, or third-party technologies.

19.1 UPDATES ARE YOUR RESPONSIBILITY. You are solely responsible for installing updates to the Services promptly and for keeping the Services on the most recent version released by PostureCo. Corrections for bugs, errors, and defects, compatibility changes, and other improvements, if and when PostureCo chooses to make them, may be delivered only through updates, and they do not reach a device that has not been updated. PostureCo has no obligation to provide any update. PostureCo is not responsible for any bug, error, defect, data problem, or other issue that occurs in an outdated version of the Services, including any issue that is corrected in a newer version of the Services, whether or not that newer version can be installed on your device.

19.2 HARDWARE AND OPERATING SYSTEMS ARE YOUR RESPONSIBILITY. You are solely responsible for obtaining, maintaining, and replacing, at your own expense, reasonably current hardware that can run a current operating-system version (such as iOS, iPadOS, Android, Windows, or macOS) that its maker still supports, together with a current, supported web browser, and for keeping that operating system and browser updated. Apple, Google, and other device and operating-system makers periodically stop providing updates for older devices and operating-system versions (they "sunset" them). After a device or operating system has been sunset, it may no longer be able to install the current version of the Services or receive its bug fixes and other corrections, and an app store may show no new update for the Services on that device even though a newer version, including one that corrects a bug, is available for supported devices. The absence of a new update in an app store on your device does not mean that no update or correction exists. It is your responsibility to determine, and to check periodically, whether your device, operating system, and browser can still run the most recent version of the Services and, if they cannot, to upgrade or replace them before continuing to rely on the Services.

19.3 UNSUPPORTED DEVICES AND VERSIONS ARE AT YOUR SOLE RISK. PostureCo may set, change, or raise the minimum hardware, operating-system, browser, and app-version requirements for any of the Services at any time, without notice. Continued use of the Services on unsupported or sunset devices, on unsupported operating-system or browser versions, or in outdated or unsupported versions of the Services is at your sole risk, and PostureCo has no responsibility or liability for any bug, error, defect, incompatibility, data loss, security issue, or other problem arising from that use.

20. GOVERNING LAW AND VENUE#

This Agreement is governed by the laws of the State of Florida. Exclusive venue, if arbitration is unenforceable, lies in Pasco County, Florida or the U.S. District Court for the Middle District of Florida (Tampa Division).

21. ENTIRE AGREEMENT#

This Agreement, together with any applicable Product-Specific Terms, any executed BAA, and any data processing agreement that PostureCo has executed, constitutes the entire agreement between you and PostureCo regarding the Services.

PostureCo may assign or transfer this Agreement, in whole or in part, without your consent, including to a successor described in Section 8.7, and may assign or transfer an executed BAA or data processing agreement to the extent that agreement permits. You may not assign or transfer this Agreement or any license under it without PostureCo's prior written consent (Section 2), and any attempt to do so without that consent is void. This Agreement binds and benefits you, PostureCo, and your and its permitted successors and assigns.

Except as a data processing agreement, or the standard contractual clauses (including any addendum to them) that apply under Section 8 of the PostureCo Cloud Services Agreement, expressly provide, except that Apple and Apple's subsidiaries are third-party beneficiaries of this Agreement as Section 2.2 provides, and except that each person whom Section 11 protects may enforce that Section, nothing in this Agreement, any Product-Specific Terms, or any PostureCo policy or notice (including the Privacy Policy, the HIPAA Compliance Statement, and the RemoteScreen® Patient App Privacy Policy) confers any right, remedy, or claim on your patients and clients or on any other person except you, PostureCo, and your and its permitted successors and assigns. This does not limit any right that applicable law gives an individual directly.

If any provision of this Agreement is held invalid or unenforceable, it will be enforced to the maximum extent permitted, and the remaining provisions remain in full force and effect.

22. TEXT MESSAGES AND PHONE CALLS#

22.1 CONSENT IS OPTIONAL AND SEPARATE. PostureCo may ask for your telephone number, for example on the contact form on its website. Calls and text messages are separate, optional choices. If you check the box agreeing to receive text messages (or otherwise expressly agree), you consent to receive text messages (SMS and MMS), which may be sent using automated technology, from PostureCo, Inc. at the mobile number you provided about your request, your account, and support for the Services. If you check the box agreeing to receive calls (or otherwise expressly agree), you consent to receive telephone calls from PostureCo at that number for the same purposes, and PostureCo may leave a voicemail. Your consent is not a condition of any purchase. Providing a telephone number alone, or accepting this Agreement, is not consent to receive text messages.

22.2 MESSAGE TYPES, FREQUENCY, AND COST. Text messages under this Section are informational and customer-care messages, such as replies to your request, follow-up questions, scheduling a call, and account and support notices. PostureCo will not send you marketing text messages unless you separately agree to receive them. Message frequency varies with your request. Message and data rates may apply.

22.3 OPT-OUT AND HELP. You may stop text messages at any time by replying STOP to any message (QUIT, END, REVOKE, OPT OUT, CANCEL, UNSUBSCRIBE, and STOP ALL also work), and PostureCo may send one final message confirming your opt-out. Reply HELP for help. You may also withdraw your consent to calls or text messages at any time by contacting PostureCo toll free at 866-577-7297, through the contact form on PostureCo's website, or by any other reasonable means, and PostureCo will honor your request promptly and no later than the law requires. Withdrawing consent does not affect the rest of this Agreement.

22.4 YOUR NUMBER. You represent that you are the subscriber of, or are authorized to use, the telephone number you provide, and that it is a mobile number if you agree to receive text messages. You agree to tell PostureCo promptly if your number changes or is no longer yours, so that PostureCo does not contact someone else.

22.5 NO PATIENT INFORMATION. Text messages, voicemail, and the website contact form are not secure channels for health information. Do not send protected health information or other patient or client information through them.

22.6 CARRIERS AND DELIVERY. Mobile carriers are not liable for delayed or undelivered messages. PostureCo does not guarantee that any message will be delivered, and text messages may not be available on every carrier or outside the United States.

22.7 YOUR MOBILE NUMBER STAYS PRIVATE. PostureCo never sells or shares your mobile telephone number, your text-messaging opt-in, or your consent with its partners, affiliates, or any other third parties. Only PostureCo's own service providers that deliver its messages and support you on its behalf receive them, solely for that purpose, as described in Section 18 of the Privacy Policy. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.

23. CONTACT INFORMATION#

Questions, complaints, and claims about the Services, including any PostureCo app obtained from an app store (Sections 2.1 and 2.2), may be directed to PostureCo at the address, telephone number, or email address below. Do not include PHI (Section 8.4).

PostureCo, Inc. 3152 Little Road, Suite 161, Trinity, FL 34655

Email: info@postureco.com

Phone (toll free): 866-577-7297 · International: +1-866-577-7297

Website contact form (never include PHI): https://www.postureanalysis.com/postureco-support/

Current version available at: https://www.postureanalysis.com/legal/terms-of-service/

HIPAA Compliance Statement: https://www.postureanalysis.com/legal/hipaa-compliance-statement/