Privacy Policy | PostureCo

PostureCo may update this document at any time without prior notice. The date above shows when it was last updated, so please check back from time to time.

POSTURECO, INC. — PRIVACY POLICY

Last Updated: October 28, 2026

Form PC-4200, Rev. 2.0.14

THIS PRIVACY POLICY (the "Privacy Policy") describes the information collection, use, disclosure, and protection practices of PostureCo, Inc., a Florida corporation ("PostureCo," "Company," "we," "us," or "our"), in connection with all websites, software, applications, products, services, and cloud-based offerings made available by PostureCo (collectively, the "Services").

THIS PRIVACY POLICY IS INCORPORATED BY REFERENCE INTO AND FORMS PART OF THE POSTURECO TERMS OF SERVICE AND END USER LICENSE AGREEMENT AND, WHERE APPLICABLE, THE POSTURECO CLOUD SERVICES AGREEMENT. IN THE EVENT OF ANY CONFLICT OR INCONSISTENCY, THE TERMS OF SERVICE SHALL GOVERN GENERALLY, AND THE CLOUD SERVICES AGREEMENT SHALL GOVERN WITH RESPECT TO CLOUD-BASED SERVICES.

BY ACCESSING, DOWNLOADING, INSTALLING, PURCHASING, REGISTERING FOR, OR USING ANY SERVICE, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO THIS PRIVACY POLICY, EVEN IF NO CLICK-THROUGH IS SHOWN TO YOU. THE ACCEPTANCE RULES IN SECTION 1 OF THE TERMS OF SERVICE, INCLUDING ANY CLICK-THROUGH OR OTHER EXPRESS ACCEPTANCE THAT POSTURECO MAY ALSO REQUIRE, APPLY TO THIS PRIVACY POLICY. IF YOU DO NOT AGREE, YOU MUST DISCONTINUE ALL USE OF THE SERVICES IMMEDIATELY.

1. ELIGIBILITY AND SCOPE#

This Privacy Policy applies to all users of the Services. By using the Services, you represent and warrant that you are at least eighteen (18) years of age and have the legal capacity to enter into binding agreements. That representation, and the agreement described above, do not apply to a patient or client who uses RemoteScreen® only to send information to a professional at that professional's invitation. Such a patient or client is not a customer of PostureCo or a party to the Terms of Service; Sections 5.3 and 11 and the RemoteScreen Patient App Privacy Policy described below explain how PostureCo handles that information.

This Privacy Policy applies to, without limitation: (a) all PostureCo-owned or operated websites and domains; (b) PostureScreen®, PostureRay®, RemoteScreen®, LeanScreen®, SquatScreen®, PostureScribe.AI®, and any successor, derivative, or related products; (c) all desktop, mobile, web-based, offline, local-only, and cloud-based software; and (d) all optional cloud services, application programming interfaces (APIs), artificial intelligence features, analytics tools, documentation tools, and support services.

Patients and clients who use RemoteScreen® at the invitation of their healthcare, fitness, or wellness professional should read the RemoteScreen Patient App Privacy Policy at https://www.postureanalysis.com/legal/remotescreen-patient-privacy-policy/, which describes how PostureCo handles the information it collects through RemoteScreen on behalf of their provider (see also Section 5.3). PostureCo's HIPAA Compliance Statement at https://www.postureanalysis.com/legal/hipaa-compliance-statement/ describes how PostureCo safeguards health information under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), when PostureCo enters into a Business Associate Agreement, and what customers are responsible for under HIPAA. Each of those documents is a notice, not a contract, and neither one creates a Business Associate Agreement (Section 2.2).

2. INFORMATION COLLECTED#

2.1 Business and Account Information. PostureCo may collect limited business-related information voluntarily provided by you, including clinic or facility name, business address, business telephone number, business email address, website address, and professional identifiers used in reports or outbound communications (collectively, "Personal Information"). PostureCo does not collect personal passwords.

2.2 Patient and Client Information; PHI. PostureScreen® and PostureCo's other device-based applications are local-first: patient and client records entered in them are kept on the professional user's own device and are not sent to PostureCo, and PostureCo has no access to, custody of, or control over those records and cannot view, retrieve, restore, or recover them (Section 5.4 describes copies that the device or a service the user turns on may make). Unless you use PostureCo Cloud Services or PostureScribe.AI (or choose to send records to PostureCo yourself), PostureCo never has access to your patient or client records. PostureCo stores or processes patient or client records, including protected health information ("PHI"), only when a professional user (a) uses PostureCo Cloud Services, including cloud backup and synchronization in PostureScreen, the PostureCo Cloud web portal, RemoteScreen®, and PostureRay® on PostureCo Cloud (which requires a separate PostureRay® subscription); (b) uses PostureScribe.AI; or (c) chooses to send or show records to PostureCo, for example under a technical support plan that includes cloud backup or during a remote support session; in each case PostureCo handles them only on that user's behalf, as described in Sections 5 and 13. Section 8.4 of the Terms of Service forbids sending PHI to PostureCo by any means, including for support, unless a BAA is in effect. Patient or client data is entered into the Services by the professional user (or, through RemoteScreen, by the user's patient or client at the user's invitation) and remains under the user's control, subject to the limited access and disclosures described in Sections 5.2 and 7.2. Separately, PostureCo automatically collects the anonymized and aggregated technical and usage data described in Section 2.3, which contains no PHI and identifies no one.

PostureCo is not a Business Associate under HIPAA by default, and using any Service does not by itself create a Business Associate Agreement ("BAA"). PostureCo agrees to act as a user's Business Associate only under a BAA that is fully executed as described below, and users must not provide PHI to PostureCo without one (Section 8.4 of the Terms of Service). PostureCo enters into a BAA only with a healthcare provider, covered entity, or business associate located in the United States that uses PostureCo Cloud Services (including RemoteScreen and PostureRay on PostureCo Cloud, which requires a separate PostureRay subscription), PostureScribe.AI, the cloud backup and online ViewBox included in a PostureRay technical support plan, or remote technical support for PostureRay software, together with technical support for those services; it does not enter into a BAA for the use of its mobile applications alone (Terms of Service Section 8.3), and it considers requests from outside the United States only as Section 8.5 of the Terms of Service describes. It is the end user's sole responsibility to determine whether a BAA is required and to request one from PostureCo, either by supplying its own proposed BAA for PostureCo's review or by asking for PostureCo's standard BAA, and the BAA must be fully executed by both the user and PostureCo before any PHI is uploaded, transmitted, recorded, or dictated, which includes before the user turns on cloud backup or synchronization for records that contain PHI, before the user uses PostureScribe.AI with PHI, and before the user invites any patient to RemoteScreen. Requests may be sent to info@postureco.com or through the contact form on PostureCo's website and must not contain PHI. PostureCo has no obligation to ask whether a BAA is needed, to offer one, or to remind anyone; a request alone does not create a BAA; and PostureCo may accept, negotiate, or decline any proposed BAA. A BAA covers only the Services it names: a BAA that covers only PostureScribe.AI does not permit PHI in PostureCo Cloud Services, and a BAA that covers only PostureCo Cloud Services does not permit PHI in PostureScribe.AI. Fitness and wellness professionals who are not HIPAA covered entities or business associates generally do not need a BAA, but each user must make that determination for itself, and nothing in this Privacy Policy is legal advice. Uploading, transmitting, recording, or dictating PHI without an executed BAA that covers the Service in question is strictly prohibited and undertaken at the user's sole risk. Where an executed BAA is in effect, PostureCo uses and discloses the PHI it covers only as that BAA permits or the law requires (for example, to provide the contracted service), and the BAA controls over any conflicting term of this Privacy Policy as to that PHI. A covered entity in the United States must have a fully executed BAA with PostureCo before inviting patients to RemoteScreen (Section 5.3). It is the user's responsibility to utilize the Services' features (including user roles, permissions, and data entry fields) in a manner compliant with their legal obligations regarding PHI.

