Get the app

Terms of Service & End User License Agreement

Last updated Form PC-4100, Rev. 2.0.19

On this page 24 sections

PostureCo may update this document at any time without prior notice. The date above shows when it was last updated, so please check back from time to time.

POSTURECO, INC. — TERMS OF SERVICE & END USER LICENSE AGREEMENT

LAST UPDATED: November 10, 2026

Form PC-4100, Rev. 2.0.19

IMPORTANT NOTICE REGARDING CHANGES TO THESE TERMS: PostureCo, Inc. reserves the right to modify, update, revise, or replace these Terms of Service and End User License Agreement at any time, in its sole discretion, without prior notice. Any changes are effective immediately upon posting. PostureCo will show the new date at the top of the revised Agreement and may also tell you of a change in the Services, by email, or by asking you to accept it (Section 1). Continued access to or use of any PostureCo website, software, or service constitutes binding acceptance of the revised terms. You are responsible for reviewing this Agreement periodically. If you do not agree, you must immediately discontinue all use of the Services. A change to Section 16 does not apply to any dispute that arose, or of which PostureCo had notice, before the change was posted.

IMPORTANT NOTICE REGARDING PRICES: PostureCo may change its prices, fees, and rates, and its pricing structure, for any of the Services, including PostureScreen®, PostureCo Cloud Services, PostureScribe.AI®, and PostureRay®, at any time, in its sole discretion, and without prior notice, except where the law or an app store's rules require notice. A new price applies from the date PostureCo posts it, including to the next renewal or billing period of a subscription or plan that you already have, but it does not change the price of anything you have already paid for (Section 3.2).

IMPORTANT NOTICE REGARDING LOCATION: You may not access or use any of the Services through a virtual private network (VPN), proxy server, or other technology that hides or changes your location (Section 4.1). If you use PostureCo Cloud Services, you choose the region where your cloud data is stored and you are solely responsible for that choice (Section 8.6). PostureScribe.AI® and the RemoteScreen® AI-Guided Health History are authorized only in the United States at this time and may be used only from inside the United States (Sections 8.8 and 8.9). Using a VPN or other location-masking technology, or using PostureScribe.AI® or the AI-Guided Health History from outside the United States, is not authorized by PostureCo and is a material breach of this Agreement that may lead to immediate suspension or termination (Section 18). Anyone who does so anyway does so entirely at their own risk, and you are responsible for the consequences, including under your indemnity (Section 11).

IMPORTANT NOTICE REGARDING BACKUPS OF PATIENT AND CLIENT INFORMATION: Your devices, and the backup and sync services that you or your organization turn on or connect, such as Apple iCloud Backup and iCloud Photos, can copy the patient and client information you keep in PostureCo's apps to servers that PostureCo does not operate or control. Apple's iCloud terms do not allow HIPAA covered entities or business associates to use iCloud for protected health information. If you are a HIPAA covered entity or business associate, you must keep PHI out of every backup, sync, or storage service that does not meet your obligations under HIPAA and the other laws that apply to you, for example by turning off iCloud Backup for PostureCo's apps and turning off the apps' settings that save client photographs and videos to the Photos app, and you must back up your data only by methods that do, such as PostureCo Cloud Services, with a BAA where you need one. If you are not, for example if you work in health and fitness only and are not covered by HIPAA, these precautions are recommended, and whether you take them is your choice, as long as you comply with any other law that applies to you (Sections 7.1 through 7.3). Either way, PostureCo is not responsible for those services or for any information in them; as Section 7.4 provides, you release PostureCo from claims about them, even claims based on PostureCo's negligence, and you are responsible for the consequences, including under your indemnity (Section 11).

IMPORTANT NOTICE FOR KNOWLEDGE BASE USERS: If you request a sign-in code for, register for, or sign in to PostureCo's knowledge base, PostureCo monitors and records your sign-ins and, while you are signed in, the Knowledge Base tutorials, articles, videos, and files you open or start, whether public or locked, together with your IP address, approximate location, and device information; uses those records for security and for its internal training purposes; keeps those records for up to thirteen (13) months, or longer during an investigation, dispute, or legal hold; and checks for, and may block, connections through a VPN or proxy (Section 23). This notice and Section 23 do not apply to visitors who do not request a sign-in code, register, or sign in.

IMPORTANT NOTICE REGARDING UPDATES AND SUPPORTED DEVICES: Keeping your devices, operating systems, browsers, and PostureCo software up to date is your responsibility. PostureCo builds its apps for the current versions of iOS, iPadOS, and Android and tries, without promising, to keep the immediately preceding version working; PostureRay® is supported on Windows 11 and on Windows 10 installations that still receive Microsoft security updates. Devices and computers that hold patient or client information must run an operating system that still receives security updates. PostureCo does not promise backward compatibility with older devices, operating systems, or software versions, does not provide support for them, and is not responsible for problems that arise from using them (Section 19.4).

IMPORTANT NOTICE FOR POSTURERAY® WINDOWS USERS: If and when PostureCo makes PostureRay® on PostureCo Cloud generally available, PostureCo will support the Windows version of PostureRay®, which is installed on a practice's own computers, for one (1) year after that launch and will then permanently end all support for it, including technical support, updates, bug fixes, technical support plans, and the cloud backup and online ViewBox included in those plans. PostureCo will post the launch date on its website (Section 19.5).

1. PARTIES AND SCOPE#

These Terms of Service and End User License Agreement ("Agreement") constitute a legally binding agreement between you ("Client," "User," or "You") and PostureCo, Inc., a Florida corporation ("PostureCo," "Company," "We," or "Us").

This Agreement governs all access to and use of:

  • Any PostureCo-owned or operated website, domain, or online service
  • All software products developed, distributed, or operated by PostureCo, Inc., including but not limited to PostureScreen® and PostureRay®
  • All desktop, mobile, web-based, offline, local-only, cloud-based, or embedded software
  • All updates, upgrades, patches, beta versions, APIs, plugins, modules, integrations, artificial intelligence features, documentation, and support services
  • Any successor, replacement, or related software or service offered now or in the future (collectively, the "Services").

By accessing, downloading, installing, purchasing, registering for, or using any Services, you acknowledge that you have read, understood, and agree to be bound by this Agreement.

Acceptance by use is the default. Accessing, downloading, installing, purchasing, registering for, or using any Service also constitutes your acceptance of the Product-Specific Terms that apply to that Service and of the policies that this Agreement and those terms incorporate, including the Privacy Policy, and your acknowledgment of the HIPAA Compliance Statement (Section 1.1). This applies whether or not PostureCo shows you a click-through, a checkbox, or a request for your signature. If you do not agree, you must not access or use the Services.

PostureCo may also require your express acceptance at any time, for example by asking you to click a button or check a box when you sign up, when you sign in to PostureCo Cloud or to PostureCo's knowledge base (Section 23.11), in an app, or after an app update or release. PostureCo requires an electronic signature for the PostureScribe.AI® User Agreement, Indemnification, and Terms of Service and may require one for the PostureCo Cloud Services Agreement. Express acceptance is in addition to your acceptance by use: if PostureCo has not asked for it, or you have not yet given it, that does not mean that you have not accepted. If you decline a click-through or signature that PostureCo requires, you must stop using the affected Service, and PostureCo may restrict your access to it until you accept.

Your electronic acceptance by clicking, checking a box, or typing or drawing a signature is your electronic signature and has the same legal effect as a handwritten signature under the Electronic Signatures in Global and National Commerce Act (15 U.S.C. § 7001 et seq.) and the Florida Uniform Electronic Transaction Act (Fla. Stat. § 668.50). Your acceptance by accessing or using a Service is equally binding on you and, to the extent the law allows, has the same effect as your signature. You agree to conduct transactions with PostureCo electronically, and you consent to receive this Agreement, any Product-Specific Terms, any changes to them, and every notice, disclosure, and other communication from PostureCo electronically, by posting on its website or in the Services or by email to the address associated with your account, each of which satisfies any legal requirement that it be in writing, to the extent the law allows; an email notice is given when sent. You may access, save, and print this Agreement at the address in Section 24 and may ask PostureCo for a paper copy. PostureCo may keep records of acceptances, such as the date, the time, the account, and the version or date of the document accepted, and those records are evidence of your acceptance. PostureCo may ask you to accept a newer version of this Agreement or of any Product-Specific Terms, and, as the notice at the top of this Agreement provides, continued use of the Services after a newer version is posted is also acceptance of it.

Except as the next paragraph provides for RemoteScreen® patients and clients, you represent that you are at least eighteen (18) years of age and have the legal capacity to accept this Agreement. If you access or use the Services, or accept this Agreement, for a practice, facility, or other organization, you represent that you are authorized to bind it, "you" includes that organization, and both it and you are bound; if you are not authorized, you are personally bound. Everyone who uses the Services under your account, license, or devices must comply with this Agreement, and you are responsible for them (Section 3).

A patient or client who uses RemoteScreen® only to send information to a professional at that professional's invitation is not a customer of PostureCo, is not a party to this Agreement, and is not "you" under it. As between PostureCo and the professional who invited them, that professional is responsible for their use of RemoteScreen® and for the information they submit, including having any required Business Associate Agreement in place (Sections 8.9 and 11). The RemoteScreen® Patient App Privacy Policy (Section 1.1) is PostureCo's notice to them and describes how PostureCo handles that information. Their use of RemoteScreen® means that they acknowledge that notice and agree to use RemoteScreen® as Section 4 requires, without creating any broader contract between them and PostureCo. Section 4 (Prohibited Uses), including its prohibitions on using a VPN or other location-masking technology (Section 4.1) and on using the RemoteScreen® AI-Guided Health History from outside the United States (Section 8.9), and PostureCo's intellectual-property rights in the Services still apply to that use, and PostureCo may block any use of RemoteScreen® that is unlawful, that Section 4 prohibits, or that threatens the security or operation of the Services.

1.1 PRODUCT-SPECIFIC AGREEMENTS CONTROL. Certain Services, including but not limited to PostureRay®, may be governed by separate product-specific end user license agreements, terms and conditions, addenda, order forms, or policies ("Product-Specific Terms"). In the event of any conflict or inconsistency between this Agreement and applicable Product-Specific Terms, the Product-Specific Terms shall control, except that Section 2.2 controls as to an Apple App (as Section 2.2 defines it). Subject to Section 2.2, this Agreement applies only to the extent it does not conflict with Product-Specific Terms.

Product-Specific Terms apply to the Services they cover in addition to this Agreement and include, without limitation:

  • The PostureCo Cloud Services Agreement (https://www.postureanalysis.com/legal/cloud-services-agreement/), which governs PostureCo Cloud Services. "PostureCo Cloud Services" means PostureCo's optional cloud storage, backup, and synchronization services (formerly "SyncScreen"), the PostureCo Cloud web portal, and RemoteScreen®, and includes PostureRay® on PostureCo Cloud, which requires a separate PostureRay® subscription and may also be subject to other Product-Specific Terms
  • The PostureScribe.AI® User Agreement, Indemnification, and Terms of Service (https://www.postureanalysis.com/legal/posturescribe-ai-agreement/), which governs PostureScribe.AI®

The following policies also apply:

PostureCo's HIPAA Compliance Statement (https://www.postureanalysis.com/legal/hipaa-compliance-statement/) describes PostureCo's HIPAA program for information only. It is not a contract or a Business Associate Agreement and creates no warranty, representation, or obligation. The HIPAA rules in this Agreement, including Sections 4, 6, 8, and 9, are intended to match it, and Section 9.4 governs any difference.

2. LICENSED SERVICES — NOT A SALE#

All Services are licensed, not sold. Subject to your compliance with this Agreement and all applicable Product-Specific Terms, PostureCo grants you a limited, revocable, non-exclusive, non-transferable, non-sublicensable license to access and use the Services solely for your internal business or personal use. A PostureRay® license may be transferred only as Section 10.1 provides.

All licenses are conditioned upon timely payment of all applicable fees. Fees are fully earned upon receipt and are not refundable by PostureCo unless expressly stated otherwise in applicable Product-Specific Terms; refunds of purchases made through an app store are decided by that app store (Sections 2.1 and 3.1). All rights not expressly granted are reserved by PostureCo.

2.1 APP STORES. PostureCo's apps may be obtained from third-party app stores, such as the Apple App Store and Google Play, as well as online from PostureCo. This Agreement, together with any applicable Product-Specific Terms, is the end user license agreement for every PostureCo app, however you obtain it, including when an app store listing links to it. If an app store applies its own standard end user license agreement to a PostureCo app (for example, Apple's Licensed Application End User License Agreement), this Agreement also applies to that app and to your use of the Services, as a separate agreement between you and PostureCo that you accept as Section 1 describes, and you must comply with both. If you obtain an app from an app store, that app store's own terms and usage rules also apply to your download, purchase, and use of the app, and you must comply with them as well as with this Agreement. The app store provider is not a party to this Agreement and, except as its own terms or Section 2.2 provide, has no obligation or responsibility to you for the app, including its content, maintenance, or support, or any claim relating to it. Purchases, subscriptions, renewals, cancellations, and refunds made through an app store are governed by that app store's terms (Section 3.1). If you obtain an app from Google Play, Google's terms also apply, and Google is not responsible for the app. When you use any PostureCo app, you must also comply with any third-party terms that apply to that use, such as your wireless data service agreement. PostureCo cannot verify who obtains or uses its apps (Section 9.6).

2.2 APPLE APP STORE TERMS. This Section 2.2 applies to each PostureCo app that you obtain from the Apple App Store (an "Apple App"). If it conflicts with any other term of this Agreement or of any Product-Specific Terms, this Section 2.2 controls as to the Apple App; however, to the extent applicable law permits, nothing in this Section 2.2 expands PostureCo's obligations or liability to you beyond what the rest of this Agreement and the applicable Product-Specific Terms provide. You and PostureCo acknowledge and agree that:

  • This Agreement is concluded between you and PostureCo only, and not with Apple Inc. ("Apple"), and PostureCo, not Apple, is solely responsible for the Apple App and its content. The usage rules in this Agreement are not intended to conflict with the Apple Media Services Terms and Conditions in effect when you accept this Agreement, and, to the extent that any usage rule in this Agreement conflicts with the Usage Rules in those terms, Apple's Usage Rules control as to the Apple App
  • Your license to the Apple App under Section 2 is a non-transferable license to use the Apple App on Apple-branded products that you own or control, as permitted by the Usage Rules in the Apple Media Services Terms and Conditions, except that other accounts associated with you as the purchaser may access and use the Apple App through Family Sharing or volume purchasing, where available. The license remains subject to every other condition and restriction of this Agreement, and everyone who uses the Apple App through your purchase must comply with this Agreement
  • PostureCo alone is responsible for providing any maintenance and support services for the Apple App, only as this Agreement specifies or as applicable law requires, and Apple has no obligation whatsoever to furnish any maintenance or support services for the Apple App
  • To the extent any warranty, whether express or implied by law, is not effectively disclaimed (Section 12), PostureCo, not Apple, is solely responsible for it. If the Apple App fails to conform to any applicable warranty, you may notify Apple, and Apple will refund the purchase price of the Apple App to you. To the maximum extent permitted by applicable law, Apple has no other warranty obligation whatsoever with respect to the Apple App, and, as between PostureCo and Apple, any other claims, losses, liabilities, damages, costs, or expenses attributable to any failure to conform to any warranty are PostureCo's sole responsibility, subject to Sections 12 and 13
  • PostureCo, not Apple, is responsible for addressing any claim by you or any third party relating to the Apple App or your possession or use of it, including (i) product liability claims, (ii) any claim that the Apple App fails to conform to any applicable legal or regulatory requirement, and (iii) claims arising under consumer protection, privacy, or similar legislation, including in connection with any use of Apple's HealthKit or HomeKit frameworks. Being responsible for addressing a claim is not an admission that the claim has merit or that PostureCo is liable on it. This Agreement does not limit PostureCo's liability to you beyond what applicable law permits, and, to the extent applicable law permits, Sections 5, 11, 12, and 13 continue to apply
  • In the event of any third-party claim that the Apple App, or your possession and use of it, infringes that third party's intellectual property rights, PostureCo, not Apple, will be solely responsible, as between PostureCo and Apple, for the investigation, defense, settlement, and discharge of that claim
  • You make the representations and warranties in Section 9.6 regarding embargoes, sanctions, and restricted-party lists, including that you are not located in a country that is subject to a U.S. Government embargo, or that the U.S. Government has designated as a "terrorist supporting" country, and that you are not listed on any U.S. Government list of prohibited or restricted parties
  • Questions, complaints, and claims about the Apple App should be directed to PostureCo, Inc., 3152 Little Road, Suite 161, Trinity, FL 34655; toll free telephone 866-577-7297 (+1-866-577-7297 from outside the United States); email info@postureco.com (Section 24)
  • You must comply with applicable third-party terms of agreement when using the Apple App; for example, you must not be in violation of your wireless data service agreement when you use it (Section 2.1)
  • Apple and Apple's subsidiaries are third-party beneficiaries of this Agreement as it relates to the Apple App, and, upon your acceptance of this Agreement, Apple will have the right (and will be deemed to have accepted the right) to enforce this Agreement against you as a third-party beneficiary of it (Section 21)

3. ACCOUNT AND ACCESS RESPONSIBILITY#

You are solely responsible for all activity occurring under your account, whether authorized or unauthorized. You must safeguard your login credentials and immediately notify PostureCo of any suspected misuse or security breach.

You must not, and must not allow anyone using your account to, access or use the Services through a virtual private network ("VPN"), proxy server, anonymizing network, or any other technology that hides, masks, or changes the location from which the Services are accessed (Section 4.1). Everything done through your account, including from outside the United States or through such a technology, is treated as your own act, and you are responsible for it. When you set up PostureCo Cloud Services, choosing the correct region for your data is also your responsibility (Section 8.6).

If you have a Knowledge Base Account, Section 23 also applies to it.

3.1 PAYMENTS; TRIALS; NO REFUNDS. Certain Services may include limited trial periods, installment payments, or deferred activation as defined in applicable Product-Specific Terms. All payments are non-refundable by PostureCo. Refunds of purchases made through an app store are decided by that app store under its own terms (Section 2.1), and Section 2.2 applies to Apple Apps. Failure to satisfy payment obligations may result in immediate suspension or deactivation of Services, loss of access to cloud features, and collection efforts, including recovery of attorneys' fees and costs. PostureCo will not, however, block your access to export the data that it stores for you in its cloud services in order to resolve a payment dispute: you may export that data yourself as Section 7 and Section 5A of the PostureCo Cloud Services Agreement describe, and it is then kept and deleted as those Sections or, for PHI, an executed BAA provide.

3.2 PRICES AND PRICE CHANGES. PostureCo may change the prices, fees, and rates for any of the Services, and its pricing structure, at any time, for any reason, including a change in PostureCo's costs, in its sole discretion, and without prior notice, except where this Section 3.2 provides for notice that the law or an app store's rules require. "Pricing structure" includes PostureCo's plans, tiers, bundles, and packages and what each of them includes; billing periods and renewal terms; usage limits and allowances; discounts, promotions, and free trials; minimum commitments; and the way any fee is calculated. This Section 3.2 applies to every Service, including the PostureScreen® suite and its modules, PostureCo Cloud Services, PostureScribe.AI®, PostureRay® licenses and modules, PostureRay® technical support plans, PostureRay® on PostureCo Cloud, training, and every other product or service that PostureCo sells, and it applies notwithstanding Section 1.1, except as the last sentence of the next paragraph provides.

A new price or pricing structure takes effect when PostureCo posts it on its website or in the Services, or on any later date that PostureCo states, and applies to every purchase, order, unlock, upgrade, renewal, and billing period from then on, including the next renewal or billing period of a subscription or technical support plan that you already have. A change is not retroactive: it does not change the price of a purchase already made, of a billing period, subscription term, or plan term that has already begun and been paid for, or of installment payments already agreed for a purchase already made. A price that a written agreement signed by both you and PostureCo expressly fixes for a stated term stays fixed until that term ends.

Where the law requires PostureCo to tell you about a price change in advance, for example for an automatically renewing subscription under the automatic-renewal laws of some states, PostureCo will give the notice that the law requires, in a way that Section 1 allows; if you do not want to continue at the new price, you must cancel before it takes effect. The prices of purchases made through an app store, and any change to them, are set and applied through that app store, whose rules, including any notice it gives or consent it requires, apply (Sections 2.1, 2.2, and 3.1). Continuing a subscription or plan, or making any purchase, after a new price takes effect is your acceptance of it.

Prices shown on PostureCo's website, in the Services, in marketing materials, or by PostureCo's personnel are subject to change and may contain errors. PostureCo may correct a pricing error at any time, including after you place an order, and may cancel an order placed at an incorrect price, in which case it refunds the amount you paid for that order. A written quote from PostureCo is valid only for the period that it states; otherwise, no quote, estimate, or statement by PostureCo's sales or support personnel fixes a price for any future purchase, renewal, or billing period unless it is in a written agreement signed by both you and PostureCo. A promotional, introductory, or discounted price applies only for the period and on the terms that PostureCo states, and PostureCo may end or change any promotion at any time. You are not entitled to a refund, credit, or price adjustment if PostureCo lowers a price or offers a promotion after your purchase. Unless PostureCo or an app store states otherwise, prices are in U.S. dollars (USD).

4. PROHIBITED USES#

You may not, directly or indirectly:

  • Use the Services in place of clinical judgment (the Services are intended for measurement, documentation, and education purposes and do not take the place of clinical judgment, and clinical decisions, treatment, and interventions remain the sole responsibility of the healthcare practitioner or fitness professional)
  • Represent any output of the Services, alone, as a medical, diagnostic, or therapeutic conclusion (all clinical judgments and opinions must be your own, made through your independent professional judgment)
  • Establish or imply a standard of care using the Services
  • Reverse engineer, decompile, disassemble, or attempt to derive source code or otherwise use the Services or any output of the Services for competitive analysis, benchmarking, or developing a competing product or service
  • Circumvent licensing, encryption, security, or usage controls
  • Perform or permit vulnerability scanning, penetration testing, load testing, or any other security testing of the Services or of PostureCo's systems without PostureCo's prior written authorization
  • Permit unauthorized third-party access
  • Share credentials across unauthorized users, locations, or facilities
  • Access or use any of the Services, or allow anyone to access or use them, through a VPN, proxy server, anonymizing network, or any other technology that hides, masks, or changes the location from which the Services are accessed (Section 4.1)
  • Access or use PostureScribe.AI® or the RemoteScreen® AI-Guided Health History from outside the United States, or allow anyone using your account or devices, or invite or allow any patient, client, or other person, to use either of them from outside the United States, unless and until PostureCo formally releases that feature for the country or region concerned (Sections 8.8 and 8.9)
  • Upload protected health information ("PHI," as defined under HIPAA at 45 C.F.R. § 160.103) to, or store or transmit PHI on or through, PostureCo's servers or systems unless expressly permitted under a separately executed Business Associate Agreement ("BAA") and the applicable Product-Specific Terms
  • Use any Service in violation of any law that applies to you or to the information you handle, including HIPAA and laws like it anywhere in the world (Sections 9.5 and 9.6)

4.1 NO VPNS, PROXIES, OR LOCATION MASKING. No one may access or use any of the Services, including PostureCo's websites, mobile and desktop applications, the PostureCo Cloud web portal, RemoteScreen®, PostureScribe.AI®, and any API, through a virtual private network (VPN), proxy server, anonymizing network, or any other technology that hides, masks, or changes the location from which the Services are accessed, including a VPN provided by an employer or a practice. Doing so is prohibited and is a material breach of this Agreement. PostureCo may not be able to detect the use of a VPN or other location-masking technology, has no obligation to monitor for it or to detect it, and may (but need not) block, suspend, or terminate access to any or all of the Services, without notice, if it suspects such use (Section 18). PostureCo may check for such technology when anyone requests a sign-in code for, registers for, signs in to, or opens Locked Content in its Knowledge Base (Section 23.6); that check, like any other, creates no obligation to monitor for or detect such technology. You are solely responsible for every consequence of any such use by you, by your workforce, by anyone using your account, or by any patient or client you invite to RemoteScreen®, including the use of a feature where it is not available (such as PostureScribe.AI® or the RemoteScreen® AI-Guided Health History outside the United States, Sections 8.8 and 8.9), data stored in a region that is wrong for you (Section 8.6), and any resulting violation of law. To the maximum extent permitted by law, and except for PostureCo's own obligations under any executed BAA or data processing agreement or that applicable law imposes on it directly, PostureCo has no liability for any of those consequences, and they are covered by your indemnity (Section 11).

5. NO MEDICAL ADVICE; THE POSTURESCREEN® SUITE AND POSTURERAY®#

None of the Services provides medical advice. The PostureScreen® suite of fitness and wellness assessment applications (the "PostureScreen® Suite," described in Section 5.2) is not a medical device, is not FDA-regulated, and is not intended to diagnose, treat, cure, or prevent any disease or medical condition. All output of the PostureScreen® Suite is informational, observational, and non-clinical only. PostureRay® for X-ray documentation (Section 5.3) is sold only to licensed healthcare practitioners who have completed training in radiology as part of their professional coursework, either in school or in postgraduate studies. It is documentation software and does not diagnose, treat, cure, or prevent any disease or medical condition. Professional judgment and responsibility rest solely with the licensed provider or user.

5.1 PURPOSE AND USERS. PostureCo's software tools are intended for objective postural, movement, body composition, and radiographic measurement, documentation, and education purposes. They are designed for use by fitness professionals and licensed healthcare providers. These software tools are not medical devices and are not intended to diagnose, treat, cure, or prevent any disease or medical condition. All markings, landmark placements, and digitizations, whether manual or AI-assisted, must be reviewed and validated by the professional using the software. The user remains solely responsible for all interpretations, clinical judgments, diagnoses, and treatment decisions.

5.2 THE POSTURESCREEN® SUITE: FITNESS AND WELLNESS ASSESSMENT APPLICATIONS. The PostureScreen® Suite consists of PostureScreen® with its screening modules, including but not limited to its LeanScreen® body composition, SquatScreen® movement, range of motion, and seated posture modules, and the standalone LeanScreen® and SquatScreen® applications. It is a suite of fitness and wellness assessment applications. It is not a medical device, is not FDA-regulated, and is not intended to diagnose, treat, cure, or prevent any disease or medical condition. All of its output is informational, observational, and non-clinical only. The PostureScreen® Suite provides objective postural, body composition, and movement screening assessments and documentation tools for use by licensed healthcare professionals and fitness professionals, and it assists in measuring and recording postural alignment and movement patterns. All markings, landmark placements, and digitizations made in any part of the PostureScreen® Suite, whether manual or AI-assisted, must be reviewed and validated by the professional user, who retains sole responsibility for interpretation, clinical decision-making, and any diagnosis or treatment.

5.3 POSTURERAY® IS A DOCUMENTATION SYSTEM SOLD ONLY TO LICENSED HEALTHCARE PRACTITIONERS. PostureRay® for X-ray documentation is separate from the PostureScreen® Suite and is sold and licensed separately. PostureRay® is sold and licensed only to licensed healthcare practitioners who have completed training in radiology as part of their professional coursework, either in school or in postgraduate studies. By purchasing or licensing PostureRay®, you represent that you are such a practitioner, or a practice acting through one. PostureCo relies on that representation and has no obligation to verify it. PostureCo may ask for proof of licensure and training, and may decline, suspend, or terminate a PostureRay® license if it is not provided or the requirement is not met. PostureRay® is a radiographic mensuration documentation software system. It is not a replacement for clinical interpretation, and it does not diagnose. All markings, landmark placements, and digitizations, whether manual or computer vision-assisted (AI-assisted), must be reviewed and validated by the clinician using PostureRay®, and all clinical judgment, including all interpretations, diagnoses, and treatment decisions, is made solely by that clinician and not by PostureCo or PostureRay®. PostureRay® does not acquire X-rays from your x-ray machine nor replace PACS systems. It is a specialized documentation software system designed to enhance your existing imaging documentation workflow.

5.4 PROFESSIONAL RESPONSIBILITY FOR ALL MARKINGS, DIGITIZATIONS, AND OUTCOMES. The software provided as part of the Services is documentation software that can measure and record. With respect to your patients, clients, and professional work, PostureCo's role is limited to providing that software and any related optional services described in this Agreement. PostureCo does not provide medical, clinical, or other professional services to your patients or clients; does not examine, interpret, diagnose, or treat any patient or client; and does not review, check, verify, or approve any marking, digitization, measurement, report, or other output for you, including any AI-assisted output. You retain full and sole responsibility for each of the following:

  • Every marking, landmark, digitization point, calibration, measurement, line, angle, annotation, and other entry made in or with the Services, whether it was placed manually, placed by the Services' artificial intelligence features (including computer vision), or placed by those features and then accepted, edited, or left unchanged by you or by anyone using your account
  • Reviewing and validating every marking, landmark placement, digitization, calibration, and measurement for accuracy and appropriateness before you use, save, report, export, or share it for any purpose
  • All reports, exports, notes, images, and other communications you create, sign, send, or share using the Services, and anything you tell a patient, client, payer, referral source, or other professional about them
  • All interpretations, clinical judgments, diagnoses, treatment and care decisions, recommendations, referrals, and other professional decisions, and all outcomes of those decisions, of the care, services, and advice you provide, and of your use of the Services
  • The training, supervision, and conduct of your staff and of anyone else who uses the Services under your account or license, whose actions are treated as your own

Accepting, saving, or leaving unchanged any AI-assisted marking, landmark placement, digitization, or other output means that you adopt it as your own work. The fact that a marking or digitization was suggested or placed by the Services, by their artificial intelligence features (including computer vision), or by a default setting does not shift any responsibility to PostureCo. Nothing in the Services, including any measurement, comparison, graphic, score, report, or educational content, is a diagnosis, a treatment recommendation, or a substitute for your own independent professional judgment.

5.5 NO WARRANTY; OTHER SECTIONS UNCHANGED. Sections 5.1 through 5.4 describe the purpose of the Services and who is responsible for their use. They are not a representation or warranty that any measurement, marking, digitization, landmark placement, estimate, report, or other output is accurate, precise, complete, reliable, valid, or suitable for any clinical purpose. They do not expand the uses permitted by Section 2, narrow the uses prohibited by Section 4, or limit Sections 12 and 13. "AI-assisted" means generated or suggested by the Services' artificial intelligence features, including computer vision.

6. DATA OWNERSHIP AND ACCESS#

You retain ownership of all data you input into the Services. Unless you subscribe to optional cloud-based services or support plans, use PostureScribe.AI®, or choose to send data to PostureCo yourself (as the next paragraph describes):

  • Data is kept locally on your device, subject to your device's own backup and sync settings (Section 7.1)
  • PostureCo has no access, custody, or control
  • PostureCo cannot retrieve, view, restore, or recover your data.

To be explicit: PostureCo's software applications that run on your own devices, such as PostureScreen® and PostureRay®, are local-first, and the patient and client records you enter in them are kept on your own devices and systems and are not sent to PostureCo unless you send them to PostureCo in one of the ways this paragraph describes. Unless you use PostureCo Cloud Services or PostureScribe.AI®, subscribe to a support plan that includes cloud backup, or choose to send or show records to PostureCo yourself (for example, in a support request or a remote support session), PostureCo never has access to your patient or client records. PostureCo stores or processes patient or client records only in those cases, and only as this Agreement, the applicable Product-Specific Terms, and any executed BAA allow (Sections 8.7 and 9.3). You must not send or show PHI to PostureCo yourself, including for support, except as Section 8.4 allows.

Your device's operating system, and any backup, sync, or storage service that you, your organization, or anyone using your devices turns on or connects, such as Apple iCloud Backup, may copy those records off the device. Such copies are not sent to PostureCo, remain outside PostureCo's access, custody, and control, and are governed by Sections 7.1 through 7.4.

Notwithstanding the same, PostureCo reserves the right to automatically collect and use anonymized and aggregated technical and usage data (e.g., non-PHI metadata, feature usage statistics, performance data, and error logs) derived from the Services, only to operate, maintain, secure, support, and improve the Services, as Sections 2.3 and 13.4 of the Privacy Policy describe. Such data contains no PHI, does not identify any individual, and is not patient or client records for purposes of this Section 6. PostureCo does not collect measurement data, such as the coordinates, angles, or other measurements calculated in the Services, for its own use, and it does not use the data it collects automatically to train or develop artificial intelligence models.

PostureCo does not create de-identified data from the patient and client records it stores or processes for you, does not use those records to train or develop artificial intelligence models, and does not license or sell de-identified data made from them, except under a separate written agreement that you sign for that purpose (for example, as a beta tester or research partner), and then only as that agreement, any executed BAA, and the law permit. PostureCo never sells the records themselves (Section 8.7). PostureCo keeps any de-identified data it holds under such an agreement in de-identified form, does not attempt to re-identify it except as the law permits, and, where the law requires, contractually prohibits anyone to whom it discloses de-identified data from re-identifying it. Otherwise, PostureCo accesses identifiable patient or client records only to provide, secure, and support the Services, as you authorize, as Section 8.7 describes, or as the law requires.

6.1 SHARING WITH PARTNERS. PostureCo shares information about you only as described in its Privacy Policy, which forms part of this Agreement. PostureCo's partners are CBP Seminars, Inc., CBP Non-Profit, Inc., WebExercises, Inc., 3D Practice, and any company with which PostureCo later establishes an integration or partnership, as listed in Section 7.1 of the Privacy Policy. PostureCo does not share your information with any other third party for that third party's own marketing. PostureCo never sells or shares mobile telephone numbers or text-messaging consent with its partners or any other third party (Section 22.7). PostureCo does not share information that it collects through its Knowledge Base with its partners (Section 23.5 and Section 2.8 of the Privacy Policy).

7. DATA LOSS, BACKUPS, AND DELETION#

PostureCo is not responsible for data loss, corruption, deletion, or overwriting arising from device failure, operating system or application updates, sync failures, encryption failures, cloud outages, third-party services, malware, ransomware, hacking, or user error. You are solely responsible for maintaining independent, redundant backups of your data, using only backup methods that meet your legal obligations (Section 7.3).