2.3 Anonymized Technical and Usage Data. PostureCo automatically collects only anonymized and aggregated technical, usage, and performance data that app developers need to operate, maintain, secure, support, and improve software, such as feature usage statistics, performance telemetry, and error logs. Crash and error reports from PostureCo's apps are sent through Google Firebase and are designed not to include patient or client information or PHI. Such data does not identify individuals, does not contain PHI, and is not considered Personal Information once de-identified. PostureCo does not collect measurement data: the posture, biomechanics, movement, imaging, and radiographic measurements, joint angles, distances, translations, rotations, ranges of motion, and X-ray digitization points and landmarks that the Services calculate are part of the user's own records and are handled only as Sections 2.2 and 5 describe.

2.4 Support Communications. PostureCo may retain records of communications, including emails, chat messages, call notes, support tickets, and diagnostic metadata, for operational, staff training, compliance, quality assurance, and support purposes.

2.5 Biometric and Health Data. The Services' image, movement, and measurement analysis is performed by software operating locally on the professional user's own device (or, for RemoteScreen® posture guidance, in the web browser on the patient's or client's own device) or, where the user elects cloud features, within PostureCo's encrypted cloud environment as described in Section 5. The Services do not use facial recognition to identify individuals, and PostureCo does not use the Services to create or store faceprints, voiceprints, or other templates used to identify individuals, does not collect, capture, purchase, or retain biometric identifiers or biometric information as defined by the Illinois Biometric Information Privacy Act and similar statutes, and does not sell biometric data. Even so, photographs, videos, and voice recordings handled through the Services may be treated as biometric data or consumer health data under some laws, such as the Washington My Health My Data Act. Photographs, videos, voice recordings, and measurements of patients or clients are captured by or at the direction of, and controlled by, the professional user, who is solely responsible for obtaining any consent or authorization required by applicable law before capturing or analyzing such media. To the extent any consumer-health-data or similar law applies to data handled through the Services, PostureCo acts solely as a service provider or processor on behalf of the professional user and does not sell or share such data.

2.6 Website Contact Form. When you send a message through the contact form on a PostureCo website, PostureCo collects the information you enter: your name; your email address, which you type twice so that a typing error cannot send PostureCo's reply to the wrong address; your telephone number and whether it is a mobile or an office or landline number; your practice, facility, or organization; the topic, subject, and text of your message; and, only if you choose to give them, your permission to be called or sent text messages at that number and your request to receive PostureCo's email newsletter, each with the date and time you gave it. PostureCo uses this information to answer your message, keeps a record of it as described in Section 2.4, and shares it only as described in Section 7; mobile telephone numbers are never sold or shared with third parties (Sections 7.3 and 18.4). The message is delivered to PostureCo's customer-service system (Salesforce) and by email to PostureCo staff; the website itself does not store your message. To protect the form from spam and automated abuse, PostureCo uses Cloudflare Turnstile, a security check provided by Cloudflare, Inc., which processes technical information about your browser and device, such as your IP address, to confirm that a person is sending the form (Section 4.2). Do not include patient or client information in a contact-form message.

Agreement Records. Before you send a message through the contact form, ask for access to PostureCo's knowledge base, or are sent a code to sign in to the knowledge base, you must tick a box confirming that you have read and agree to PostureCo's Terms of Service and this Privacy Policy. PostureCo keeps a record of each such agreement: the email address you gave (and, on a form, your name), the date and time, the form you used, the dates of the versions of both documents you agreed to, the wording of the box, and your IP address and browser. PostureCo uses these records to show what you agreed to and when, to enforce its agreements, and to protect its rights. It stores the IP address encrypted, deletes the IP address and browser after thirteen (13) months, and keeps the rest of the record for as long as it may be needed for a claim, a dispute, or a legal obligation (Section 6). The record never includes the text of your message.

2.7 Online Scheduling. PostureCo may offer online booking pages, for example to schedule a call, a demonstration, or a support, training, or service session. These booking pages are provided and hosted by OnceHub, PostureCo's scheduling service provider (Section 7.2). When you book, PostureCo collects the information the booking form asks for, such as your name, email address, telephone number, practice or organization, the date and time you choose, and any notes you add, and uses it to arrange, confirm, remind you of, reschedule, and hold the meeting and to keep a record of it. To protect the booking pages from spam and automated bookings, they use a security check that may place a strictly necessary cookie on your browser (Section 4.1). Do not include patient or client information in a booking.

3. USE OF INFORMATION#

PostureCo uses collected information solely for legitimate business purposes, including to operate, maintain, support, and improve the Services; process subscriptions and transactions; provide customer support; communicate administrative, security, and service-related notices; conduct internal analytics, auditing, and research; and enforce contractual terms and protect the integrity and security of the Services.

You may opt out of marketing communications at any time by using the unsubscribe mechanism in any marketing email or by contacting info@postureco.com. Administrative, security, and service-related notices are not marketing and may be sent as long as you use the Services.

Telephone calls and text messages, which PostureCo sends only with your permission, are described in Section 18.

4. COOKIES AND SIMILAR TECHNOLOGIES#

4.1 What These Technologies Are. PostureCo websites use cookies and similar technologies, such as browser local storage, session storage, pixels, and tags (together, "cookies"). Cookies may collect technical information, including IP address, browser type, device identifiers, referring and exit pages, date and time stamps, and interaction data.

RemoteScreen's patient web app, which patients and clients open from their provider's link, uses no advertising or analytics cookies or other trackers, only browser storage strictly needed to run it, such as a random device identifier in local storage and session settings in session storage, as described in the RemoteScreen Patient App Privacy Policy at https://www.postureanalysis.com/legal/remotescreen-patient-privacy-policy/.