Data stored on PostureCo servers under optional cloud services or technical support plans, including PostureRay® cloud backup and online ViewBox data, remains available for you to export yourself, through the export features that the applicable Service provides, while the subscription or plan is active and for thirty (30) days after it ends for any reason, including cancellation, expiration, non-payment, or termination (the "Retrieval Period" described in Section 5A of the PostureCo Cloud Services Agreement), and may then be permanently deleted without notice and without liability, as that Section 5A describes (which applies in the same way to data stored under a technical support plan) or, for PHI, as an executed BAA provides. It is solely your responsibility to export every record you need, in the formats you need, before the Retrieval Period ends. If you cannot sign in or export during the Retrieval Period, email info@postureco.com before it ends, explaining the problem without including any PHI; after verifying your request, PostureCo will restore your ability to export and, if the Services caused the problem, extend the Retrieval Period by the time from your email until it does. Except as the law requires, PostureCo does not send or deliver your data to you or to anyone you designate when a subscription or plan ends, and it does not provide copies of its databases or backups, files in PostureCo's own formats, or any data that can be viewed only with PostureCo's software, except that, while a PostureRay® technical support plan is active, PostureCo's technicians may restore PostureRay® data from PostureRay® cloud backup into your PostureRay® software as that plan provides.

PostureCo does not provide archival services and is not a medical-records custodian, and none of the Services, including PostureCo Cloud Services, is a system of record for any legal record-retention obligation. You are solely responsible for keeping complete records in your own system of record for as long as the law requires, and for retrieving any data you wish to keep before it is deleted.

7.1 THIRD-PARTY BACKUP, SYNC, AND STORAGE SERVICES, INCLUDING APPLE iCLOUD. PostureCo's apps run on phones, tablets, computers, and operating systems that PostureCo does not make, operate, or control, such as Apple iPhone, iPad, and Mac devices and Microsoft Windows computers. Those devices and operating systems, and the backup, synchronization, storage, file-sharing, email, and device-management services that you, your organization, or anyone using your devices turns on or connects, can copy, back up, synchronize, or store the information you keep in or export from the Services on servers that third parties operate (each, a "Third-Party Backup Service"). That information can include patient and client records, demographics, photographs, videos, measurements, notes, reports, signed forms, and audio recordings. Third-Party Backup Services include, for example, Apple iCloud Backup, iCloud Photos, iCloud Drive, and iCloud Mail; Google Drive and other Google backup and storage services; Microsoft OneDrive and Windows Backup; Dropbox and Box; other cloud backup software and services; and backups of a device made to a computer, server, or storage service that you do not control. They also include any third-party service that you choose to connect through the Services, such as Google Drive (through the "Allow Google Drive Storage" option) or a third-party electronic health record system (through an electronic health record connection), which, once you turn the connection on, may receive records automatically. No Service that PostureCo itself provides, and no service provider that PostureCo uses to provide one, such as Amazon Web Services, is a Third-Party Backup Service; this includes PostureCo Cloud Services (and the Cloud Backup feature in PostureCo's apps), PostureScribe.AI®, and the cloud backup and online ViewBox included in a PostureRay® technical support plan.

For example, if iCloud Backup is turned on for an iPhone or iPad, Apple's backup can include the information that PostureScreen® and PostureCo's other apps keep on that device, unless you turn off iCloud Backup for those apps or for the device. PostureScreen® can save copies of the client photographs you take, and, if you choose, client videos, to the device's Photos app (the "Save images to device Photos app" and "Save videos to device Photos app" settings, or any similar setting), and, on a new installation, the setting for photographs may be on until you turn it off in PostureScreen® itself, whatever any other settings screen shows. Photographs and videos in the Photos app are uploaded to iCloud when iCloud Photos is turned on, and, when iCloud Photos is off, they can be included in iCloud Backup. A file that you export or share, for example through the device's share sheet, may be saved to iCloud Drive or to another service you choose. Whether and when any of this happens is controlled by your device settings, your accounts, and your organization's systems, under each provider's own terms, and not by PostureCo.

Apple's iCloud terms, as of the date shown at the top of this Agreement, state that a covered entity or business associate, as HIPAA defines those terms, or a representative of either, must not use iCloud to create, receive, maintain, or transmit protected health information, or use iCloud in any way that would make Apple (or an Apple subsidiary) its or any third party's business associate. Many other consumer backup and cloud services do not offer, or will not sign, a business associate agreement. Under guidance from the U.S. Department of Health and Human Services, a cloud service provider that stores electronic PHI on behalf of a covered entity or business associate is generally a business associate even if it stores only encrypted PHI and does not have the key to decrypt it, so encrypting a backup, including with an end-to-end encryption option that a provider offers (such as Apple's Advanced Data Protection), does not by itself make a service appropriate for PHI. PostureCo makes no representation that any Third-Party Backup Service, or any setting of one, is suitable or lawful for PHI or for any other patient or client information. PostureCo is not affiliated with, or endorsed by, Apple or the provider of any other Third-Party Backup Service.

7.2 KEEPING PHI OUT OF THIRD-PARTY BACKUPS IS YOUR RESPONSIBILITY. Each Third-Party Backup Service is provided to you by its provider under your own agreement with that provider. Copies made by or in a Third-Party Backup Service are made through your devices, settings, accounts, and choices, and are held by that provider. PostureCo does not receive, access, view, store, or control those copies, and any copy that PostureCo's software sends to a service you connect, such as Google Drive, is sent from your device, under your own account with that service, because you turned that connection on. PostureCo does not select, review, approve, configure, or monitor any Third-Party Backup Service; is not a party to your agreement with its provider; and does not act for you in any dealing with it. No Third-Party Backup Service is PostureCo's service provider or subcontractor, no BAA with PostureCo covers any information in one, and PostureCo is not your business associate for it.

If you are subject to HIPAA, or to any other law that protects health or personal information, you are solely responsible for determining whether each Third-Party Backup Service that can reach your devices or records may lawfully hold PHI or other patient or client information; for obtaining, before it does, any business associate agreement or other agreement that the law requires; and, where it may not lawfully hold that information, for keeping the information out of it. You must do so on every device and account you use with the Services, before you enter PHI in the Services and for as long as PHI remains on the device. The steps you should take include, for example:

  • Turning off iCloud Backup for PostureScreen® and for every other PostureCo app that holds PHI, or turning off iCloud Backup for the device, in the device's iCloud settings; on an iPhone or iPad, for example, Apple's settings let you turn off iCloud Backup for an app and remove that app's information from iCloud at the same time
  • Turning off the "Save images to device Photos app" and "Save videos to device Photos app" settings in PostureScreen®, not using "Save Image" or any other option that saves patient or client images to the Photos app, and checking the Photos app itself to confirm that no patient or client images are being saved there, unless no Third-Party Backup Service, such as iCloud Photos, a photo-sharing service, or a backup that includes the photo library, can copy the Photos app's contents off that device
  • Not exporting, sharing, emailing, or saving PHI to iCloud Drive, iCloud Mail, or any other Third-Party Backup Service that does not meet your obligations, and turning on a connected service, such as the "Allow Google Drive Storage" option, only under an account and an agreement with its provider that meet them
  • Letting a device trust, synchronize with, or back up to a computer only if you control and secure that computer and its storage, and backing a device up to a computer only with the backup's encryption turned on
  • Removing, under the provider's own procedures, any PHI that a Third-Party Backup Service already holds and may not lawfully hold
  • Checking these settings again whenever you set up, restore, replace, or update a device or its operating system, or sign in to it with a different account, because those events can change them
  • Using mobile device management, where your practice uses it, to apply these settings to the devices it manages
  • Making sure that your workforce, and anyone else who uses your devices or accounts, follows these steps

If you are a HIPAA covered entity or business associate, you should take these steps, or other steps that are at least as protective, to meet that responsibility. If you are not, for example if you work in health and fitness only and are not covered by HIPAA, these steps are recommended, and whether you take them is your choice, as long as you comply with any other law that applies to you, such as a state health-privacy or consumer-health-data law. In either case, the choice and its consequences are yours, and Sections 7.3 and 7.4 apply.

These steps are examples only, and they are not a complete list. Device settings, menu names, and providers' terms change, and you must follow the current instructions of your device and service providers and the advice of your own legal counsel. Any reminder, instruction, help article, or setting that PostureCo provides about Third-Party Backup Services is for your convenience only and does not make PostureCo responsible for them.

7.3 YOUR BACKUPS MUST BE INDEPENDENT AND LAWFUL. Keeping PHI out of a Third-Party Backup Service does not relieve you of your responsibility to back up your data (Section 7), or of any data backup plan that the HIPAA Security Rule or any other law requires of you, and any loss of data that you have not backed up is your responsibility. Your backups must be both independent and lawful. PostureCo's own backup for this purpose is PostureCo Cloud Services (the Cloud Backup feature in PostureCo's apps) or, for PostureRay®, the cloud backup included in a PostureRay® technical support plan, used as Sections 8 and 9 require, including, for a U.S. healthcare company that needs one, under a fully executed BAA that covers them; a U.S. healthcare company may request PostureCo's standard BAA for them (Section 8.2). Depending on your circumstances, other backup methods that may meet your obligations include encrypted backups on computers and storage devices that you control and secure; your own electronic health record or other system of record; and any other service that you have confirmed meets your obligations, including through any business associate agreement they require. PostureCo Cloud Services are not a complete or exclusive backup solution (Section 7 and Section 3 of the PostureCo Cloud Services Agreement). Information that PostureCo Cloud Services synchronize to your devices is again on those devices, and Section 7.2 applies to it there.

7.4 POSTURECO IS NOT RESPONSIBLE FOR THIRD-PARTY BACKUP SERVICES; YOUR RELEASE AND INDEMNITY. PostureCo may, but need not, offer settings, reminders, or features that affect what its apps save to a device's Photos app or what a device backs up or synchronizes; it may change or remove them at any time; and it does not promise that any of them prevents every copy. Their presence, absence, or default value, including any default that saves photographs to the Photos app or leaves app data in a device backup, does not shift any responsibility to PostureCo.

AS BETWEEN YOU AND POSTURECO, AND TO THE MAXIMUM EXTENT PERMITTED BY LAW, POSTURECO IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD-PARTY BACKUP SERVICE OR FOR ANY INFORMATION IN IT OR SENT THROUGH IT, INCLUDING ANY BACKUP, SYNCHRONIZATION, COPYING, STORAGE, RESTORATION, RETENTION, ACCESS, USE, DISCLOSURE, LOSS, CORRUPTION, OR SECURITY INCIDENT, OR FOR ANY FAILURE TO KEEP PHI OUT OF ONE (EACH, A "BACKUP MATTER"). YOU RELEASE POSTURECO AND ITS OFFICERS, DIRECTORS, EMPLOYEES, CONTRACTORS, AGENTS, LICENSORS, AND AFFILIATES (TOGETHER, THE "RELEASED PARTIES") FROM, AND AGREE NOT TO BRING AGAINST ANY OF THE RELEASED PARTIES, ANY CLAIM ARISING OUT OF OR RELATED TO ANY BACKUP MATTER, WHETHER BASED ON CONTRACT, TORT, STATUTE, OR ANY OTHER THEORY, AND EVEN IF THE BACKUP MATTER OR THE CLAIM IS CAUSED, OR IS ALLEGED TO BE CAUSED, IN WHOLE OR IN PART BY THE NEGLIGENCE OF POSTURECO OR OF ANY OTHER RELEASED PARTY, BY ANY SETTING OR DEFAULT OF THE SERVICES, BY YOU OR ANYONE USING YOUR ACCOUNT OR DEVICES, OR BY THE PROVIDER OF THE THIRD-PARTY BACKUP SERVICE, AND WHETHER OR NOT YOU TOOK THE STEPS THAT SECTION 7.2 DESCRIBES. YOU MUST ALSO DEFEND, INDEMNIFY, AND HOLD HARMLESS THE RELEASED PARTIES, AS SECTION 11 PROVIDES, AGAINST EVERY CLAIM BY ANYONE ELSE, INCLUDING YOUR PATIENTS AND CLIENTS AND ANY GOVERNMENT AUTHORITY, AND EVERY FINE, PENALTY, LOSS, AND EXPENSE, ARISING OUT OF OR RELATED TO ANY BACKUP MATTER.

This Section 7.4 does not exclude PostureCo's liability for, release, or bar you from bringing under Section 16, any claim to the extent that it arises from PostureCo's gross negligence, willful misconduct, or fraud, and asking an arbitrator under Section 16 to decide whether a claim is released is not a breach of this Section 7.4. Your indemnity for Backup Matters does not apply to the extent that a final decision of an arbitrator or court determines that a loss was caused by PostureCo's gross negligence, willful misconduct, or fraud. This Section 7.4 does not limit PostureCo's own obligations under an executed BAA as to PHI that PostureCo itself creates, receives, maintains, or transmits through the Services that the BAA covers (including through PostureCo Cloud Services), any obligation that applicable law imposes on PostureCo directly and that cannot be waived or limited by contract, or any right of a government authority. If this Section 7.4 conflicts with an executed BAA, the BAA controls, but only as to PHI that PostureCo creates, receives, maintains, or transmits on your behalf through the Services the BAA covers (Section 9.3). Sections 7.1 through 7.4 survive termination.

8. CLOUD SERVICES (OPTIONAL)#

Cloud-based services, including backups, virtual viewbox access, artificial intelligence modules, and browser-based tools, are optional, subscription-based, and provided "AS IS" and "AS AVAILABLE." Discontinuation of the applicable subscription or support plan will result in loss of access to these features, without affecting local software functionality, except that you may still export the data PostureCo stores for you during the Retrieval Period described in Section 7.

No uptime guarantee. PostureCo does not guarantee that any cloud-based Service will be available at any particular time or for any percentage of time, or that it will meet any response time or performance level, and it offers no service level agreement, uptime commitment, or service credits unless a separate written agreement signed by PostureCo says otherwise. PostureCo may suspend, limit, or interrupt any cloud-based Service, with or without notice, for scheduled or emergency maintenance, updates, or security, or to protect the Services or your data. No outage, interruption, or slowdown entitles you to a refund, credit, or extension of a subscription or support plan, and you are responsible for keeping the local copies and backup procedures your practice needs while a cloud-based Service is unavailable.

8.1 HIPAA POSITION. PostureCo is not a Business Associate by default. Using any Service, including PostureCo Cloud Services or PostureScribe.AI®, does not by itself create a BAA. PostureCo agrees to act as your business associate only under an executed BAA, and you must not provide PHI to PostureCo without one (Section 8.4). It is your sole responsibility to determine whether a BAA is required and, if it is, to affirmatively request one from PostureCo, supplying your own proposed BAA or asking for PostureCo's standard BAA, and to make sure it is fully executed by both you and PostureCo before any PHI reaches PostureCo, including before you turn on cloud sync or invite patients to RemoteScreen® (Section 8.2). Any unauthorized upload of PHI is at your sole risk.

8.2 WHO MAY REQUEST A BAA; REQUESTING ONE IS YOUR RESPONSIBILITY. Section 8.1 applies to every user. Except as Section 8.5 provides for practitioners outside the United States, PostureCo enters into a BAA only with a healthcare provider, covered entity, or business associate under HIPAA that is located in the United States (a "U.S. healthcare company"), only for its use of one or more of the following, together with technical support for them: PostureCo Cloud Services (including RemoteScreen® and PostureRay® on PostureCo Cloud), PostureScribe.AI®, the cloud backup and online ViewBox included in a PostureRay® technical support plan, and remote technical support for PostureRay® software; and only at its request. PostureCo does not enter into a BAA for any other Service, including the mobile applications used alone (Section 8.3). If you are a U.S. healthcare company, or are otherwise subject to HIPAA, and you use PostureCo Cloud Services, PostureScribe.AI®, or a PostureRay® technical support plan's cloud backup or online ViewBox, or receive remote technical support for PostureRay® software, the onus is entirely on you to determine whether a BAA is required and, if it is, to request one from PostureCo by email to info@postureco.com or through the contact form on PostureCo's website (https://www.postureanalysis.com/postureco-support/), without including any PHI in your request. You may supply your own proposed BAA for PostureCo's review or ask for PostureCo's standard BAA. The BAA must be fully executed by both you and PostureCo before any PHI is uploaded, transmitted, recorded, or dictated, which includes before you set up or turn on cloud backup or synchronization for records that contain PHI (once it is on, the Services may upload your records automatically; Section 7.3 of the PostureCo Cloud Services Agreement), before you use PostureScribe.AI® with PHI, before you invite any patient to RemoteScreen® (Section 8.9), and before PostureCo's staff see any PHI during remote technical support (Section 8.4). PostureCo has no obligation to ask whether you need a BAA, to offer one, or to remind you. A request alone does not create a BAA, and no BAA exists unless and until it is fully executed by both you and PostureCo. PostureCo may accept, negotiate, or decline any proposed BAA, except to the extent the applicable Product-Specific Terms expressly provide otherwise. A BAA covers only the Services it names. For example, a BAA that covers PostureScribe.AI® but not PostureCo Cloud Services does not permit PHI in PostureCo Cloud Services, and a BAA that covers PostureCo Cloud Services but not PostureScribe.AI® does not permit PHI in PostureScribe.AI®. Until a BAA that covers the Service in question is fully executed, you must not upload, transmit, record, or dictate any PHI to or through PostureCo's servers or systems, including through PostureCo Cloud Services, RemoteScreen®, or PostureScribe.AI®, and any PHI you do upload, transmit, record, or dictate is at your sole risk (Sections 4, 8.1, and 8.4). The applicable Product-Specific Terms, including the PostureScribe.AI® User Agreement, Indemnification, and Terms of Service and the PostureCo Cloud Services Agreement, may set further conditions on whether a BAA is available and on what terms.