PostureCo's online booking pages (Section 2.7) are hosted by OnceHub, not on PostureCo's websites. To stop spam and automated bookings, they run a CAPTCHA security check, which OnceHub provides through Cloudflare, Inc. The check may set a strictly necessary cookie, such as cf_chl_prog, used only to complete the check and to tell people apart from automated traffic; OnceHub states that this cookie does not identify you and does not track or store personal information. Because the cookie is needed to keep the booking pages secure, it does not require consent. OnceHub may use other cookies on its booking pages under its own cookie notice and privacy policy, which PostureCo does not control; you can block or delete them through your browser settings, although blocking strictly necessary cookies may prevent you from booking.

4.2 Categories. PostureCo groups the cookies on its websites into four categories:

Strictly necessary: required for a website to work and to remember your choices. These include the first-party pc_consent cookie, which stores a random consent identifier, the date and time of your choice, the version of the cookie settings you were shown, your choices and how you made them, and whether your browser sent a Global Privacy Control signal, for six (6) months (if your browser does not accept the cookie, the same record is kept in its local storage instead); the pc-dock-off entry in session storage, which remembers that you closed the "Get the app" bar until you close the browser tab; and, only if you sign in to the knowledge base as a PostureRay® customer, the first-party pc_kb cookie, which keeps you signed in for thirty (30) days from your last visit. These are always on and do not require consent. Pages with a contact form also use Cloudflare Turnstile, a security check provided by Cloudflare, Inc. that confirms a person, not a bot, is sending the form; it loads only once you start filling in the form and may use cookies or local storage for the length of your visit. PostureCo's websites also count page views without cookies, using Vercel Web Analytics, provided by Vercel, Inc., which hosts PostureCo's websites. Its script loads from the website's own address (/_vercel/insights/) and stores nothing on your device. When a page loads, the website sends only the address of that page, without any query string or "#" fragment, and Vercel processes technical information that comes with that request, such as your IP address, browser, operating system, device type, and referring page, to produce aggregate totals, such as page views, referring websites, countries, and device types. PostureCo sees only those totals, does not use them to identify you, to follow you across other websites, or for advertising, and Vercel processes the request as PostureCo's service provider (Section 7.2). Because this page count uses no cookies and stores nothing on your device, it runs without a consent choice and is listed under Strictly necessary in the "Cookie settings" panel as "Cookie-free page count."
Embedded videos: YouTube videos on PostureCo websites, and their preview images, load from YouTube only after you allow embedded videos or choose to play a video; until then, nothing loads from YouTube. When you press play, you may play that one video ("Play this video") or allow YouTube videos from then on ("Always allow YouTube"). Videos play from youtube-nocookie.com. Once a video loads, YouTube (Google) may set its own cookies and local storage, such as YSC, VISITOR_INFO1_LIVE, VISITOR_PRIVACY_METADATA, and yt-remote-*, which last from the length of your visit up to six (6) months, to remember playback settings, count views, and prevent abuse, under Google's own privacy policy.
Analytics: measurement tools that use cookies or device storage, such as Google Analytics 4 (cookies _ga and _ga_<ID>, which last up to two (2) years), that help PostureCo understand how its websites are used.
Marketing: advertising tools, such as the Meta Pixel (cookies _fbp and _fbc, which last up to ninety (90) days), that help PostureCo measure and improve its advertising.

The "Cookie settings" panel on each PostureCo website lists the cookies and similar technologies in use in each category, with their provider, purpose, type, and duration, and marks a category "Not in use" when PostureCo has not enabled it.

4.3 Consent. PostureCo applies the same opt-in standard to every visitor, wherever located: no cookies other than strictly necessary cookies are used until you make a choice. You may accept all, reject all, or choose by category, and rejecting is as easy as accepting. Your choice and its consent identifier are recorded in the pc_consent cookie, and PostureCo asks again after six (6) months, or sooner if PostureCo adds an analytics or marketing tool or materially changes what an optional category does.

4.4 Changing or Withdrawing Consent. You may change or withdraw your consent at any time through the "Cookie settings" or "Your Privacy Choices" link at the bottom of every page. When you withdraw consent, the website deletes the analytics and marketing cookies that PostureCo set on its own domain and, where a tool has already run on the page, reloads the page so that it stops. Cookies that YouTube (Google) or another provider sets on its own domain cannot be deleted by PostureCo's websites; you can delete them through your browser settings. The "Cookie settings" panel shows your consent identifier, which you may quote if you contact PostureCo about your choices. You can also block or delete cookies through your browser settings; blocking strictly necessary cookies may impair functionality of the Services.

4.5 Sale, Sharing, Targeted Advertising, and Global Privacy Control. Under the laws of California and certain other U.S. states, the use of marketing cookies may be considered a "sale" or "sharing" of personal information, or "targeted advertising." Marketing cookies are used only with your consent, and you may opt out at any time through the "Your Privacy Choices" link. PostureCo honors the Global Privacy Control ("GPC") browser signal as a valid request to opt out of such sale, sharing, and targeted advertising for the browser that sends it: marketing cookies remain off, and the website confirms that the opt-out preference signal was honored.

4.6 Do Not Track. There is no common industry standard for browser "Do Not Track" signals, and the Services do not respond to them. PostureCo honors the Global Privacy Control signal as described in Section 4.5.

5. DATA STORAGE AND CLOUD SERVICES#

5.1 Local Data. Unless you elect to use optional cloud services or PostureScribe.AI, or choose to send data to PostureCo yourself (Section 2.2), data generated through use of the Services is kept locally on your device and is not sent to PostureCo, and PostureCo has no access, custody, or control over such data (Section 5.4 describes copies that your device, or a service you turn on, may make).

5.2 Cloud Services; Hosting and Regions. If you elect to use PostureCo's optional cloud services, PostureCo Cloud Services (formerly "SyncScreen"), data is uploaded only after you subscribe to and set up those services, and then as their settings provide, which may include automatic uploads whenever you add or edit a client or add an assessment (or, through RemoteScreen®, when a patient or client you invite submits information). Because uploads may happen automatically, any BAA you need (Section 2.2) must be fully executed before any PHI reaches PostureCo, including before you set up or turn on cloud backup or synchronization for records that contain PHI and before you invite any patient to RemoteScreen. PostureCo Cloud Services' storage, backup, and synchronization infrastructure runs on Amazon Web Services ("AWS"), under a signed Business Associate Addendum between PostureCo and AWS. Cloud Services data, including PHI, is stored and processed in AWS services that AWS designates as HIPAA-eligible; information sent to an AI provider for PostureScribe.AI or RemoteScreen's AI-Guided Health History is processed by that provider under its own BAA with PostureCo (Section 13.1 and Section 6 of the PostureScribe.AI User Agreement).

PostureCo uses regional AWS infrastructure. You choose the location (AWS region) where your PostureCo Cloud Services data is stored, directly in the Software when you set up PostureCo Cloud Services, from the regions PostureCo offers at the time (for example, the United States, Europe, or Asia, where offered). Choosing the correct region for your location and for the laws that apply to you, including data-residency, data-protection, and health-information laws such as HIPAA, the GDPR, and the UK GDPR, is your sole responsibility, not PostureCo's. PostureCo has no obligation to determine, verify, or monitor where you or your patients or clients are located, and it cannot reliably tell, for example because a user may connect through a virtual private network ("VPN") or other location-masking technology, which Section 4 of the Terms of Service prohibits (see Section 10.1). Any location or VPN check that PostureCo chooses to make may be inaccurate and does not make PostureCo responsible for your choice of region. PostureCo stores your data in the region you select and relies on that selection. If the Software offers no choice of region, or you make none, your data is stored in the United States. PostureCo does not promise that any particular region, or a region for every country, is available, and it may add, change, or retire regions. Within a region, AWS stores data redundantly across multiple availability zones. Even with regional storage, PostureCo personnel and service providers in the United States may access data as needed to provide, secure, and support the Services (Section 10).

If you selected the wrong region, set up data outside your country by mistake, or later need your data moved to another region, you must contact PostureCo support promptly once you realize it, by email at info@postureco.com, toll free at 866-577-7297 (+1-866-577-7297 from outside the United States), or through the contact form at https://www.postureanalysis.com/postureco-support/; do not include PHI in the request. After verifying the request in the manner Section 6 describes for deletion requests, PostureCo will assist you by manually moving the data to the region you designate, from those PostureCo then offers, and deleting it from the region it is moved from, including any region where it was created by mistake, within a reasonable time and subject to secure backup retention cycles (copies in backups expire on their normal cycle and remain protected until then). PostureCo does not guarantee a completion time. PostureCo does not move your data to another region on its own initiative, except as Section 4.1 of the Cloud Services Agreement allows (for example, if a region becomes unavailable or is retired, or as needed to provide, secure, or support the Services or to comply with law). Until the move is completed, and for any period before you tell PostureCo, you are solely responsible for your data being stored and processed in the region you selected (or in the United States, if you made no selection), including any legal consequence, and, to the maximum extent permitted by law and except for PostureCo's own obligations under any executed BAA or data processing agreement, PostureCo has no liability for it; that responsibility is part of your indemnity under Section 11 of the Terms of Service and Section 13 of the Cloud Services Agreement.

Cloud Services data is encrypted in transit using TLS and at rest using AES-256 encryption. PostureCo operates as a blind storage provider: in the ordinary course of providing PostureCo Cloud Services, PostureCo's personnel do not view, review, or interpret your uploaded content. PostureCo's systems process that content automatically only to provide, secure, and support the Services. Use of cloud services is governed by the PostureCo Cloud Services Agreement at https://www.postureanalysis.com/legal/cloud-services-agreement/, which supplements and incorporates the Terms of Service, and, as to PHI, by any BAA executed as described in Section 2.2.

5.3 RemoteScreen Patients and Clients. RemoteScreen® lets a professional user (the "Provider") send a patient or client a RemoteScreen link. The patient or client opens it in a web browser or app, enters identifying details (such as name, date of birth, telephone number, and email address), takes guided posture photographs and a guided movement video, and, where the Provider offers it, completes the AI-Guided Health History by voice. In-browser posture guidance analyzes the camera image on the patient's or client's own device to help position each photograph and does not send that image to third parties. The photographs, videos, and intake results are uploaded to the Provider's PostureCo Cloud account; RemoteScreen works as a drop-off, so the patient's or client's browser cannot read back the Provider's records. The AI-Guided Health History uses SpaceX AI, as described in Section 13.1; before it begins, RemoteScreen asks the patient or client to confirm that they are not having a medical emergency, to acknowledge that the AI does not give medical advice, and to consent to being recorded for transcription. The AI-Guided Health History is available only in the United States at this time. Accessing or using it from outside the United States, including by a patient or client and including through a VPN or other location-masking technology (Section 10.1), is prohibited and a breach of the Terms of Service (Section 4 of the Terms of Service, which also applies to patients' and clients' use of RemoteScreen) until PostureCo formally releases it outside the United States, which PostureCo will do only by publishing updated terms or a written release notice on its website or in the Services; no other statement, including one by PostureCo support or sales personnel, releases it. RemoteScreen's posture photograph and movement video features may be used outside the United States, subject to the Provider's own legal responsibilities, including its choice of region (Section 5.2) and the laws that apply to it. PostureCo may block or disable the AI-Guided Health History and is not responsible for any use of it outside the United States. RemoteScreen requires the Provider's PostureCo Cloud Services subscription. In collecting and storing this information, PostureCo acts on behalf of, and on the instructions of, the Provider, as its service provider or processor and, where an executed BAA is in effect (Section 2.2), as its business associate, and PostureCo does not sell that information. The Provider's own notice of privacy practices and policies govern the Provider's use of the information. The Provider is solely responsible for its notices to patients and clients; for obtaining every consent and authorization the law requires, including for recording and AI processing and any parental or guardian consent the law requires when inviting a minor; for making sure that a parent or legal guardian completes RemoteScreen on behalf of any child under thirteen (13), and that a minor aged thirteen (13) to seventeen (17) uses it only with a parent's or legal guardian's permission (Section 11); for not inviting or allowing any patient or client who is outside the United States to use the AI-Guided Health History, for telling patients and clients not to use a VPN or other location-masking technology with RemoteScreen, and for its invitees' compliance with those restrictions; for determining whether it needs a BAA and, if it is a covered entity in the United States, having one fully executed with PostureCo before inviting patients to RemoteScreen (Section 2.2); and for responding to patients' and clients' requests about their information. Patients and clients should read the RemoteScreen Patient App Privacy Policy at https://www.postureanalysis.com/legal/remotescreen-patient-privacy-policy/ and direct requests about their information to their Provider.

5.4 Device Backups and Third-Party Services. Information you keep on your device may be copied off it by the device's operating system or by services that you or your organization turn on or connect, for example Apple iCloud Backup, iCloud Photos, and iCloud Drive, Google Drive, Microsoft OneDrive, Dropbox, email, or backup software (a "Third-Party Backup Service," as Section 7.1 of the Terms of Service defines it). Those services are provided by their own providers under their own terms and privacy policies, not by PostureCo. PostureCo does not receive the copies they make, has no access to or control over them, and is not responsible for them. A professional user who is a HIPAA covered entity or business associate must keep PHI out of any such service that does not meet their legal obligations, including any business associate agreement those obligations require; Apple's iCloud terms, for example, do not allow HIPAA covered entities or business associates to use iCloud for PHI (Terms of Service, Sections 7.1 through 7.4). For a professional who works in health and fitness only and is not covered by HIPAA, those precautions are recommended but optional, subject to any other law that applies to them.