8.3 NO BAA FOR MOBILE APPS ALONE. PostureCo does not enter into a BAA for the use of its iOS, iPadOS, or Android mobile applications alone, such as PostureScreen® and its screening modules used without a PostureCo Cloud Services subscription, PostureScribe.AI®, or a support plan, because, as described in Section 6, the data you enter in those applications is kept locally on your device, subject to your device's own backup and sync settings (Section 7.1), and, except for data you choose to send to PostureCo through optional cloud-based services, PostureScribe.AI®, or a support plan, PostureCo has no access, custody, or control of it. Data kept only on your own device in this way is not uploaded to or stored on PostureCo's systems. Whether a BAA is available for PostureCo Cloud Services, PostureScribe.AI®, or any other optional service is governed by Section 8.2 and the applicable Product-Specific Terms. Protecting the data on your device, including device security, passcodes, encryption, exports, and backups, is your sole responsibility, including deciding whether your device or any Third-Party Backup Service, such as Apple iCloud Backup, may copy it; no BAA with PostureCo covers any such copy (Sections 7.1 through 7.4).

8.4 DO NOT SEND PHI TO POSTURECO WITHOUT A BAA, INCLUDING FOR SUPPORT. Unless a BAA between you and PostureCo is fully executed and in effect, you must not send, upload, show, or otherwise transmit any PHI to PostureCo, by any means. This includes every request for technical support or troubleshooting, whether by email, support ticket, the website contact form, chat, text message, telephone, file upload, or remote screen-sharing session. Unless such a BAA is in effect, before you send PostureCo any documentation, report, export, image, X-ray, screenshot, recording, log, or other file, or start a remote support session, you must remove, redact, or hide all patient and client identifiers and other PHI, and you must never simply email patient or client documentation that has not been redacted. Even when a BAA is in effect, you may send PHI to PostureCo only through secure, encrypted means: the Services' encrypted features that the BAA covers, or another secure, encrypted method that PostureCo has approved in writing for that purpose, and never by unencrypted email. A remote support session that PostureCo's support staff start with PostureCo's encrypted remote-support tool is an approved method for showing PHI during technical support that the BAA covers, but even then you must hide any PHI that the support does not require. PostureCo may delete any PHI it receives in breach of this Section 8.4 and is not responsible for it, and you remain solely responsible for any such transmission.

8.5 BAAS ONLY IN THE UNITED STATES. Except as this Section 8.5 provides, PostureCo enters into BAAs only with persons and organizations located in the United States, and it does not sign BAAs or similar health-information agreements with persons or organizations outside the United States, other than the data processing terms, standard contractual clauses, and data processing agreement described in Section 9.5 and Section 8 of the PostureCo Cloud Services Agreement. If a healthcare practitioner outside the United States wishes to use PostureCo Cloud Services, or the cloud backup or online ViewBox included in a PostureRay® technical support plan, PostureCo may consider a request on a case-by-case basis, in its sole discretion. The onus is on that practitioner to supply PostureCo with all documentation PostureCo needs to verify the request, including any proposed agreement for PostureCo to review and, where PostureCo considers it appropriate, sign. PostureCo has no obligation to agree to any such request. You must state accurately where you and your practice are located in any BAA request, and PostureCo may rely on that statement without verifying it. For Sections 8.2 and 8.5, your location is where you and your practice actually are, not where you appear to access the Services from, and using a VPN or other location-masking technology (Section 4.1) does not change it. If you are a healthcare provider or other professional outside the United States, Section 9.5 also applies, including your sole responsibility to identify, request, and supply any agreement or other requirement that your own law imposes before you upload any information it covers.

8.6 WHERE CLOUD DATA IS STORED; YOU CHOOSE THE REGION. PostureCo Cloud Services' storage, backup, and synchronization infrastructure runs on Amazon Web Services ("AWS"), under a signed Business Associate Addendum between PostureCo and AWS. PostureCo Cloud Services data, including PHI, is stored and processed in AWS services that AWS designates as HIPAA-eligible; information sent to an AI provider for the artificial intelligence features is processed by that provider under its own BAA with PostureCo (Section 8.8 and Section 6 of the PostureScribe.AI® User Agreement, Indemnification, and Terms of Service). PostureCo uses regional AWS infrastructure. During setup, you choose, directly in the Services, the location (AWS region) where your PostureCo Cloud Services data is stored, from the regions PostureCo offers at the time (for example, the United States, Europe, or Asia, where offered). PostureCo does not promise that any particular region, or a region for every country, is available, and it may add, change, or retire regions. Choosing the correct region for your location and for the laws that apply to you and to your patients and clients, including data-residency, data-protection, and health-information laws such as HIPAA, the GDPR, and the UK GDPR, is your sole responsibility. PostureCo is not required to, and does not undertake to, determine, verify, or monitor where you, your workforce, or your patients or clients are located, and it cannot reliably tell, for example because someone may connect through a VPN in breach of Section 4.1. Any location, network, or VPN check that PostureCo chooses to use is for its own protection only, may be inaccurate or incomplete, and does not make PostureCo responsible for anyone's location, for your choice of region, or for any use of the Services or of a feature where it is not available. PostureCo stores your cloud data in the region you select and relies on your selection. If the Services offer you no choice, or you make none, your cloud data is stored in the United States.

If you selected the wrong region, set up your data outside your country by mistake, or later need your data moved to another region, you must contact PostureCo support promptly once you realize it, by email to info@postureco.com, toll free at 866-577-7297 (+1-866-577-7297 from outside the United States), or through the contact form on PostureCo's website (https://www.postureanalysis.com/postureco-support/), without including any PHI in your request. After verifying your request (as Section 6 of the Privacy Policy describes), PostureCo will assist you: it will manually move your data to the correct region, which you designate from the regions PostureCo then offers, and delete it from the previous region, including any region where it was created by mistake, within a reasonable time, subject to secure backup retention cycles (copies in backups expire on their normal cycle and remain protected until then). By asking PostureCo to move your data, you instruct and authorize PostureCo to transfer it between the regions concerned. If no region that PostureCo then offers is suitable for you, PostureCo has no obligation to offer another one, its only obligation as to that data is to delete it at your verified request (subject to the same backup retention cycles), and you must stop storing that data in PostureCo Cloud Services; retrieving any data you wish to keep before it is deleted is your responsibility (Section 7). PostureCo does not guarantee any completion time. Except as Section 4.1 of the PostureCo Cloud Services Agreement allows (for example, if a region becomes unavailable or is retired, or as needed to provide, secure, or support the Services or to comply with law), PostureCo does not move your data to another region on its own initiative. Until the move is completed, and for any period before you tell PostureCo, you are solely responsible for your data being stored and processed in the region you selected (or in the United States, if you made no selection), including every legal consequence of it, and, to the maximum extent permitted by law and except for PostureCo's own obligations under any executed BAA or data processing agreement or that applicable law imposes on it directly, PostureCo has no liability for it (Section 11).

Within a region, AWS stores data redundantly across multiple availability zones. Wherever your data is stored, PostureCo's personnel and service providers in the United States may access it as needed to provide, secure, and support the Services, subject to Section 8.7 and any executed BAA. PostureScribe.AI® and the RemoteScreen® AI-Guided Health History are processed in the United States, whatever region you choose, and are offered and authorized only in the United States at this time. The PostureCo Cloud Services Agreement (Sections 4 and 8) and the Privacy Policy (Section 10) describe hosting and international transfers in more detail. You are solely responsible for determining whether storing and accessing your data as this Section 8.6 describes complies with the laws that apply to you, and use of the Services outside the United States is at your sole risk. PostureScribe.AI® and the AI-Guided Health History, however, are not merely at your risk outside the United States: accessing or using either of them from outside the United States is not authorized by PostureCo, is prohibited, and is a material breach of this Agreement (Sections 4, 8.8, and 8.9), and any such use is also entirely at your own risk.

8.7 WHEN POSTURECO HAS ACCESS TO YOUR DATA. PostureCo has access to patient or client records only in the cases Section 6 describes. In those cases, PostureCo stores and processes them only as this Agreement, the applicable Product-Specific Terms, and any executed BAA allow and, for PHI covered by an executed BAA, only as that BAA permits. In the ordinary course of providing PostureCo Cloud Services, PostureCo's personnel do not view, review, or interpret your uploaded content (blind storage). PostureCo's systems process it automatically only to provide, secure, and support the Services. Access to production systems is limited to designated senior technology staff, for maintenance. PostureCo may also access, use, or disclose stored data when you ask it to (for example, for support, subject to Section 8.4); when needed to secure the Services or to investigate a security incident or a suspected breach of this Agreement; when the law requires it; where the law permits, to establish, exercise, or defend legal claims, to protect the rights, property, or safety of PostureCo, you, or others, and for PostureCo's proper management and administration, including by disclosure to PostureCo's legal, insurance, and accounting advisers under a duty of confidentiality; and, in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of PostureCo's business or assets, to the successor or acquirer, subject to the same protections that this Agreement provides and to any executed BAA. In every case, PostureCo uses and discloses customer PHI only as an executed BAA permits or the law requires, and PostureCo's service providers that receive PHI act for PostureCo under BAAs with PostureCo.

For the patient and client information you upload or submit through the Services, you decide why and how it is processed, and PostureCo processes it on your behalf: as your business associate where an executed BAA is in effect, and as your service provider or processor under U.S. state privacy and consumer-health-data laws, the GDPR, and the UK GDPR, to the extent those laws apply. PostureCo does not sell or share that information (as those laws define those terms). A data processing agreement is available on request (Section 8 of the PostureCo Cloud Services Agreement). PostureCo's safeguards include encryption in transit (TLS) and at rest (AES-256), per-practice data segregation enforced on the server, multi-factor authentication on the PostureCo Cloud web portal, and logging of access and administrative events, as the HIPAA Compliance Statement describes. PostureCo may change its safeguards and service providers at any time while maintaining equivalent or better protection, giving any notice of a new or replacement subprocessor that Section 8.3 of the PostureCo Cloud Services Agreement or applicable law requires. No method of storage or transmission is completely secure, and PostureCo does not guarantee that data will never be accessed, disclosed, altered, or lost without authorization. PostureCo is not a medical-records custodian, and PostureCo Cloud Services are not a system of record (Section 7).

8.8 THIRD-PARTY AI PROVIDERS. PostureScribe.AI® and the RemoteScreen® AI-Guided Health History use third-party artificial intelligence providers. PostureCo's primary provider for them is SpaceXAI LLC, the company formerly known as xAI and now part of SpaceX, which provides the Grok models ("SpaceX AI"). SpaceX AI provides AI services to PostureCo under a signed Business Associate Agreement and with zero data retention, meaning that it does not retain the data it processes for PostureCo. PostureCo's fallback provider for PostureScribe.AI® is Amazon Bedrock, which PostureCo uses within its own AWS account under PostureCo's BAA with AWS. Under PostureCo's arrangements, neither provider may use PostureScribe.AI® inputs or outputs to train its models. PostureScribe.AI® sends the AI provider the audio you record, for transcription, and the exam and assessment findings, notes, prompts, and instructions needed to produce the documentation you request, and PostureCo designs it to send only what is needed for that purpose. PostureCo may add, change, or replace AI providers or models at any time without prior notice, except where Section 8.3 of the PostureCo Cloud Services Agreement or applicable law requires notice, but it sends PHI only to AI providers bound by a BAA (or an equivalent subcontractor agreement) with PostureCo. The PostureScribe.AI® User Agreement, Indemnification, and Terms of Service names PostureCo's current AI providers and, in Section 6, the third-party AI provider terms that apply to your use, including the SpaceX AI Acceptable Use Policy, the AWS Acceptable Use Policy, and the AWS Responsible AI Policy. You must comply with those terms. You must not use any AI feature for an unlawful or harmful purpose, to infringe anyone's privacy or intellectual property, to generate false or misleading clinical documentation, or to reverse engineer or extract any model, and you must not access or use any AI feature through a VPN or other location-masking technology (Section 4.1). PostureScribe.AI® and the RemoteScreen® AI-Guided Health History may be used only from inside the United States (the next paragraph and Section 8.9). PostureCo may suspend or disable your access to AI features if it suspects that any of these rules has been broken. AI output may be inaccurate, incomplete, fabricated, or offensive. You must review, edit, and verify every output before you use it, and no AI output is medical advice, a diagnosis, or a treatment recommendation (Sections 5.4 and 12). Unless a BAA that covers the feature you are using is in effect (Section 8.2), you must not include PHI in any input to an AI feature (Section 8.4), and even when such a BAA is in effect, you should not dictate or enter identifiers that are not needed.

PostureScribe.AI® is offered and authorized only in the United States at this time. Accessing or using PostureScribe.AI® from outside the United States, whether by you, by your workforce, or by anyone using your account or devices, and including through a VPN or other location-masking technology, is not allowed or authorized by PostureCo, is prohibited (Section 4), and is a material breach of this Agreement and of Section 3.2 of the PostureScribe.AI® User Agreement, Indemnification, and Terms of Service, unless and until PostureCo formally releases PostureScribe.AI® outside the United States, which PostureCo will do only by publishing updated terms or a written release notice on its website or in the Services; no other statement, including one by PostureCo support or sales personnel, releases it. A release applies only to the countries or regions, and only on the terms, that the published updated terms or release notice expressly name; any access to or use of PostureScribe.AI® from anywhere else outside the United States, or otherwise than on those terms, remains a material breach of this Agreement and of the PostureScribe.AI® User Agreement, Indemnification, and Terms of Service. Except as such a release expressly provides, nothing in this Agreement or in any Product-Specific Terms licenses or permits the use of PostureScribe.AI® outside the United States. Anyone who circumvents this restriction does so entirely at their own risk, and you must defend, indemnify, and hold harmless PostureCo completely, as Section 11 provides, for any such use by you, by your workforce, or by anyone using your account or devices, and for that breach. PostureCo makes no claim, representation, or warranty that PostureScribe.AI® complies with any law outside the United States, including the GDPR or any similar law. PostureCo has no obligation to determine or verify where PostureScribe.AI® is used, and its failure to detect or block a use from outside the United States does not excuse or waive the breach. PostureCo may suspend, terminate, or disable PostureScribe.AI®, or your access to it, for any such use, with or without notice and, to the extent the law allows, without refund (Sections 3.1 and 18).

Sections 8.6 through 8.8 describe PostureCo's current hosting, safeguards, service providers, and AI providers, including what those providers have agreed with PostureCo and what they state about their own services, on which PostureCo relies. They are not a warranty, and they do not guarantee the performance of AWS, of any AI provider, or of any other third party. PostureCo does not operate the infrastructure of AWS or the systems of any AI provider, and it may change these practices as those Sections allow. Sections 12 and 13 apply.

8.9 REMOTESCREEN® AND YOUR PATIENTS. RemoteScreen® is part of PostureCo Cloud Services and requires your PostureCo Cloud Services subscription. It lets you send a patient or client a link that they open in a web browser on their phone, or in a RemoteScreen® app where one is offered, to enter identifying details, take guided posture photographs and a guided movement video, and, where your plan includes it and only from inside the United States, complete the AI-Guided Health History by voice. The in-browser posture guidance runs on the patient's own device. The photographs, videos, and intake results are uploaded to your PostureCo Cloud account, and the patient cannot read back your records through RemoteScreen®. PostureCo handles this information on your behalf, as Sections 6 and 8.7 describe. PostureCo is not your patients' or clients' healthcare provider, does not provide them with care or advice, and directs their requests about their records to you. The RemoteScreen® Patient App Privacy Policy (Section 1.1) is PostureCo's notice to them, and your own notice of privacy practices governs your use of their information. You are solely responsible for:

  • Having a fully executed BAA with PostureCo that covers PostureCo Cloud Services before you invite any patient to RemoteScreen®, if you are a covered entity or business associate under HIPAA (Section 8.2)
  • Giving every notice, and obtaining every consent and authorization, that the law requires before a patient or client uses RemoteScreen®, including for photographs and videos, for recording and transcribing the AI-Guided Health History, and for processing their information with artificial intelligence. The confirmations RemoteScreen® asks a patient for before the AI-Guided Health History (that they are not having a medical emergency, that the AI does not give medical advice, and that they consent to being recorded for transcription) do not replace them
  • Sending each link only to the intended person, and obtaining any consent that the Telephone Consumer Protection Act or any other law requires before you send a link or other message by text message or place a call
  • Telling every patient and client you invite not to use a VPN, proxy server, or other location-masking technology with RemoteScreen® (Section 4.1), and not inviting or allowing any patient or client who is outside the United States to use the AI-Guided Health History (as described below)
  • Making sure, because RemoteScreen® is not directed to children under thirteen (13) and PostureCo does not knowingly collect personal information directly from a child under thirteen (13), that a parent or legal guardian completes RemoteScreen® on behalf of any child under thirteen (13), so that the child does not use it on their own, and that the parent or legal guardian, not the child, gives every consent and confirmation RemoteScreen® asks for; that a minor aged thirteen (13) to seventeen (17) uses RemoteScreen® only with the permission of a parent or legal guardian and as you allow; and that every consent of a parent or legal guardian that the law requires, including any parental consent the Children's Online Privacy Protection Act requires, is obtained before the minor uses RemoteScreen®
  • Reviewing every submission, following up with the patient or client, and making every clinical judgment yourself (Section 5.4)

RemoteScreen® is not for emergencies or real-time monitoring, and a submission may be delayed, incomplete, or not received. You are responsible for telling your patients and clients to call their local emergency number, and not to use RemoteScreen®, in an emergency.