6. DATA RETENTION AND DELETION#

PostureCo retains information only for so long as reasonably necessary for business, legal, and contractual purposes. In deciding how long to keep information it handles for its own purposes, PostureCo considers why the information was collected, whether you still have an account or subscription, and the periods that tax, accounting, and other laws, and possible legal claims, require. For example, PostureCo keeps account and subscription records for the life of the account and afterward for as long as those periods require; support communications and contact-form messages (Sections 2.4 and 2.6) and bookings (Section 2.7) for as long as needed to support you and to show compliance; records of your agreement to the Terms of Service and this Privacy Policy as Section 2.6 describes; records of text-message permissions and opt-outs as Section 18.6 describes; and cookies for the durations listed in Section 4.2. Data stored on PostureCo's servers through optional cloud services or technical support plans, including PostureCo Cloud Services, RemoteScreen®, and PostureRay® cloud backup and online ViewBox, remains available for the account holder to export, using the export features the Services provide, for thirty (30) days after the applicable subscription or plan ends for any reason, and may then be permanently deleted without notice and without liability, as Section 7 of the Terms of Service and Section 5A of the PostureCo Cloud Services Agreement provide. Exporting that data before then is the account holder's responsibility; PostureCo does not send copies of that data, or of PostureCo's databases or backups, when the subscription or plan ends. You are solely responsible for maintaining independent, redundant backups of your data, using only backup methods that meet your legal obligations (Section 5.4). PostureCo does not provide archival services and is not a medical-records custodian; cloud storage is not a system of record for any legal retention obligation. Audio recordings used by PostureScribe.AI are deleted as described in Section 13.3. Where an executed BAA is in effect (Section 2.2), PostureCo returns or destroys the PHI it covers as that BAA provides.

To request deletion of information stored on PostureCo's servers, submit a notarized written request (or equivalent legal attestation) to info@postureco.com. PostureCo requires this verification to confirm that a deletion request is legitimate and authorized — protecting account holders from fraudulent or malicious destruction of their information. Upon verification, PostureCo will permanently delete the requested data from its servers, subject to reasonable processing time, secure backup retention cycles, and any retention that applicable law or legal process requires. Where a law that applies to a request does not permit PostureCo to require notarization, or requires PostureCo to bear its cost, PostureCo will verify the request by another reasonable method that law permits. A request to move PostureCo Cloud Services data to a different region, and to delete it from the region it is moved from, is verified and handled as Section 5.2 describes.

Patients and clients must direct any requests for access to, amendment of, or deletion of records to the professional who collected such data, including, for RemoteScreen®, their Provider (Section 5.3). Where PostureCo receives such a request, it may refer the request to that professional and will support the professional as an executed BAA or data processing agreement, and applicable law, require.

7. DISCLOSURE OF INFORMATION#

7.1 Partners. PostureCo shares Personal Information outside PostureCo only as this Section describes. PostureCo's partners are CBP Seminars, Inc.; CBP Non-Profit, Inc.; WebExercises, Inc.; 3D Practice; and any company with which PostureCo later establishes an integration or partnership, which PostureCo will add to this list (together, "Partners"). PostureCo may share the business, account, and contact information described in Sections 2.1 and 2.6, other than mobile telephone numbers (Section 7.3), with its Partners to provide, support, and improve integrated products and services (for example, exercise programs through WebExercises or educational animations through 3D Practice when you use them); to provide related education, seminars, and research; and so that Partners may tell you about related products, services, and events. PostureCo shares it with Partners only for those purposes. Patient and client information is shared with a Partner only when you direct it, for example by sending an exercise program through WebExercises. PostureCo does not share Personal Information with any other third party for that third party's own marketing. You may ask PostureCo at any time to stop sharing your Personal Information with Partners for their marketing by contacting PostureCo as described in Section 19, and PostureCo will honor your request. To the extent such sharing is considered a "sale" or "sharing" of Personal Information under a U.S. state privacy law, that request is your opt-out.

7.2 Service Providers and Legal Disclosures. PostureCo may also disclose information to affiliates and service providers acting on its behalf, each bound by written agreements — including Business Associate Agreements where applicable — that restrict their use of the information. PostureCo's service providers fall into the following categories, with the principal ones named:

cloud hosting, storage, backup, and synchronization for PostureCo Cloud Services: Amazon Web Services, under a signed Business Associate Addendum (Section 5.2);
artificial intelligence processing: SpaceX AI, for PostureScribe.AI and RemoteScreen's AI-Guided Health History; Amazon Bedrock on AWS, as the fallback for PostureScribe.AI; and any other AI provider that PostureCo may use under a Business Associate Agreement with PostureCo (Section 13.1);
customer service and support: PostureCo's customer-service system, Salesforce (Section 2.6);
website security: Cloudflare, Inc., which provides the Cloudflare Turnstile security check (Sections 2.6 and 4.2);
website hosting and delivery, and the cookie-free page counts described in Section 4.2: Vercel, Inc.;
online scheduling: OnceHub, which provides PostureCo's booking pages and their CAPTCHA security check (Sections 2.7 and 4.1);
crash and error reporting for PostureCo's apps: Google Firebase (Section 2.3);
analytics on the anonymized and aggregated technical and usage data described in Section 2.3, which contains no PHI; and
business operations, such as email, document, communication, ticket-tracking, and remote-support tools.

PostureCo may add, change, or replace service providers at any time without prior notice, except where Section 8.3 of the Cloud Services Agreement or applicable law requires notice, and it sends PHI only to service providers bound by a Business Associate Agreement (or an equivalent subcontractor agreement) with PostureCo. Mobile telephone numbers and text-messaging opt-in data and consent are not disclosed under this Section 7.2; only PostureCo's own service providers described in Section 18.4, such as its customer-service system and its text-messaging provider, receive them, solely to deliver PostureCo's messages and support you on PostureCo's behalf. PostureCo may also disclose information to comply with applicable law, regulation, or legal process; to enforce agreements or protect rights, safety, or property; or in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of PostureCo's business or assets, subject to the same protections and any executed BAA. PostureCo does not sell Personal Information for money. Any use of optional marketing cookies on PostureCo websites, which may be considered a "sale" or "sharing" of Personal Information under certain U.S. state laws, takes place only with your consent and is subject to your right to opt out described in Section 4.5.

7.3 Mobile Telephone Numbers. PostureCo never sells mobile telephone numbers and never shares them, or text-messaging opt-in data and consent, with its Partners, affiliates, or any other third parties. The only exception is PostureCo's own service providers described in Section 18.4. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.

8. SECURITY AND INCIDENT RESPONSE#

PostureCo implements commercially reasonable administrative, technical, and physical safeguards appropriate to the nature of the information. For PostureCo Cloud Services, these include:

encryption of data in transit using TLS and at rest using AES-256 encryption;
per-organization data segregation enforced on PostureCo's servers, with storage locations segmented per account;
authentication of API requests to PostureCo's cloud services, using short-lived, practice-scoped temporary credentials and access tokens;
multi-factor authentication, automatic session expiry, and rate-limited sign-in on the PostureCo Cloud web portal;
logging of access and administrative events, and integrity checks on data written to the cloud;
blind storage: in the ordinary course of providing PostureCo Cloud Services, PostureCo's personnel do not view, review, or interpret uploaded content, which PostureCo's systems process automatically only as Section 5.2 describes;
production access limited to designated senior technology staff, for maintenance, and use and disclosure of customer PHI only as an executed BAA permits or the law requires, with PostureCo's service providers that receive PHI acting for PostureCo under BAAs with PostureCo;
signed BAAs with every third-party vendor whose services could touch customer PHI, with new vendors required to sign one before engagement;
physical and environmental security of the data centers provided by AWS, which maintains its own independent attestations (PostureCo operates no data centers of its own); and
a documented, risk-driven security program, privacy and security obligations communicated to personnel, and designated Privacy and Security Officers (PostureCo's Chief Executive Officer and Chief Technology Officer).