The RemoteScreen® AI-Guided Health History (the artificial intelligence voice medical and patient-history intake with the AI assistant) is available only in the United States at this time, and only on the PostureCo Cloud Services plans that include it. Any access to or use of it from outside the United States, whether by you, by anyone using your account, or by any patient or client you invite, and including through a VPN or other location-masking technology, is prohibited and is a material breach of this Agreement (including Section 4, which applies to patients and clients as Section 1 describes) unless and until PostureCo formally releases it outside the United States, which PostureCo will do only by publishing updated terms or a written release notice on its website or in the Services; no other statement, including one by PostureCo support or sales personnel, releases it. A release applies only to the countries or regions, and only on the terms, that the published updated terms or release notice expressly name; any access to or use of the AI-Guided Health History from anywhere else outside the United States, or otherwise than on those terms, remains a material breach of this Agreement. You must not invite or allow any patient or client who is outside the United States to use the AI-Guided Health History, and you are responsible for your invitees' compliance with this Section 8.9 and with Section 4, including under your indemnity in Section 11. RemoteScreen®'s posture photograph and movement video features may be used outside the United States, subject to your own legal responsibilities, including your choice of region (Section 8.6) and the laws that apply to you and to your patients and clients. PostureCo has no obligation to determine or verify where you or a patient or client is located when RemoteScreen® is used (Section 8.6), may (but need not) block or disable the AI-Guided Health History for any account, invitation, or use, and is not responsible for any use of it outside the United States.

9. REGULATORY COMPLIANCE#

You are solely responsible for compliance with all applicable laws and regulations, including HIPAA, HITECH, GDPR, state privacy laws, data-residency laws (including through your choice of cloud region, Section 8.6), professional licensing rules, and record retention requirements. PostureCo assumes no regulatory responsibility.

9.1 HIPAA AND HEALTH INFORMATION ARE YOUR RESPONSIBILITY. If you are a healthcare provider, a covered entity or business associate under HIPAA, or are otherwise subject to HIPAA, HITECH, or any other law that protects health information, the onus is entirely on you to determine whether and how those laws apply to you and to your use of the Services, and to understand and follow them. That includes deciding how you collect, use, share, store, export, and transmit any patient or client information, and using only services, devices, and channels that meet your legal obligations. You must not use any service, whether provided by PostureCo or by anyone else (for example email, text messaging, cloud storage, device or cloud backup and synchronization, including Apple iCloud, file sharing, electronic health record, or messaging services), to share, store, back up, or transmit protected health information unless that service, and the way you use it, complies with those laws, including any business associate agreement they require. PostureCo does not decide whether you are a covered entity or business associate, does not review or approve the services you choose, and is not responsible for any use, disclosure, storage, or transmission of information through services outside its control, including any service you export to, share with, or connect to the Services, and any Third-Party Backup Service that backs up or synchronizes your devices (Sections 7.1 through 7.4). Section 8 governs BAAs with PostureCo. Nothing in this Agreement is legal advice; you should consult your own legal counsel about your obligations.

9.2 YOUR HIPAA RESPONSIBILITIES. Without limiting Section 9.1, if you are subject to HIPAA, you are solely responsible for each of the following, and PostureCo does not perform any of them for you:

  • Deciding whether you are a covered entity or a business associate under HIPAA and whether you need a BAA with PostureCo (fitness and wellness professionals who are not covered entities or business associates may not need one, but the decision is yours), and, if you are a business associate, meeting your own business associate agreements, including any requirement to obtain your covered entity's permission before you use PostureCo as a subcontractor
  • Where a BAA is required, requesting one from PostureCo, and making sure it covers each Service you use with PHI and is fully executed by both you and PostureCo before any PHI is uploaded, transmitted, recorded, or dictated, which includes before you set up or turn on cloud backup or synchronization for records that contain PHI (once it is on, the Services may upload your records automatically; Section 7.3 of the PostureCo Cloud Services Agreement), before you use PostureScribe.AI® with PHI, and before you invite any patient to RemoteScreen® (Section 8.2)
  • Using, disclosing, and requesting only the minimum necessary PHI, and entering, recording, or dictating only the identifiers you need
  • Giving your patients your notice of privacy practices, and obtaining every consent and authorization the law requires, including for taking and storing photographs and videos, for recording or transcribing conversations, for processing their information with artificial intelligence, and for any disclosure about your use of artificial intelligence that the law of your state requires healthcare providers to make
  • Obtaining the consent of every party to a conversation before you record or transcribe it where the law requires the consent of all parties, as the laws of some states, including Florida and California, do
  • Giving each person who uses the Services under your account a unique user account where the Services offer one, never sharing credentials, and protecting every device you use with the Services with a strong passcode, multi-factor authentication where available, device encryption, automatic screen lock, and the Services' app lock or your device's biometric lock
  • Training, supervising, and, where appropriate, sanctioning your workforce for their handling of PHI, and promptly removing the access of anyone who leaves your practice or no longer needs it
  • Safeguarding every export, report, email, file, and transfer you make from the Services, including transfers to electronic health record systems and to file-sharing, messaging, and other third-party services, and having a business associate agreement in place with each of those vendors where HIPAA requires one (Section 9.1)
  • Configuring every device, account, and setting you use with the Services, including through mobile device management where you use it, so that PHI is not backed up, synchronized, or copied to Apple iCloud or any other Third-Party Backup Service unless that service, and your use of it, complies with HIPAA, including any business associate agreement HIPAA requires, and keeping a data backup plan that uses only backup methods that comply (Sections 7.1 through 7.4)
  • Responding to your patients' requests to exercise their rights, such as access, amendment, an accounting of disclosures, restrictions, and confidential communications
  • Performing your own risk analysis and breach risk assessments, and giving every breach notification the law requires of you as a covered entity, including to affected individuals, the U.S. Department of Health and Human Services, the media, and state authorities
  • Reporting to PostureCo any suspected security incident involving PostureCo Cloud Services, PostureScribe.AI®, or your account, such as a lost or stolen device that is signed in to them or a suspected compromise of your credentials, immediately as Section 3 requires and in any event within five (5) business days after you discover it, by email to info@postureco.com or toll free at 866-577-7297, without including any PHI in your report unless a BAA is in effect, and then only by a secure means that PostureCo has approved (Section 8.4). A report to PostureCo does not satisfy, or transfer to PostureCo, any notification duty you have
  • Keeping complete records in your own system of record for as long as the law requires, because PostureCo is not a medical-records custodian (Section 7)
  • Complying with every state or other law that is more stringent than HIPAA, such as state medical-privacy, consumer-health-data (for example, Washington's My Health My Data Act), biometric, recording-consent, and artificial-intelligence-disclosure laws

These responsibilities are yours whether or not a BAA is in effect, and PostureCo does not review or verify how you meet them.

9.3 WHEN A BAA IS IN EFFECT. Your BAA with PostureCo exists only when you have requested it and both you and PostureCo have fully executed it, which must happen before any PHI reaches PostureCo, including before you turn on cloud sync or invite patients to RemoteScreen® (Section 8.2). If you and PostureCo have fully executed a BAA, the BAA controls over any conflicting term of this Agreement or of the Product-Specific Terms, but only as to the PHI that PostureCo creates, receives, maintains, or transmits on your behalf through the Services the BAA covers; in every other respect, this Agreement and the Product-Specific Terms control. PostureCo's obligations as a business associate are only those stated in the executed BAA and those that HIPAA imposes on business associates directly; apart from them, the first paragraph of this Section 9 applies. As the executed BAA provides, PostureCo uses and discloses PHI only as the BAA permits or the law requires, including as needed to provide the contracted Services; applies the safeguards the HIPAA Security Rule requires; reports security incidents and breaches of unsecured PHI to you without unreasonable delay and no later than sixty (60) calendar days after discovery, or within any shorter period that the executed BAA or applicable law (such as the Florida Information Protection Act) requires; requires its subcontractors that handle PHI, such as AWS and PostureCo's AI providers, to agree to the same restrictions under their own business associate agreements; supports your obligations to give patients access to, amendment of, and an accounting of disclosures of their PHI; and, at termination, returns or destroys PHI as the executed BAA provides, which, for cloud data, includes keeping it available for you to export yourself during the thirty (30) day Retrieval Period described in Section 7 and then deleting it, and extends the BAA's protections to any PHI that cannot feasibly be returned or destroyed at once, such as copies held in secure backup retention cycles, limiting further uses and disclosures to the purposes that make return or destruction infeasible. This summary does not add to the executed BAA, and notifying affected individuals, the U.S. Department of Health and Human Services, and the media remains your responsibility unless the executed BAA expressly provides otherwise. To the extent the executed BAA permits, this Section 9.3 is notice of the ongoing existence of unsuccessful security incidents, such as pings, port scans, and blocked sign-in attempts, that do not result in unauthorized access to, or use, disclosure, modification, or destruction of, PHI, and no further report of them is required. A BAA does not change your responsibilities under Sections 9.1 and 9.2 and does not cover any Service, data, or channel outside its stated scope (Sections 8.2 and 8.4). Nothing in this Agreement or in any BAA makes PostureCo a covered entity, a medical-records custodian, a bailee, a trustee, or a fiduciary, or your agent, partner, or joint venturer.

9.4 HIPAA COMPLIANCE STATEMENT. PostureCo's HIPAA Compliance Statement (https://www.postureanalysis.com/legal/hipaa-compliance-statement/) describes PostureCo's HIPAA program, including its safeguards, when it enters into BAAs, and the responsibilities this Section 9 gives you. It is provided for information only. It is not a contract or a BAA, does not amend this Agreement, any Product-Specific Terms, or any executed BAA, and creates no warranty, representation, or obligation of PostureCo. PostureCo intends the HIPAA terms of this Agreement to match it, and PostureCo may update it at any time without notice. If the HIPAA Compliance Statement conflicts with this Agreement, the applicable Product-Specific Terms, or an executed BAA, those documents govern. No government agency certifies a company or its software as "HIPAA compliant"; whether health information is protected as HIPAA requires depends on how each organization, including yours, uses the Services.

9.5 HEALTHCARE PROVIDERS OUTSIDE THE UNITED STATES. If you are a healthcare provider or other professional located outside the United States and you use PostureCo Cloud Services or any other Service through which PostureCo stores or processes your patients' or clients' information (including the cloud backup and online ViewBox included in a PostureRay® technical support plan, and remote technical support in which PostureCo's staff see that information), including if you use them only to back up health information, the onus is entirely on you: you are solely responsible for identifying, understanding, and complying with every law that applies to you and to your patients' and clients' information, including data-protection, health-information, professional-secrecy, data-residency, health-data-hosting, and record-retention laws.

Where the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection applies, the processor terms in Section 8.3 of the PostureCo Cloud Services Agreement (which address Article 28 of the GDPR and of the UK GDPR) and, where Section 8.4 of that agreement makes them apply, the standard contractual clauses it incorporates are built into that agreement and apply automatically, as those Sections provide, when you accept it, without a separate signature; a separately signed data processing agreement is available on request (Section 8.3 of that agreement). Under those laws, they are the counterpart of a HIPAA BAA. They are not a BAA, and they do not address any other requirement of those laws or of any other law. For any Service described in the previous paragraph that the PostureCo Cloud Services Agreement does not govern, any processor terms that your law requires are your responsibility to request under the next paragraph.

Anything else that your law requires, including any other contract (such as an agreement similar to a HIPAA BAA) and any registration, notification, authorization, certification, or approval (for example, a country-specific requirement for hosting health data), is your sole responsibility to identify, to request from PostureCo, and to supply to PostureCo for review before you upload any information it covers, without including any PHI or other patient or client information in your request. PostureCo has no obligation to ask whether you need one, to offer one, or to remind you, and it may accept, negotiate, or decline any such request, case by case and in its sole discretion (Section 8.5). PostureCo makes no representation that the Services, PostureCo, or its service providers meet any legal requirement outside the United States, or hold any country-specific certification, unless PostureCo expressly confirms it in a writing signed by PostureCo.

If an agreement or other requirement that your law imposes is not in place, you must not use PostureCo Cloud Services, or any other Service, for the information it covers. Using them anyway is a material breach of this Agreement, as well as of your own law, and is entirely at your own risk. PostureCo is not responsible for any consequence of that use, including where you never sent PostureCo any document to sign or review, and you must defend, indemnify, and hold harmless PostureCo completely, as Section 11 provides. Sections 8.6 (your choice of region), 9.1, and 9.6 also apply.

9.6 POSTURECO CANNOT TELL WHO YOU ARE; YOU MUST FOLLOW THE LAWS THAT APPLY TO YOU. PostureCo distributes its apps worldwide through app stores, such as the Apple App Store and Google Play, and online (Section 2.1). It cannot vet or verify who downloads, buys, or uses the Services; whether a user is a healthcare provider, a covered entity or business associate under HIPAA, a fitness or wellness professional, or a consumer; where a user, or a user's patients or clients, are located; or which laws apply to them. PostureCo relies on you for all of this and has no obligation to verify it.

You must determine, and comply with, every law that applies to you and to the information you handle, including HIPAA and laws like it anywhere in the world, for example the GDPR, the UK GDPR, Canada's Personal Information Protection and Electronic Documents Act and provincial health-information laws, and Australia's Privacy Act 1988. These are examples only; the list is not complete, and PostureCo does not tell you which laws apply to you (Section 9.1).

Using any Service in violation of a law that applies to you or to the information you handle is prohibited (Section 4) and is a material breach of this Agreement. Your license and your right to use the affected Service end automatically for that use, without notice and whether or not PostureCo has detected it, and you must stop that use immediately. PostureCo may also suspend or terminate your access to any or all of the Services (Section 18), and you must defend, indemnify, and hold harmless PostureCo as Section 11 provides.

PostureCo makes no representation that the Services are appropriate, lawful, or available for use in any particular location. Anyone who accesses or uses the Services from outside the United States does so on their own initiative and is responsible for complying with local law, and some features may be used only from inside the United States (Sections 8.8 and 8.9). PostureCo may restrict or withdraw the availability of any Service or feature in any country or region at any time.

You represent and warrant that you are not located in a country that is subject to a U.S. Government embargo, or that the U.S. Government has designated as a "terrorist supporting" country, and that you are not listed on any U.S. Government list of prohibited or restricted parties. You must not access, use, export, re-export, or transfer the Services, or allow anyone else to do so, in violation of U.S. export-control or sanctions laws or any other export-control or sanctions law that applies, and PostureCo may refuse, suspend, or terminate access as needed to comply with those laws.

Nothing in this Agreement limits any right you have under applicable consumer-protection law that cannot lawfully be waived or limited by contract.

10. FAIR USE AND LICENSE RESTRICTIONS#

Licenses are issued to a single customer or facility, and a PostureRay® license covers one practice location (Section 10.1). Excessive, abnormal, automated, or unauthorized usage may result in suspension or permanent restriction of access. PostureCo reserves the right to enforce fair usage limits.

10.1 TRANSFERRING A POSTURERAY® LICENSE. A PostureRay® software license belongs to one licensee for one practice location, where the software runs on that location's own computers and local network. It may be transferred to anyone else only as this Section 10.1 provides. A transfer includes a sale of the license alone to another practice, a sale of the practice or of the business that holds the license, and any transfer by operation of law, such as on death, divorce, dissolution, merger, or bankruptcy. This Section 10.1 does not apply to PostureCo's apps obtained through an app store, whose purchases are governed by the app store's own terms (Section 2.1), or to subscriptions to PostureCo Cloud Services or PostureScribe.AI®, which are not transferable: a new owner of a practice starts its own subscriptions.

(a) Transfer form. A transfer takes effect only when (i) the current licensee (the "Transferor") and the person acquiring the license (the "Transferee") have each completed and signed PostureCo's PostureRay® License Transfer form through the electronic-signature service that PostureCo designates (for example, Adobe Acrobat Sign or DocuSign), and (ii) PostureCo has approved the transfer in writing. PostureCo sends the form for the Transferor's signature to the email address of record used to register the PostureRay® software, may confirm the request by calling a telephone number in its records, and does not rely on contact details supplied only in a request. If that email address can no longer be used, for example because the practice has closed or the licensee has retired or died, PostureCo may instead accept a notarized affidavit from the Transferor or its legal representative, together with documents showing the transfer (such as a bill of sale, a purchase agreement, a court order, or letters of administration), confirmed by a call to a telephone number in PostureCo's records or by another method PostureCo considers reliable. PostureCo charges no fee to process a transfer.

(b) What the Transferor confirms. In the transfer form, the Transferor confirms, among other things, that it is the licensee of record and has the right to transfer the license; that no lender, co-owner, partner, or other person has a right in the license that the transfer would violate, or that each such person has consented; that it is transferring the entire license, including every server and workstation installation and every module, because a license may not be divided; that, once the transfer takes effect, it will have stopped using the PostureRay® software and removed it from every computer it keeps; and that it has met the obligations described in paragraph (e) for the patient and client records it holds.