PostureCo's HIPAA Compliance Statement at https://www.postureanalysis.com/legal/hipaa-compliance-statement/ describes how PostureCo safeguards health information, when it enters into a BAA, and what customers are responsible for under HIPAA. PostureCo may change its safeguards and service providers at any time while maintaining equivalent or better protection. The descriptions of PostureCo's safeguards and service providers in this Privacy Policy describe its current practices and are not a warranty. No method of transmission or storage is completely secure, and PostureCo cannot guarantee absolute security. You are responsible for the security of your own devices, accounts, and login credentials, and of any data you keep on your devices, back up, or export from the Services, including through a Third-Party Backup Service such as Apple iCloud (Section 5.4).

PostureCo maintains incident-response and breach-notification procedures consistent with applicable law, including HIPAA (where it applies) and the Florida Information Protection Act, and will provide notifications as required by law. Where an executed BAA is in effect (Section 2.2), PostureCo reports security incidents and breaches of unsecured PHI to the customer as that BAA provides, and reports a breach of unsecured PHI without unreasonable delay and no later than sixty (60) calendar days after discovery, or within any shorter period that the executed BAA or applicable law, such as the Florida Information Protection Act, requires. Where PostureCo processes personal data as a processor under the GDPR or the UK GDPR, it notifies the controller of a personal data breach without undue delay after becoming aware of it. Suspected security issues may be reported to info@postureco.com.

9. STATE PRIVACY RIGHTS#

To the extent a U.S. state privacy law applies to your Personal Information, you may submit a rights request (such as access, correction, or deletion) to info@postureco.com. PostureCo will verify the identity and authority of the requester before acting on any request and will honor verified requests as required by applicable law. To verify a request, PostureCo matches information you give, such as your name, email address, telephone number, and practice, with information PostureCo already holds, and may ask for more information only as needed to confirm your identity and authority; a request to delete information stored on PostureCo's servers is verified as Section 6 describes. You may use an authorized agent to submit a request on your behalf, subject to verification of the agent's authority and your identity. You may also opt out of the sale or sharing of personal information and of targeted advertising as described in Sections 4.5 and 7.1. PostureCo does not sell personal information for money and does not discriminate against users for exercising privacy rights.

If PostureCo declines to act on your request, you may appeal the decision by emailing info@postureco.com with the subject line "Privacy Appeal." PostureCo will respond to your appeal within the time required by applicable law and, if the appeal is denied, will explain how you may contact your state Attorney General.

Where the California Consumer Privacy Act, as amended (the "CCPA"), applies to PostureCo's handling of your Personal Information, you may also submit a request to know, delete, or correct by calling PostureCo toll free at 866-577-7297; PostureCo confirms receipt of such a request within ten (10) business days and responds within forty-five (45) calendar days, which may be extended once by another forty-five (45) days with notice to you. In the preceding twelve (12) months, PostureCo has collected the following categories of personal information, as the CCPA describes them: identifiers and customer records, such as name, business address, email address, and telephone number (Sections 2.1 and 2.6); professional information, such as clinic or facility name and professional identifiers (Section 2.1); commercial information, such as the subscriptions you purchase (Section 3); the content of your communications with PostureCo (Sections 2.4 and 2.6); and internet or other electronic network activity information (Section 4). PostureCo collects them from you, from your browser or device, and from its service providers; uses them for the purposes described in Section 3; and discloses them for business purposes to the service providers described in Sections 7.2 and 18.4. As Sections 4.5 and 7.1 describe, PostureCo may disclose identifiers, customer records, and professional information, other than mobile telephone numbers and text-messaging opt-in data and consent (which are never sold or shared; Sections 7.3 and 18.4), to its Partners and, only with your consent, internet activity information to advertising providers, such as Meta, through marketing cookies (Section 4.2), which may be a "sale" or "sharing" under the CCPA. PostureCo keeps each category as Section 6 describes. PostureCo does not use or disclose sensitive personal information for purposes that would require it to offer a right to limit that use, and it does not knowingly sell or share the personal information of consumers under sixteen (16) years of age.

10. INTERNATIONAL USE AND PRIVACY RIGHTS OUTSIDE THE UNITED STATES#

10.1 International Use; Regional Hosting. The Services are controlled and operated from the United States. PostureCo Cloud Services data is stored in the AWS region you choose when you set up PostureCo Cloud Services, or in the United States if the Software offers no choice or you make none (Section 5.2). Choosing the correct region for your location and for the laws that apply to you is solely your responsibility, not PostureCo's; if you chose the wrong region, you must contact PostureCo to have your data moved, as Section 5.2 describes. Even where data is stored in another region, PostureCo personnel and service providers in the United States may access it as needed to provide, secure, and support the Services, and the information PostureCo handles for its own purposes, such as account, billing, support, and website information, may be transferred to and processed in the United States.

You must not access or use any of the Services, including PostureCo's websites and apps, the PostureCo Cloud web portal, RemoteScreen®, and PostureScribe.AI, through a VPN, proxy server, anonymizing network, or any other technology that hides, masks, or changes the location from which you access them, including a VPN provided by your employer or practice; doing so is a material breach of the Terms of Service (Section 4 of the Terms of Service). PostureCo may not be able to detect such use, has no obligation to monitor for or detect it, and may (but need not) block, suspend, or terminate access if it suspects it. You are solely responsible for every consequence of such use, including use of a feature where it is not available, data stored in a region that is wrong for you, and any resulting violation of law, and, to the maximum extent permitted by law and except for PostureCo's own obligations under any executed BAA or data processing agreement, PostureCo has no liability for it.

PostureScribe.AI and RemoteScreen's AI-Guided Health History are currently offered only in the United States and may be used only from inside the United States; using either of them from outside the United States, including through a VPN, is not authorized by PostureCo and is a breach of the Terms of Service (Sections 5.3 and 13.2). If you access or use the Services from outside the United States, it is solely your responsibility to determine whether your use of the Services — including your choice of region and any storage, access, or transfer described in this Section 10.1 — complies with the laws applicable to you, including HIPAA, GDPR, UK GDPR, and other data protection or privacy laws. PostureCo does not guarantee that data residency in any particular region or country is available, or that it will satisfy the laws applicable to you. International use is at the user's sole risk.