(c) What the Transferee agrees to. In the transfer form, the Transferee accepts this Agreement and any Product-Specific Terms that apply to PostureRay®, as then in effect; confirms that it meets Section 5.3 (a licensed healthcare practitioner with training in radiology, or a practice acting through one); confirms that it is located in the United States, unless PostureCo agrees in writing to a transfer to a practice outside the United States on the terms PostureCo then requires (Sections 8.5 and 9.5); names the single practice location where it will use the license; and agrees, where HIPAA applies, to sign its own BAA with PostureCo before PostureCo creates, receives, maintains, or transmits any PHI for it. The Transferor's BAA and any other agreement of the Transferor do not transfer to the Transferee, except as this Section 10.1 expressly provides.

(d) Approval and its effect. PostureCo may approve or decline a transfer, or approve it on conditions, in its sole discretion. Until PostureCo approves a transfer in writing, the Transferor remains the licensee, PostureCo deals only with the Transferor, and the Transferor is responsible for all use of the PostureRay® software, including any use by the Transferee or its staff, which is a matter between the Transferor and the Transferee. PostureCo does not monitor or prevent use of the software by anyone who has access to the licensed computers and their credentials. When PostureCo approves the transfer, the Transferor's license ends, the Transferee becomes the licensee under this Agreement, and PostureCo updates its records and may issue a new license number. The Transferee receives the license as it is at that time, in its installed version, with no greater rights than the Transferor had and with no warranty beyond those in this Agreement (Section 12). A transfer that does not follow this Section 10.1 is void: PostureCo will continue to treat the Transferor as the licensee and may decline to support, update, or activate the software for anyone else.

(e) Patient and client records. The PostureRay® software keeps patient and client records on the licensee's own computers and local network. PostureCo stores the software's data in the cloud only as part of a PostureRay® technical support plan: in the plan's cloud backup and online ViewBox, while the plan is active and, after it ends, for the Retrieval Period described in Section 7. A license without an active technical support plan therefore has no cloud backup or online ViewBox, and, apart from any data from an ended plan that is still in its Retrieval Period, PostureCo stores none of the license's patient or client records, so there is no cloud data to move. Data in a PostureCo Cloud Services subscription, including PostureRay® on PostureCo Cloud, is not part of the license and stays with that subscription, which does not transfer. Transferring a license does not transfer any patient or client records. Whether, when, and how a practice's records may be transferred, kept, or delivered in a sale, and any notice to patients or other obligation that applies, are solely the Transferor's and the Transferee's responsibility under HIPAA and the other laws that apply to them (Section 9). Unless the Transferee is lawfully acquiring those records, the Transferor must remove them from every computer, database, and copy of the software that passes to the Transferee. PostureCo is not a party to the sale, gives no advice about it, and is not a medical-records custodian (Section 7). While a PostureRay® technical support plan is in effect, PostureCo may, at the licensee's request, move the licensee's PostureRay® data to a new installation as part of that plan. If the license has an active technical support plan, PostureCo may also, at the Transferor's written direction in the transfer form, move the Transferor's PostureRay® cloud backup and online ViewBox data into the Transferee's account, but, where HIPAA applies, only after the Transferee's BAA is fully executed. Otherwise, any cloud data of the Transferor is kept and deleted as Section 7 and any executed BAA of the Transferor provide.

(f) Payments, support, and training. A transfer does not change any amount owed for the license or for technical support, including installment payments, financing, and the rest of a minimum commitment, and each stays due on its terms. Unless PostureCo agrees otherwise in writing, the Transferee takes on every such amount that is unpaid when the transfer takes effect, and the Transferor remains responsible for it until it is paid in full. Financing from a third party, such as Affirm, is governed by that provider's own terms, which the Transferor and the Transferee must follow. Any remaining prepaid term of a PostureRay® technical support plan, and any training sessions included with the license that have not been used, pass to the Transferee, and none of them is refunded. If the license is not covered by a current technical support plan when the transfer takes effect, the Transferee must enroll in one, at PostureCo's then-current rates (https://www.postureanalysis.com/knowledge-base/postureray-annual-technical-support-plans/), to receive technical support, updates, cloud features, data moves, or any other assistance from PostureCo. If the installed version has reached end of life (https://www.postureanalysis.com/postureray_end_of_life_version_notice/), enrolling in a technical support plan is the only way to be updated to a supported version (Section 19). After the Windows End-of-Support Date, no technical support plan is available for the Windows version of PostureRay®, and PostureCo provides no support, updates, or other assistance for it (Section 19.5).

(g) Change of ownership without a transfer. If the licensee itself stays the same but its ownership or control changes, for example through a sale of its shares or membership interests, no transfer form is needed, but the licensee must notify PostureCo in writing within thirty (30) days, update its contacts and authorized representatives, and, if PostureCo asks, accept this Agreement as then in effect.

(h) PostureCo's protection. PostureCo is not a party to any sale between the Transferor and the Transferee. It may rely, without further inquiry, on the transfer form, the signatures and statements in it, and the documents provided with it, and it is not liable for acting on them or for declining or delaying a transfer. If PostureCo learns of a dispute about a transfer or receives conflicting instructions, it may suspend the transfer, and support for the license, until the parties resolve the dispute in a writing signed by both of them or by a final court order, and it has no obligation to decide the dispute. The Transferor and the Transferee each indemnify PostureCo, as Section 11 provides, against all claims arising out of or related to the transfer, any statement in the transfer form, or any transfer of patient or client records. A signature through the electronic-signature service that PostureCo designates is binding, and that service's audit record is evidence of the transfer.

11. INDEMNIFICATION#

You agree to defend, indemnify, and hold harmless PostureCo, Inc., its officers, directors, employees, contractors, agents, licensors, and affiliates from and against all claims, damages, liabilities, losses, fines, penalties, and expenses, including attorneys' fees, arising out of or related to your use of the Services, your breach of this Agreement (including Sections 3, 4, 7.1 through 7.4, 8, 9.1, 9.2, 9.5, 9.6, and 23), or any use, disclosure, storage, or transmission of patient or client information by you, or by anyone using your account, through any service, whether or not provided by PostureCo. This includes, without limitation, any claim, fine, or penalty arising out of or related to: your upload, transmission, recording, or dictation of PHI without a fully executed BAA; your failure to give any notice, or to obtain any consent or authorization, that the law requires, including for photographs, videos, recordings, transcription, text messages, calls, and artificial intelligence processing; your failure to meet your responsibilities under Section 9.2, including any breach notification the law requires of you; your violation of any third-party AI provider terms or policies (Section 8.8); any access to or use of the Services through a VPN or other location-masking technology by you, by anyone using your account, or by any patient or client you invite (Section 4.1); your choice of cloud region, and the storage and processing of your data in the region you selected (or in the United States, if you made no selection), including before any move you request is completed (Section 8.6); any access to or use of PostureScribe.AI® from outside the United States, and any circumvention of that restriction, by you, by your workforce, or by anyone using your account or devices, and your resulting breach of this Agreement and of the PostureScribe.AI® User Agreement, Indemnification, and Terms of Service (Section 8.8); any access to or use of the RemoteScreen® AI-Guided Health History from outside the United States by you, by anyone using your account, or by any patient or client you invite (Section 8.9); any use of any Service in violation of any law that applies to you or to the information you handle, by you or by anyone using your account or devices (Section 9.6); any use of PostureCo Cloud Services, or of any other Service, for information without an agreement, registration, notification, authorization, certification, or approval that the law that applies to you requires, including where you never sent PostureCo any document to sign or review (Section 9.5); any breach of your representations and warranties in Section 9.6 regarding embargoes, sanctions, and restricted-party lists, and any access to, use, export, re-export, or transfer of the Services in violation of export-control or sanctions laws; any Third-Party Backup Service, including Apple iCloud Backup, iCloud Photos, and iCloud Drive, and any backup, synchronization, copying, storage, restoration, retention, access, use, disclosure, loss, or security incident involving PHI or other patient or client information in or through one, whether caused by you, by anyone using your account or devices, by a device or its settings, by any setting or default of the Services, or by the service's provider, and any failure to keep PHI out of one (Sections 7.1 through 7.4, subject to the last paragraph of Section 7.4); any copying, recording, scraping, redistribution, artificial intelligence use, or other use of Knowledge Base Content in breach of Section 23.7, and any sharing of a Knowledge Base Account or sign-in code, by you or by anyone using your Knowledge Base Account (Section 23); any use of the Services, by you or by anyone using your account or devices, on a device, operating system, browser, or version of the Services that is unsupported or has not been updated, including any security incident involving patient or client information on one (Section 19); and any claim by a patient or client whose information you enter in the Services or whom you invite to submit information through RemoteScreen®. To the fullest extent permitted by law, this obligation applies even if the claim, damage, liability, loss, fine, penalty, or expense arises, or is alleged to arise, in whole or in part from the negligence of PostureCo or any other indemnified party, except to the extent that a final decision of an arbitrator or court determines that it was caused by PostureCo's gross negligence or willful misconduct. PostureCo may assume the exclusive defense and control of any matter for which you must indemnify it, at your expense and with counsel of its choice, and you will cooperate fully with PostureCo in that defense. You must not settle any such matter without PostureCo's prior written consent if the settlement would admit fault by, or impose any obligation, restriction, or payment on, PostureCo or any other indemnified party. Your obligations under this Section 11 survive termination.

12. DISCLAIMER OF WARRANTIES#

THE SERVICES ARE PROVIDED "AS IS," "AS AVAILABLE," AND "WITH ALL FAULTS." POSTURECO DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, RELIABILITY, AND NON-INFRINGEMENT.

12.1 NO GUARANTEE OF ERROR-FREE SOFTWARE. SOFTWARE, INCLUDING THE SERVICES, MAY CONTAIN BUGS, ERRORS, DEFECTS, INACCURACIES, AND OTHER PROBLEMS, SOME OF WHICH MAY AFFECT MEASUREMENTS, MARKINGS, DIGITIZATIONS, CALCULATIONS, REPORTS, EXPORTS, STORED DATA, OR THE AVAILABILITY OF FEATURES. POSTURECO DOES NOT REPRESENT, WARRANT, OR GUARANTEE THAT THE SERVICES, OR ANY VERSION, UPDATE, FEATURE, OR OUTPUT OF THEM, WILL BE BUG-FREE, ERROR-FREE, UNINTERRUPTED, OR COMPATIBLE WITH ANY PARTICULAR DEVICE, OPERATING SYSTEM, BROWSER, OR OTHER SOFTWARE, OR THAT ANY BUG, ERROR, OR DEFECT WILL BE CORRECTED, WHETHER IN A PARTICULAR VERSION, ON A PARTICULAR DEVICE, OR AT ALL. POSTURECO MAKES NO CLAIMS ABOUT, AND ASSUMES NO RESPONSIBILITY FOR, ANY BUG, ERROR, OR DEFECT IN THE SERVICES OR ANY CONSEQUENCE OF ONE. You are responsible for reviewing every output before you use it (Section 5.4), for keeping the Services updated (Section 19.1), and for maintaining independent backups of your data, using only backup methods that meet your legal obligations (Sections 7 and 7.3).

13. LIMITATION OF LIABILITY#

TO THE MAXIMUM EXTENT PERMITTED BY LAW, POSTURECO'S TOTAL LIABILITY SHALL NOT EXCEED THE AMOUNT PAID BY YOU TO POSTURECO IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM. POSTURECO SHALL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOST PROFITS, LOST DATA, PATIENT CLAIMS, OR REGULATORY PENALTIES. THESE LIMITATIONS APPLY TO ALL CLAIMS, INCLUDING CLAIMS ARISING OUT OF OR RELATED TO PHI, ANY SECURITY INCIDENT, ANY THIRD-PARTY BACKUP SERVICE (INCLUDING APPLE ICLOUD), OR ANY BAA, UNLESS THE EXECUTED BAA EXPRESSLY PROVIDES OTHERWISE, AND THE DAMAGES EXCLUDED ABOVE INCLUDE COSTS OF INVESTIGATION, BREACH NOTIFICATION, AND CREDIT MONITORING.

14. WAIVER OF SUBROGATION#

To the extent you maintain insurance coverage, you waive any right of subrogation against PostureCo.

15. INJUNCTIVE RELIEF#

Unauthorized clinical reliance, unauthorized PHI upload (including any upload, transmission, recording, or dictation of PHI without a fully executed BAA), use of RemoteScreen® or PostureScribe.AI® without the notices, consents, or BAA that Sections 8.9 and 9.2 require, misuse of artificial intelligence features in violation of Section 8.8, access to or use of the Services through a VPN or other location-masking technology in violation of Section 4.1, use of PostureScribe.AI® or the RemoteScreen® AI-Guided Health History from outside the United States in violation of Sections 4, 8.8, and 8.9, copying, recording, scraping, redistribution, or artificial intelligence use of Knowledge Base Content in violation of Section 23.7, sharing of Knowledge Base Accounts or sign-in codes (Section 23.3), or circumvention of licensing or location restrictions causes irreparable harm. PostureCo is entitled to injunctive relief and all available legal remedies.

16. DISPUTE RESOLUTION#

Except where applicable Product-Specific Terms expressly provide otherwise, any dispute shall be resolved by binding arbitration in Pasco County, Florida. You waive the right to a jury trial and any class or representative action.

17. ATTORNEYS' FEES#

The prevailing party is entitled to recover all attorneys' fees and costs.

18. TERMINATION#

PostureCo may suspend or terminate access at any time, with or without notice. Without limiting that right, PostureCo may immediately, and without notice, suspend or terminate your access to any or all of the Services, or block or disable any feature, including PostureScribe.AI® and the RemoteScreen® AI-Guided Health History, if it suspects that you, anyone using your account or devices, or any patient or client you invite has accessed or used the Services through a VPN or other location-masking technology (Section 4.1), has used PostureScribe.AI® or the AI-Guided Health History from outside the United States (Sections 8.8 and 8.9), or has used any Service in violation of a law that applies to you or to the information you handle (Sections 9.5 and 9.6). PostureCo may also limit, suspend, or end Knowledge Base Accounts as Section 23.9 provides. PostureCo has no obligation to do so, and not doing so is not a waiver of any of its rights. In addition, if you, or anyone using your account or devices, use any Service in violation of such a law, your license and right to use the affected Service end automatically for that use, without notice and whether or not PostureCo has detected it or taken any action, and you must stop that use immediately (Section 9.6). To the extent the law allows, fees paid for any Service or feature that is suspended, terminated, blocked, or disabled, or whose right of use ends, for any of these reasons are not refunded (Section 3.1). Upon termination, access to software features and cloud services may be immediately disabled, except that, unless the law requires otherwise or PostureCo restricts access as needed, and only for as long as needed, to secure the Services or your data (Section 8.7), you may still export the data PostureCo stores for you in its cloud services during the Retrieval Period described in Section 7. All disclaimers, indemnities, arbitration provisions, and liability limitations survive termination.

19. SOFTWARE LIFECYCLE AND END-OF-LIFE#

PostureCo reserves the right to retire or declare end-of-life for any software version. Continued use of legacy or unsupported versions is at your sole risk. PostureCo has no obligation to maintain compatibility with future laws, operating systems, or third-party technologies.

19.1 UPDATES ARE YOUR RESPONSIBILITY. You are solely responsible for installing updates to the Services promptly and for keeping the Services on the most recent version released by PostureCo. Corrections for bugs, errors, and defects, compatibility changes, and other improvements, if and when PostureCo chooses to make them, may be delivered only through updates, and they do not reach a device that has not been updated. PostureCo has no obligation to provide any update. PostureCo is not responsible for any bug, error, defect, data problem, or other issue that occurs in an outdated version of the Services, including any issue that is corrected in a newer version of the Services, whether or not that newer version can be installed on your device.

19.2 HARDWARE AND OPERATING SYSTEMS ARE YOUR RESPONSIBILITY. You are solely responsible for obtaining, maintaining, and replacing, at your own expense, reasonably current hardware that can run a current operating-system version (such as iOS, iPadOS, Android, Windows, or macOS) that its maker still supports, together with a current, supported web browser, and for keeping that operating system and browser updated. Apple, Google, and other device and operating-system makers periodically stop providing updates for older devices and operating-system versions (they "sunset" them). After a device or operating system has been sunset, it may no longer be able to install the current version of the Services or receive its bug fixes and other corrections, and an app store may show no new update for the Services on that device even though a newer version, including one that corrects a bug, is available for supported devices. The absence of a new update in an app store on your device does not mean that no update or correction exists. It is your responsibility to determine, and to check periodically, whether your device, operating system, and browser can still run the most recent version of the Services and, if they cannot, to upgrade or replace them before continuing to rely on the Services.

19.3 UNSUPPORTED DEVICES AND VERSIONS ARE AT YOUR SOLE RISK. PostureCo may set, change, or raise the minimum hardware, operating-system, browser, and app-version requirements for any of the Services at any time, without notice. Continued use of the Services on unsupported or sunset devices, on unsupported operating-system or browser versions, or in outdated or unsupported versions of the Services is at your sole risk, and PostureCo has no responsibility or liability for any bug, error, defect, incompatibility, data loss, security issue, or other problem arising from that use.

19.4 SUPPORTED PLATFORMS; NO PROMISE OF BACKWARD COMPATIBILITY. PostureCo designs, builds, and tests the Services for current technology. In this Section 19.4, a "Supported Platform" is a device, operating-system version, or browser version that this Section 19.4 or PostureCo's then-current published requirements describe as supported; everything else is unsupported.

(a) Mobile apps. PostureCo builds its mobile apps for the current major version of Apple iOS and iPadOS and of Google Android. PostureCo generally tries, where it considers it practical, to keep its current apps working on the immediately preceding major version of each of those operating systems as well, but that is a goal, not a commitment, warranty, or obligation, and PostureCo may stop doing so at any time. Earlier operating-system versions, and devices that cannot run a supported version, are not supported. For example, if the current major version is iOS 27, PostureCo builds for iOS 27 and tries to keep iOS 26 working, but it does not support iOS 18 or any earlier version.

(b) PostureRay®. The Windows version of PostureRay® (Section 19.5) is supported only on Microsoft Windows 11; on Microsoft Windows 10, but only while that installation receives security updates from Microsoft, for example under a Microsoft Extended Security Updates program; and on any other Windows version that PostureCo expressly lists as supported in its published system requirements. This applies to every server and workstation on which the PostureRay® software or its database runs, including a Windows installation running in a virtual machine; PostureCo does not support the virtualization software or the computer on which it runs.

(c) Websites and web-based Services. PostureCo's websites and web-based Services, including the PostureCo Cloud web portal, are supported only on the current, updated version of a major web browser, such as Safari, Google Chrome, Microsoft Edge, or Mozilla Firefox, running on an operating system that its maker still supports, unless PostureCo states otherwise.

(d) Why support changes. Which devices, operating systems, and browsers PostureCo can support depends largely on things outside its control, including the requirements, software development tools, and app store rules of Apple, Google, and Microsoft; security fixes; the hardware capabilities of devices, such as their cameras, sensors, processors, and memory; third-party software and services that the Services rely on, including artificial intelligence providers; and changes in law. PostureCo may therefore stop supporting any device, operating-system version, or browser at any time and without notice, including the immediately preceding version described in paragraph (a), and may require a newer one for any new version, update, or feature (Section 19.3). PostureCo may publish its current requirements, for example in an app store listing, on its website, or in the Services, and may change them at any time without notice. A published list is for information only and does not promise support for any period.

(e) No backward compatibility. PostureCo does not promise, and has no obligation, to keep any Service, version, update, feature, or fix working on, available for, or compatible with any unsupported device, operating system, or browser, or with any older version of the Services, or to make any new version, update, or fix available for one. An update or fix that PostureCo releases for Supported Platforms may not reach an unsupported device at all, and when a device can no longer install the current version of an app, an app store may offer it only the last version that is compatible with it, if any. That older version is unsupported, and a problem in it is not a defect that PostureCo must correct (Sections 12.1 and 19.1). PostureCo may require a minimum version of the Services in order to sign in, synchronize, back up, or use cloud or artificial intelligence features, and may block older versions from doing so.

(f) Support only for supported setups. PostureCo's technical support covers only the current version of the Services on Supported Platforms. Before investigating a problem, PostureCo may require you to update the Services, your operating system, or your browser, or to move to a supported device, and it may decline to troubleshoot, or stop troubleshooting, any problem on an unsupported device, operating system, browser, or version of the Services. A problem that occurs only on an unsupported setup is not a defect, and PostureCo has no obligation to fix it. To the extent the law allows, no fee is refunded because a device, operating system, browser, or version of the Services is or becomes unsupported (Section 3.1).

(g) Your responsibility, including under HIPAA. It is solely your responsibility, at your own expense, to use the Services only on Supported Platforms; to keep every device, computer, and server that you use with the Services, including every PostureRay® server and workstation, on an operating system that its maker still supports with security updates, and to install those updates; to keep the Services on their current version (Section 19.1); and to check PostureCo's published requirements before you buy a device, update an operating system, or rely on the Services. Keeping patient or client information on a device, computer, or server whose operating system or software no longer receives security updates can expose that information to security risks and may not meet your obligations under HIPAA, including its Security Rule, or under the other laws that apply to you; whether your devices and software meet those obligations is your responsibility alone (Section 9). PostureCo is not responsible for any bug, error, defect, incompatibility, data loss, security incident, or other problem that arises from any device, operating system, browser, or version of the Services that is unsupported or has not been updated, and Section 11 applies to it.

19.5 POSTURERAY® FOR WINDOWS: END OF ALL SUPPORT ONE YEAR AFTER POSTURERAY® ON POSTURECO CLOUD LAUNCHES. In this Section 19.5, the "Windows version" means PostureRay® software that is installed on a practice's own computers and local network and runs on Microsoft Windows, however it is run, including in a virtual machine, together with its modules, and "PostureRay® on PostureCo Cloud" means PostureRay® provided through PostureCo Cloud Services (Section 1.1).

(a) Launch date and end-of-support date. If and when PostureCo makes PostureRay® on PostureCo Cloud generally available, meaning available for any eligible new customer in the United States to subscribe to and not only as a beta, pilot, or early-access program, PostureCo will announce the date on which it did so (the "Cloud Launch Date") by posting it on its website, for example on its PostureRay® end-of-life notice page (https://www.postureanalysis.com/postureray_end_of_life_version_notice/), and may also tell licensees by email or in the Services. The Cloud Launch Date is the date that PostureCo states in that announcement. All support for the Windows version ends permanently one (1) year after the Cloud Launch Date (the "Windows End-of-Support Date"), unless PostureCo, in its sole discretion, posts a later date on its website; no other statement, including one by PostureCo's sales or support personnel, extends it. PostureCo has no obligation to launch PostureRay® on PostureCo Cloud at all or by any date.

(b) Until the Windows End-of-Support Date. PostureCo continues to support the Windows version only as this Agreement and the licensee's PostureRay® technical support plan provide, for example only for a licensee with a current technical support plan and only for versions that have not reached end of life (Section 10.1(f) and this Section 19). This Section 19.5 does not promise any support, update, or feature that this Agreement and that plan do not already provide, and it does not limit PostureCo's right to declare a particular version end-of-life under this Section 19 or its rights under Section 18. PostureCo may stop selling new licenses for the Windows version at any time, including before the Cloud Launch Date. A license for the Windows version that is bought, or transferred under Section 10.1, after the Cloud Launch Date receives support only until the Windows End-of-Support Date.

(c) After the Windows End-of-Support Date. On the Windows End-of-Support Date, PostureCo ends all support for the Windows version, permanently and for every licensee, whether or not the licensee has, or has paid for, a technical support plan. From that date, PostureCo provides, for the Windows version: no technical support of any kind, whether by telephone, email, chat, remote session, or otherwise; no updates, upgrades, bug fixes, security patches, or compatibility changes, including for new versions of Windows or of any other software; no installation, reinstallation, activation, configuration, data moves, or restores; no training; no technical support plans, which PostureCo no longer sells or renews; and no cloud backup or online ViewBox. The licensee may keep using the Windows version already installed on its computers under this Agreement, but entirely at its own risk (Section 19.3). PostureCo has no obligation to keep the Windows version working, available, or compatible with any hardware, operating system, or other software, and features that depend on PostureCo's servers or on third-party services may stop working. Using software that no longer receives security patches, or an operating system that its maker no longer supports, can expose patient and client information to security risks, and the licensee alone is responsible for deciding whether that use meets its obligations under HIPAA and the other laws that apply to it (Section 9).

(d) Data. The Windows version keeps patient and client records on the licensee's own computers and local network (Section 10.1(e)), and they stay there: PostureCo does not move, convert, export, or deliver them. When a technical support plan ends, including on the Windows End-of-Support Date, the plan's cloud backup and online ViewBox data remain available for the licensee to export itself, through the export features that the applicable Service provides, for the Retrieval Period described in Section 7, and may then be permanently deleted as that Section or, for PHI, an executed BAA provides. It is the licensee's sole responsibility to export every record it needs before then. PostureCo may, but need not, offer tools or help to move PostureRay® data into PostureRay® on PostureCo Cloud, on the terms and at the prices that it sets, and, where HIPAA applies, only under a fully executed BAA that covers PostureCo Cloud Services (Section 8).

(e) PostureRay® on PostureCo Cloud and technical support plans. PostureRay® on PostureCo Cloud is a separate service that requires its own PostureRay® subscription and is governed by the PostureCo Cloud Services Agreement and any other Product-Specific Terms that apply to it (Section 1.1). Except as this Section 19.5 provides, a license for the Windows version, a license transfer, or a technical support plan does not include PostureRay® on PostureCo Cloud or entitle the licensee to it, or to any discount, credit, or particular price for it, unless PostureCo expressly offers one in writing, and its prices may change as Section 3.2 provides. PostureCo will not sell or renew a technical support plan for the Windows version for a term that ends after the Windows End-of-Support Date, and it may shorten the term of any plan sold or renewed after the Cloud Launch Date so that it ends on that date, with its price prorated. If the paid term of any plan nevertheless runs past the Windows End-of-Support Date, PostureCo will, at its option, credit the unused part, prorated, toward a PostureRay® on PostureCo Cloud subscription or refund it. Otherwise, and to the extent the law allows, no fee paid for the Windows version, for a technical support plan, or for training is refunded because support ends (Section 3.1).

(f) This Section 19.5 controls over any conflicting Product-Specific Terms for PostureRay® that PostureCo publishes and over any statement in PostureCo's marketing, sales, or support materials.

20. GOVERNING LAW AND VENUE#

This Agreement is governed by the laws of the State of Florida. Exclusive venue, if arbitration is unenforceable, lies in Pasco County, Florida or the U.S. District Court for the Middle District of Florida (Tampa Division).

21. ENTIRE AGREEMENT#

This Agreement, together with any applicable Product-Specific Terms, any executed BAA, and any data processing agreement that PostureCo has executed, constitutes the entire agreement between you and PostureCo regarding the Services.

PostureCo may assign or transfer this Agreement, in whole or in part, without your consent, including to a successor described in Section 8.7, and may assign or transfer an executed BAA or data processing agreement to the extent that agreement permits. You may not assign or transfer this Agreement or any license under it without PostureCo's prior written consent (Section 2), which for a PostureRay® license is given only as Section 10.1 provides, and any attempt to do so without that consent is void. This Agreement binds and benefits you, PostureCo, and your and its permitted successors and assigns.

Except as a data processing agreement, or the standard contractual clauses (including any addendum to them) that apply under Section 8 of the PostureCo Cloud Services Agreement, expressly provide, except that Apple and Apple's subsidiaries are third-party beneficiaries of this Agreement as Section 2.2 provides, and except that each person whom Section 11 protects may enforce that Section, nothing in this Agreement, any Product-Specific Terms, or any PostureCo policy or notice (including the Privacy Policy, the HIPAA Compliance Statement, and the RemoteScreen® Patient App Privacy Policy) confers any right, remedy, or claim on your patients and clients or on any other person except you, PostureCo, and your and its permitted successors and assigns. This does not limit any right that applicable law gives an individual directly.

If any provision of this Agreement is held invalid or unenforceable, it will be enforced to the maximum extent permitted, and the remaining provisions remain in full force and effect.

22. TEXT MESSAGES AND PHONE CALLS#

22.1 CONSENT IS OPTIONAL AND SEPARATE. PostureCo may ask for your telephone number, for example on the contact form on its website. Calls and text messages are separate, optional choices. If you check the box agreeing to receive text messages (or otherwise expressly agree), you consent to receive text messages (SMS and MMS), which may be sent using automated technology, from PostureCo, Inc. at the mobile number you provided about your request, your account, and support for the Services. If you check the box agreeing to receive calls (or otherwise expressly agree), you consent to receive telephone calls from PostureCo at that number for the same purposes, and PostureCo may leave a voicemail. Your consent is not a condition of any purchase. Providing a telephone number alone, or accepting this Agreement, is not consent to receive text messages.

22.2 MESSAGE TYPES, FREQUENCY, AND COST. Text messages under this Section are informational and customer-care messages, such as replies to your request, follow-up questions, scheduling a call, and account and support notices. PostureCo will not send you marketing text messages unless you separately agree to receive them. Message frequency varies with your request. Message and data rates may apply.

22.3 OPT-OUT AND HELP. You may stop text messages at any time by replying STOP to any message (QUIT, END, REVOKE, OPT OUT, CANCEL, UNSUBSCRIBE, and STOP ALL also work), and PostureCo may send one final message confirming your opt-out. Reply HELP for help, or contact info@postureco.com or 866-577-7297. You may also withdraw your consent to calls or text messages at any time by contacting PostureCo toll free at 866-577-7297, through the contact form on PostureCo's website, or by any other reasonable means, and PostureCo will honor your request promptly and no later than the law requires. Withdrawing consent does not affect the rest of this Agreement.

22.4 YOUR NUMBER. You represent that you are the subscriber of, or are authorized to use, the telephone number you provide, and that it is a mobile number if you agree to receive text messages. You agree to tell PostureCo promptly if your number changes or is no longer yours, so that PostureCo does not contact someone else.

22.5 NO PATIENT INFORMATION. Text messages, voicemail, and the website contact form are not secure channels for health information. Do not send protected health information or other patient or client information through them.

22.6 CARRIERS AND DELIVERY. Mobile carriers are not liable for delayed or undelivered messages. PostureCo does not guarantee that any message will be delivered, and text messages may not be available on every carrier or outside the United States.

22.7 YOUR MOBILE NUMBER STAYS PRIVATE. PostureCo never sells or shares your mobile telephone number, your text-messaging opt-in, or your consent with its partners, affiliates, or any other third parties. Only PostureCo's own service providers that deliver its messages and support you on its behalf receive them, solely for that purpose, as described in Section 18 of the Privacy Policy. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent are excluded from every other category of disclosure in the Privacy Policy, including Sections 7.1 and 7.2, and will not be shared with any third parties.

23. KNOWLEDGE BASE ACCOUNTS#

23.1 SCOPE: KNOWLEDGE BASE USERS ONLY. PostureCo's knowledge base (the "Knowledge Base") is the collection of tutorials, videos, articles, guides, downloadable files, and other training and support materials about PostureCo's products that PostureCo makes available on its websites (currently at https://www.postureanalysis.com/knowledge-base/) and through its apps (together, "Knowledge Base Content"). Some Knowledge Base Content is public. The rest can be opened only after signing in ("Locked Content"). A "Knowledge Base Account" is the access PostureCo gives a person to sign in to the Knowledge Base and open Locked Content, however that access is obtained (Section 23.2). This Section 23 applies only to a person who requests a Knowledge Base sign-in code or access to the Knowledge Base, registers for or signs in to a Knowledge Base Account, or opens Locked Content, and only to that person's use of the Knowledge Base. It does not apply to anyone who visits PostureCo's websites, including the public pages of the Knowledge Base, without doing any of those things, and PostureCo does not make the Activity Records described in Section 23.5 of those visits. PostureCo records which Knowledge Base Content a person views only while that person is signed in. The Privacy Policy describes how PostureCo handles those visits (Sections 4 and 7.2 of the Privacy Policy). The Knowledge Base is part of the Services, and the rest of this Agreement applies to it in full. As to the Knowledge Base, this Section 23 applies in addition to any Product-Specific Terms (Section 1.1). If this Section 23 conflicts with any other Section of this Agreement as to the Knowledge Base, this Section 23 controls.

23.2 WHO MAY HAVE A KNOWLEDGE BASE ACCOUNT. Knowledge Base Accounts are for professionals who use, or have used or evaluated, PostureCo's products, and for the personnel of their practices. PostureCo decides, in its sole discretion, who may have a Knowledge Base Account and which Locked Content each Knowledge Base Account may open, and it may grant, limit, suspend, or revoke any Knowledge Base Account, or access to any Locked Content, at any time, with or without notice or reason (Section 23.9). Without limiting that discretion, PostureCo currently offers Knowledge Base Accounts in the following ways, and it may add, change, or stop any of them at any time:

  • PostureRay® customers. When you request a sign-in code (Section 23.3), and again when you use it, PostureCo checks your email address against its customer records, as copied from time to time from its customer relationship management system (currently Salesforce) to its website for this purpose, to confirm that the address is listed in those records for a practice, or for a contact of a practice, that has licensed PostureRay®, or that PostureCo has allowed to evaluate it, and that no block applies.
  • PostureCo apps. Where PostureCo offers it, you may open the Knowledge Base from a PostureCo app, which sends PostureCo information such as your app store purchase or subscription record so that PostureCo can confirm your eligibility (Section 2.8 of the Privacy Policy).
  • PostureCo's approval. If your email address is not confirmed in that way and PostureCo has not approved it, PostureCo will not send it a sign-in code. You may instead ask for access using the request form in the Knowledge Base. PostureCo may approve, limit, or decline any request in its sole discretion, with or without a reason, and has no obligation to answer it. A request does not give you access. PostureCo may also grant a Knowledge Base Account, or access to particular Locked Content, to any person it chooses, for the period and on the conditions it chooses.

Locked Content is available only to Knowledge Base Accounts that PostureCo has confirmed or approved in one of these ways. PostureCo no longer offers registration to the Knowledge Base, and an earlier registration does not by itself give access to Locked Content.