PostureCo distributes its apps worldwide, including through app stores, and cannot tell who a user is, what type of provider or professional a user is, where a user is located, or which laws apply to a user; it relies on each user (Section 9.6 of the Terms of Service). If you are a healthcare provider or other professional outside the United States, you are solely responsible for identifying and complying with every law that applies to you and to your patients' and clients' information, and for requesting from PostureCo, before uploading any such information, any agreement that law requires, such as an agreement similar to a BAA under HIPAA (where the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection applies, the processor terms and standard contractual clauses in Sections 8.3 and 8.4 of the Cloud Services Agreement already apply, as those Sections provide); until any such agreement is in place, you must not upload that information (Section 9.5 of the Terms of Service). Using any Service in violation of a law that applies to you, including HIPAA or a similar law, is a material breach of the Terms of Service that ends your right to use that Service for that use, at your sole risk and under your indemnity (Sections 9.6 and 11 of the Terms of Service).

10.2 Legal Bases (EEA, United Kingdom, and Switzerland). Where the General Data Protection Regulation ("GDPR"), the UK GDPR, or the Swiss Federal Act on Data Protection applies, PostureCo processes Personal Information: to perform its contract with you and provide the Services you request, such as account, subscription, and support information; to comply with its legal obligations, such as tax, accounting, and breach-notification duties; for its legitimate interests in operating, securing, supporting, and improving the Services, enforcing its terms (including the location rules in Section 10.1), and communicating with professional customers about the Services, where those interests are not overridden by your rights; and with your consent, such as for optional cookies (Section 4). Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal. PostureCo shares the business, account, and contact information described in Section 7.1 with its Partners to perform its contract with you when you use integrated products and services, and otherwise for its and its Partners' legitimate interests in offering professional customers related education, seminars, research, products, services, and events. You may object at any time to sharing for those legitimate interests (Sections 7.1 and 10.3). Where the law requires your consent for that sharing or for a Partner's marketing to you, PostureCo shares your information for that purpose only with your consent.

10.3 Your Rights. Depending on where you live, including in the European Economic Area, the United Kingdom, Switzerland, Brazil, Canada, and Australia, you may have the right to access the Personal Information PostureCo holds about you; to correct it; to have it deleted; to restrict or object to its processing, including processing based on legitimate interests and processing for direct marketing; to receive it in a portable format; and to withdraw consent. To exercise these rights, contact info@postureco.com. PostureCo will verify the identity and authority of the requester (for deletion of data stored on PostureCo's servers, as described in Section 6) and will respond within the time required by applicable law, which is generally one (1) month under the GDPR and the UK GDPR. Requests concerning patient or client records must be directed to the professional who collected them.

10.4 International Transfers. Where applicable law requires a transfer mechanism for Personal Information transferred to the United States, PostureCo relies on a mechanism permitted by that law, such as standard contractual clauses approved by the relevant authority, or on an exception permitted by that law, such as where the transfer is necessary to perform a contract with you. You may obtain a copy of the safeguards PostureCo relies on by contacting info@postureco.com.

10.5 Complaints. If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to lodge a complaint with a data protection supervisory authority, such as the authority in the country where you live or work, the UK Information Commissioner's Office, or the Swiss Federal Data Protection and Information Commissioner. Residents of other countries may have a similar right under their local laws. PostureCo encourages you to contact info@postureco.com first so that it can try to resolve your concern.

10.6 Roles; Data Processing Agreement. For patient and client information that a professional user uploads to, or collects through, PostureCo Cloud Services (including RemoteScreen®) or PostureScribe.AI, or otherwise sends to PostureCo, the professional user is the controller and PostureCo is a processor acting on the professional user's behalf and instructions, as set out in the applicable PostureCo agreements, except where the law requires otherwise. PostureCo has no access to patient or client information kept only on a professional user's own device (Section 2.2); separately, PostureCo automatically collects the anonymized and aggregated technical and usage data described in Section 2.3, which contains no PHI and identifies no one. For the patient and client information PostureCo handles for a professional user as this Section describes, PostureCo acts as a service provider or processor under U.S. state privacy and consumer-health-data laws, such as the Washington My Health My Data Act (Section 2.5), and, where an executed BAA is in effect, as a business associate under HIPAA (Section 2.2). PostureCo is the controller of the information it handles for its own purposes, such as account, billing, support, website, and security information, which this Privacy Policy describes. A separate data processing agreement is available on request to info@postureco.com; it is the professional user's responsibility to request one if it needs one, and none is in effect until it is fully executed by both the professional user and PostureCo. Until then, the processor terms in Section 8.3 of the PostureCo Cloud Services Agreement apply where the law requires them. The professional user is solely responsible for having a lawful basis for its processing, for giving the notices and obtaining the consents the law requires (including explicit consent for health data where required), for choosing the correct region for its PostureCo Cloud Services data (Section 5.2), and for determining whether it may use the Services under the laws that apply to it (Section 10.1). Patients and clients should consult the professional user's own privacy notice and direct their requests to the professional user.

10.7 Other Information. Providing the account and subscription information that PostureCo asks for when you subscribe is necessary to enter into and perform PostureCo's contract with you; without it, PostureCo may be unable to provide the Services. Providing other information, such as a contact-form message or consent to optional cookies, is voluntary. PostureCo does not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. Section 6 describes how long PostureCo keeps information.

11. CHILDREN#

PostureCo's websites and its products and services for professionals are intended for adults, and PostureCo does not knowingly collect Personal Information from individuals under eighteen (18) years of age, except as this Section describes for RemoteScreen®. RemoteScreen® is not directed to children under thirteen (13), and PostureCo does not knowingly collect personal information directly from a child under thirteen (13). For a child under thirteen (13), a parent or legal guardian must complete RemoteScreen on the child's behalf; the child must not use it on their own. Minors aged thirteen (13) to seventeen (17) may use RemoteScreen only with a parent's or legal guardian's permission and as the Provider allows. PostureCo handles information about a minor submitted through RemoteScreen only on the Provider's behalf, as Section 5.3 and the RemoteScreen Patient App Privacy Policy describe. Professionals using the Services are solely responsible for obtaining any required parental or guardian consent when assessing or inviting minors. If you believe a child under thirteen (13) has used RemoteScreen on their own, or has provided information through it without a parent's or legal guardian's involvement and consent, contact the Provider or info@postureco.com, and PostureCo will work with the Provider to take the steps the law requires.

12. NO MEDICAL ADVICE#

The Services are not medical devices, are not regulated by the U.S. Food and Drug Administration, and do not provide medical advice. All outputs are informational only and do not establish a standard of care.