You may not request, register for, or use a Knowledge Base Account if: (a) you are, or work for or act on behalf of (as an employee, contractor, consultant, agent, or otherwise), a person or business that develops, markets, sells, or distributes any product or service that competes with any of the Services (a "Competitor"), unless PostureCo has expressly agreed in writing; (b) PostureCo has suspended, revoked, or blocked access for you, your practice, your email address, or your email domain, unless PostureCo has expressly restored it; (c) you are under eighteen (18) years of age (Section 1); (d) Section 9.6 prohibits your access; or (e) you intend any use that Section 23.7 prohibits. You represent and warrant that all information you give PostureCo for a Knowledge Base Account is true, accurate, current, and complete and is your own, that you are not a Competitor, and that you will keep that information up to date. Giving false or misleading information, or registering or signing in as or for anyone else, is a material breach of this Agreement.

Any check that PostureCo makes against its customer records, an app store record, or any other source is for PostureCo's own protection. It may be inaccurate or incomplete, and it does not mean that PostureCo has verified your identity, qualifications, license, or authority for any other purpose (Section 9.6). Unless your Product-Specific Terms or a support plan you have purchased expressly provide otherwise, a Knowledge Base Account is provided without charge, is not part of any paid license, subscription, or support plan, and gives you no right to any particular Knowledge Base Content or to continued access.

23.3 SIGN-IN CODES; ONE PERSON PER ACCOUNT. PostureCo signs you in by sending a one-time code to the email address you enter, and you may use only an email address that you are authorized to use. A Knowledge Base Account is personal to the one individual who signs in to it. You must not share, forward, sell, or disclose any sign-in code, sign-in link, or signed-in session; let anyone else sign in with your email address or use your signed-in session; or sign in for anyone else. Each person who wants a Knowledge Base Account must have their own. If you sign in with an email address that other people can read, such as a shared practice inbox, you are responsible for everyone who uses it, and PostureCo may refuse, limit, or end access through that address. PostureCo may limit the number of devices, browsers, and sessions for each Knowledge Base Account, may set and change how long a sign-in lasts, and may require you to prove your email address again at any time. PostureCo's authorized personnel can see the sign-in codes it sends, and to help if a code does not arrive they may give it to the person who asked for it, at the same email address. You must tell PostureCo immediately, as Section 3 requires, if you suspect that anyone else has used your Knowledge Base Account or a sign-in code sent to you. Section 3 applies to your Knowledge Base Account, and you are responsible for all activity under it.

23.4 YOUR PRACTICE. If you are eligible through a practice, you represent that the practice has authorized you to use the Knowledge Base for it. PostureCo may tell that practice, for example through its primary contact in PostureCo's records, that you have registered for or signed in to a Knowledge Base Account through it, and PostureCo may end your eligibility through that practice if the practice asks or if PostureCo's records no longer list your email address for that practice. PostureCo does not tell your practice which Knowledge Base Content you open or which videos you watch.

23.5 MONITORING AND ACTIVITY RECORDS. You acknowledge and agree that, as a condition of having a Knowledge Base Account, PostureCo monitors and records the use of Knowledge Base Accounts, and of Knowledge Base Content while you are signed in, as this Section 23.5 describes. PostureCo records each request for a Knowledge Base sign-in code; each registration, sign-in, and sign-out, and each attempt at one, whether it succeeds or is refused; and, while you are signed in, each Knowledge Base tutorial or article you open, whether it is public or Locked Content, each download of a Knowledge Base file, and each start of a Knowledge Base video (together, "Activity Records"). An Activity Record may include:

  • the date and time;
  • the Knowledge Base Account, email address, name, and practice concerned, and how you signed in (for example, through PostureCo's customer records, by registration, through a PostureCo app, or by PostureCo's approval);
  • the Knowledge Base Content concerned;
  • the Internet Protocol ("IP") address from which the request was made, and a scrambled (hashed) form of it;
  • the approximate location, such as the city, region, and country, that PostureCo's website host derives from that IP address;
  • the type of device, operating system, and browser, as your browser or app reports them, whether the request came from a web browser or a PostureCo app, and the app version; and
  • the result of the checks described in this Section 23, including the eligibility check, any block or limit, and the VPN check (Section 23.6).

PostureCo does not collect GPS or other precise location for the Knowledge Base, and it does not use technology on the Knowledge Base that records your screen, keystrokes, or mouse movements ("session replay"). Recording approximate location for the Knowledge Base does not mean that PostureCo determines, verifies, or monitors where you or anyone else is located for any other purpose, and it does not change Section 8.6.

PostureCo uses Activity Records to keep the Knowledge Base and the Services secure; to confirm that each Knowledge Base Account is used only by the person entitled to it; to detect, investigate, and prevent the sharing of sign-in codes and Knowledge Base Accounts, automated access, scraping, downloading, recording, redistribution, use by Competitors, and other misuse; to enforce usage limits (Section 23.8), this Agreement, and PostureCo's licenses and intellectual property rights; to support you; to keep a record of the Knowledge Base Content each user has viewed, for PostureCo's internal training purposes, such as confirming what training a user has reviewed and planning further training; to understand, in aggregate, how the Knowledge Base is used so that PostureCo can improve it; to comply with the law; and to establish, exercise, or defend legal claims. To the extent the law allows, Activity Records are evidence of the activity they record, including in any dispute, arbitration, or other proceeding between you and PostureCo, and PostureCo may rely on them in deciding whether to limit, suspend, or end access (Section 23.9). The monitoring described in this Section 23.5 is for PostureCo's own protection. PostureCo has no obligation to monitor, to detect any misuse, or to act on any Activity Record, and not doing so is not a waiver of any of its rights.

PostureCo keeps Activity Records, including full IP addresses, for up to thirteen (13) months after the activity they record. It then deletes them or keeps only totals that do not identify any individual or show which content any individual viewed or which videos any individual watched. PostureCo may keep particular Activity Records longer, for as long as they are reasonably needed: while it investigates suspected misuse or a security incident; while a dispute, claim, or enforcement action is pending or reasonably anticipated; while a legal hold or legal process requires them; or as the law otherwise requires. It deletes them when that need ends. For as long as a block is in effect, PostureCo may also keep the information needed to enforce it, such as an email address, email domain, name, practice, and the reason for the block. PostureCo limits access to Activity Records to the personnel who need it for the purposes above and protects them with safeguards that include encryption. PostureCo does not use Activity Records for advertising, does not sell them, does not share them with its partners (Section 6.1), and does not give them to its email-marketing provider. PostureCo discloses Activity Records only to the service providers that host, deliver, and support the Knowledge Base on its behalf; to your practice, only as Section 23.4 describes; and otherwise only as the law permits or requires, for example in response to valid legal process or in connection with a transaction described in Section 8.7. Where a law, such as the federal Video Privacy Protection Act (18 U.S.C. § 2710), limits the disclosure of information that identifies a person as having requested or obtained particular videos, PostureCo discloses that information only as that law permits, including in any dispute or proceeding with you. Section 2.8 of the Privacy Policy describes this processing, and your choices and rights, in more detail.

23.6 NO VPNS OR PROXIES; THE KNOWLEDGE BASE VPN CHECK. Section 4.1 prohibits accessing or using any of the Services, including the Knowledge Base, through a VPN, proxy server, anonymizing network, or other technology that hides, masks, or changes your location. When you request a sign-in code, register, sign in, or open Locked Content, PostureCo may check whether your connection appears to come through a VPN, proxy server, anonymizing network (such as Tor), or hosting or data-center network, by comparing your IP address with information about networks known to provide those services. If it appears to, PostureCo may tell you that you appear to be using a VPN or similar technology, which this Agreement does not allow, and may refuse to let you sign in, register, or open Locked Content until you connect without it. PostureCo may also record the result of the check without blocking the connection. PostureCo may choose not to block certain connections or services, such as Apple's iCloud Private Relay, and may change what it checks or blocks at any time without notice. A decision not to block a connection or service, or a failure to detect one, is not permission to use it and does not waive or limit Section 4.1. PostureCo does not block access to its public web pages because of this check, but Section 4.1 still applies to them. Like any other location, network, or VPN check (Sections 4.1 and 8.6), this check is for PostureCo's own protection: it may be inaccurate or incomplete, may block a connection that is not a VPN or miss one that is, and creates no obligation of PostureCo to monitor for or detect location-masking technology. If you believe the check has blocked you in error, you may contact PostureCo as Section 24 describes, and a person will review your request, but PostureCo may continue to block any connection it reasonably suspects. To the maximum extent permitted by law, PostureCo has no liability for access that is blocked, delayed, or refused because of this check.

23.7 KNOWLEDGE BASE CONTENT: LICENSE AND RESTRICTIONS. Knowledge Base Content is owned by PostureCo or its licensors and is protected by copyright and other intellectual property laws. Subject to your compliance with this Agreement, PostureCo grants you, for as long as you have a Knowledge Base Account, a limited, revocable, non-exclusive, non-transferable, non-sublicensable license (a) to view the Locked Content that your Knowledge Base Account may open, by streaming it through the Knowledge Base, and (b) to download a Knowledge Base file, but only where the Knowledge Base offers a download of it. Both are solely to learn to use PostureCo's products in your own practice and to train your own practice's personnel who use PostureCo's products under your practice's license (the "Permitted Use"). You may show Locked Content to those personnel for the Permitted Use, but you must not give them your sign-in code, your signed-in session, or a copy of any Locked Content; each of them who wants to watch or read on their own needs their own Knowledge Base Account. All rights not expressly granted are reserved by PostureCo (Section 2).

Except as PostureCo expressly permits in writing, you must not, and must not allow or help anyone else to:

  • Download, save, record, screen-record, rip, or otherwise copy any Knowledge Base video, or copy any other Locked Content, except a file that the Knowledge Base offers for download, used for the Permitted Use
  • Reproduce, publish, post, broadcast, stream, transmit, display, distribute, sell, rent, lend, license, or sublicense any Locked Content, or otherwise make it available to anyone outside your own practice, including on social media, video-sharing or file-sharing services, websites, courses, seminars, or webinars
  • Share, post, frame, or embed any Locked Content, or any link, code, token, or session that opens it, so that anyone can reach it without their own Knowledge Base Account
  • Remove, obscure, or alter any copyright notice, watermark, or other identifying mark (Section 23.8)
  • Circumvent, disable, or interfere with any copy protection (DRM), encryption, access control, usage limit, VPN check, or other security or technological measure, including any technological measure that controls access to a copyrighted work under 17 U.S.C. § 1201 (Section 4)
  • Access, collect, index, or download Locked Content with any robot, spider, crawler, scraper, script, browser extension, artificial intelligence agent, or other automated means, or access the Knowledge Base faster or in greater volume than a person reasonably could using an ordinary web browser
  • Use any Locked Content, or any transcript, caption, summary, translation, description, screenshot, or other material derived from it, to train, fine-tune, evaluate, benchmark, test, ground, or otherwise develop or improve any artificial intelligence or machine-learning model or system, including any large language model and any system that retrieves content to generate output or answer questions; or upload, paste, or otherwise input any Locked Content into any artificial intelligence tool or service, other than assistive technology that you need for accessibility and use only for your own viewing
  • Translate, adapt, or create any other derivative work of any Locked Content, except notes for your own Permitted Use
  • Use any Knowledge Base Content for competitive analysis or benchmarking, or to develop, market, support, or teach any product or service that competes with any of the Services (Section 4)

Public Knowledge Base Content may be read by anyone, and PostureCo makes some of it available to search engines and artificial intelligence services on purpose. It remains subject to PostureCo's intellectual property rights and to Section 4, but the restrictions in this Section 23.7 on automated access and on artificial intelligence apply only to Locked Content and to anything obtained through a Knowledge Base Account. Any breach of this Section 23.7 is a material breach of this Agreement, causes PostureCo irreparable harm (Section 15), and ends your license under this Section 23.7 automatically, without notice.

23.8 USAGE LIMITS, CONFIRMATIONS, AND MARKS. PostureCo may set, change, and enforce limits on the use of Knowledge Base Accounts, such as how many videos may be started, or files downloaded, in a day or other period, how many devices, browsers, or sessions may be used, and how long a sign-in lasts, and it may treat use that exceeds a limit, or that is excessive, abnormal, or automated, as misuse (Section 10). Before you sign in, open particular Locked Content, or go beyond a limit, PostureCo may require you to confirm, including by checking a box, how you will use Locked Content; each such confirmation is a representation to PostureCo on which PostureCo relies. PostureCo may add visible or invisible marks to Locked Content, such as watermarks that identify your Knowledge Base Account, and may use them to trace copies.

23.9 SUSPENSION AND TERMINATION; NO REFUND. PostureCo may limit, suspend, or end any Knowledge Base Account, or access to any Locked Content, at any time, with or without notice, for any reason or no reason. Reasons include, among others, that PostureCo suspects:

  • that you, or anyone using your Knowledge Base Account, has breached this Section 23 or Section 4.1;
  • that you are, work for, or act on behalf of a Competitor;
  • that information you gave PostureCo is false;
  • that you are no longer eligible, for example because PostureCo's customer records no longer list your email address for an eligible practice; or
  • that doing so is needed to protect PostureCo, the Knowledge Base, or others.

PostureCo may also block the email addresses, email domains, names, practices, devices, app purchases, and networks that it associates with a breach. If PostureCo suspects misuse of the Knowledge Base, it may also suspend or terminate your access to any or all of the other Services, and, where the misuse is by or for a practice, that practice's access, as Section 18 allows. Except as a support plan you have purchased expressly provides, limiting, suspending, or ending a Knowledge Base Account gives no right to any refund, credit, or compensation. To the extent the law allows, fees paid for any other Service that PostureCo suspends or terminates because of misuse of the Knowledge Base, including misuse by or for a Competitor, are not refunded (Sections 3.1 and 18). PostureCo may also seek injunctive relief and every other remedy available to it (Sections 15 and 17), and you must defend, indemnify, and hold harmless PostureCo as Section 11 provides for any breach of this Section 23 by you or by anyone using your Knowledge Base Account. PostureCo may change, remove, or stop offering any Knowledge Base Content, or the Knowledge Base itself, at any time without notice or liability.

23.10 MARKETING EMAILS ARE SEPARATE AND OPTIONAL. Registering for or using a Knowledge Base Account does not, by itself, sign you up for PostureCo's marketing emails. PostureCo adds you to its email newsletter through the Knowledge Base only if you separately ask for it by checking the newsletter box, which is never checked in advance. Leaving the box unchecked does not remove you from any mailing list you joined earlier. You may unsubscribe at any time by using the unsubscribe link in any newsletter or by contacting PostureCo (Section 24). Unsubscribing does not affect your Knowledge Base Account. Sign-in codes and messages about your Knowledge Base Account, its security, and this Agreement are not marketing, and PostureCo may send them as long as you have a Knowledge Base Account. Any telephone number you give for a Knowledge Base Account is used only as Section 2.8 of the Privacy Policy describes. Giving it is not consent to receive text messages (Section 22.1), and PostureCo never gives it to its email-marketing provider or sells or shares it with any third party other than its own service providers (Section 22.7).

23.11 EXPRESS ACCEPTANCE AND RECORDS. PostureCo requires you to check a box, which is never checked in advance and is shown next to links to this Agreement and the Privacy Policy, confirming that you agree to this Agreement, including this Section 23, and that you have read the Privacy Policy. PostureCo asks for this before it first sends you a Knowledge Base sign-in code or accepts your request for access, before it first opens Locked Content for you through a PostureCo app, and again whenever it asks after posting a newer version of this Agreement or of the Privacy Policy. If you do not check the box, PostureCo will not give you a Knowledge Base Account. This express acceptance is in addition to your acceptance by use (Section 1). PostureCo keeps a record of each acceptance, and of each consent you give or withdraw in the Knowledge Base, including the date and time, the email address and Knowledge Base Account, the date of the document and the wording you were shown, your IP address, and the identifying information your browser or app sends (its user agent). Those records are evidence of your acceptance or consent (Section 1).

23.12 EDUCATIONAL CONTENT; SURVIVAL. Knowledge Base Content explains how to use PostureCo's products. It is provided "AS IS" for information and education only, may be incomplete or out of date, may not match your version of the Services (Section 19.1), and is not medical or legal advice or a substitute for your own professional judgment (Section 5.4); Sections 5, 12, and 13 apply to it. The representations and warranties in Sections 23.2, 23.4, and 23.8; Sections 23.5, 23.7 (other than its license grant), 23.9, and 23.11; the last two sentences of Section 23.6; and this Section 23.12 survive the suspension or termination of your Knowledge Base Account and of this Agreement.

24. CONTACT INFORMATION#

Questions, complaints, and claims about the Services, including any PostureCo app obtained from an app store (Sections 2.1 and 2.2), may be directed to PostureCo at the address, telephone number, or email address below. Do not include PHI (Section 8.4).

PostureCo, Inc. 3152 Little Road, Suite 161, Trinity, FL 34655

Email: info@postureco.com

Phone (toll free): 866-577-7297 · International: +1-866-577-7297

Website contact form (never include PHI): https://www.postureanalysis.com/postureco-support/

Current version available at: https://www.postureanalysis.com/legal/terms-of-service/

HIPAA Compliance Statement: https://www.postureanalysis.com/legal/hipaa-compliance-statement/