13. ARTIFICIAL INTELLIGENCE, IMAGING, AND DOCUMENTATION#

13.1 AI-Enabled Services and AI Providers. The Services may include artificial intelligence, machine learning, computer vision, imaging analysis, analytics, and documentation or scribe functionality, including PostureScribe.AI and RemoteScreen's AI-Guided Health History. PostureCo's primary AI provider is SpaceXAI LLC, the company formerly known as xAI (X.AI) and now part of SpaceX ("SpaceX AI"), which provides AI services to PostureCo under a signed Business Associate Agreement and with zero data retention: SpaceX AI does not retain the data it processes for PostureCo. PostureScribe.AI uses SpaceX AI for speech-to-text transcription of dictation and recordings and to generate documentation with a large language model. The AI-Guided Health History uses SpaceX AI for its voice intake, and PostureCo may also use other AI providers bound by a Business Associate Agreement with PostureCo, such as AWS, for the AI-Guided Health History. PostureCo's fallback AI provider for PostureScribe.AI is Amazon Bedrock, which PostureCo uses inside its own AWS account under its Business Associate Addendum with AWS and which may run third-party foundation models. PostureCo uses Amazon Bedrock's zero-data-retention setting for PostureScribe.AI where the selected model supports it; any retention AWS requires, for example for abuse detection, stays within AWS under PostureCo's Business Associate Addendum with AWS, and AWS states that it does not share that content with the model provider. Under PostureCo's arrangements, neither provider may use PostureScribe.AI inputs or outputs to train its models, and SpaceX AI's enterprise terms state that it will not use customer content to train its models. PostureCo may add, change, or replace AI providers or models at any time without prior notice, except where Section 8.3 of the Cloud Services Agreement or applicable law requires notice, but it sends PHI only to AI providers bound by a Business Associate Agreement (or an equivalent subcontractor agreement) with PostureCo. The PostureScribe.AI User Agreement, including its Third-Party AI Provider Terms, at https://www.postureanalysis.com/legal/posturescribe-ai-agreement/ lists PostureCo's current AI providers and the third-party terms that apply to the use of PostureScribe.AI.

13.2 PHI Safeguards and User Responsibility. PostureScribe.AI sends the AI provider the audio the user records, for transcription, and the exam and assessment findings, notes, prompts, and instructions needed to produce the documentation the user requests. PostureCo designs PostureScribe.AI to send only the information needed for that purpose, consistent with the HIPAA minimum-necessary standard. A BAA covering PostureScribe.AI is available, on the user's request, to healthcare providers, covered entities, and business associates located in the United States, as described in Section 2.2. It is the end user's sole responsibility to determine whether a BAA is required and to request one, and the BAA must be fully executed by both the user and PostureCo before the user uses PostureScribe.AI with any PHI, that is, before any PHI is uploaded, transmitted, recorded, or dictated through it. Use of AI documentation features does not by itself create a BAA. Unless such a BAA is in effect, users are strictly prohibited from inputting, dictating, recording, or transmitting PHI when using AI documentation or scribe features. Each user signs the PostureScribe.AI User Agreement, an acknowledgment and indemnification agreement in which the user confirms that, unless a BAA is in effect, no PHI will be included in any recording or other input to PostureScribe.AI. Even when a BAA is in effect, users should not dictate or enter identifiers that the documentation does not need. Users must obtain every consent the law requires before recording or transcribing any conversation (some states, including Florida and California, require the consent of all parties), and any patient or client consent or authorization required for AI processing. Where an executed BAA is in effect, it governs PostureCo's handling of the PHI it covers. Any disclosure of PHI through such features is solely the responsibility of the user, who agrees to indemnify PostureCo for any resulting claims or liabilities. PostureScribe.AI is currently offered and authorized only inside the United States. Accessing or using it from outside the United States, including through a VPN or other location-masking technology (which Section 10.1 prohibits for all of the Services) and including by anyone using the user's device or account, is not allowed or authorized by PostureCo and is a material breach of Section 4 of the Terms of Service and of Section 3.2 of the PostureScribe.AI User Agreement, until PostureCo formally releases PostureScribe.AI outside the United States by publishing updated terms or a written release notice on its website or in the Services; no other statement, including one by PostureCo support or sales personnel, releases it. Anyone who uses PostureScribe.AI outside the United States, or circumvents this restriction, does so entirely at their own risk and must defend, indemnify, and hold harmless PostureCo as Section 3.2 of the PostureScribe.AI User Agreement provides; PostureCo's failure to detect or block such use does not excuse it, and nothing in this Privacy Policy permits it.

13.3 Audio Processing. Audio recordings used for documentation are processed transiently, and PostureCo's copies are deleted as soon as the user signs off on, or generates, the documentation, as described in the PostureScribe.AI User Agreement. PostureCo does not retain or access exported recordings. A recording, note, or other documentation that you export, or that remains in the app on your device, and any copy of it that your device or a service you connect makes, including in a Third-Party Backup Service such as Apple iCloud Backup, iCloud Drive, or Google Drive, is under your control and responsibility (Section 5.4).

13.4 Analytics; No AI Training on Customer Data. PostureCo may use and keep the anonymized and aggregated technical and usage data that it collects automatically as Section 2.3 describes, including after an account or subscription ends, only to operate, maintain, secure, support, and improve the Services, including analytics and aggregate statistics about how the Services are used that identify no individual or customer. PostureCo does not use that data to train or develop artificial intelligence models and does not license or sell it, other than as part of a transaction described in Section 7.2 (for example, a merger or sale of PostureCo's business). PostureCo does not create de-identified data from the patient and client information it handles for professional users, does not use that information to train or develop artificial intelligence models, and does not license or sell de-identified data made from it, except under a separate written agreement with the professional user for that purpose (for example, a beta-testing, research, or data-sharing agreement, which PostureCo enters into only with beta testers and research participants who choose to sign one), and then only as that agreement, any executed BAA (Section 2.2), and applicable law permit. Any de-identified patient information derived from PHI that PostureCo discloses, licenses, or sells under such an agreement has been de-identified under the HIPAA standard using the safe-harbor method (45 C.F.R. § 164.514(b)(2)) or the expert-determination method (45 C.F.R. § 164.514(b)(1)). De-identified data that meets this Section 13.4 is not Personal Information or patient or client information for purposes of this Privacy Policy (Section 2.3), and this Section 13.4 governs its use and disclosure. PostureCo maintains and uses de-identified data only in de-identified form, does not attempt to re-identify it except as the law permits, and, where applicable law requires (for example, California Civil Code Section 1798.148), contractually prohibits anyone to whom it discloses, licenses, or sells de-identified data from re-identifying it. PostureCo accesses identifiable patient and client information only to provide, secure, and support the Services, as the professional user authorizes, as Section 8.7 of the Terms of Service describes, or as the law requires.

13.5 Ownership and Reliance. All AI models, imaging models, and documentation models, all improvements to and derivatives of them, and PostureCo's software, templates, and other technology used to produce outputs are the exclusive intellectual property of PostureCo. PostureCo's ownership of that technology does not make PostureCo the owner of the patient and client information in an output or of the documentation a professional user adopts as its own; that information remains the professional user's data (Section 6 of the Terms of Service), and PostureCo handles it only as this Privacy Policy (including Sections 2.2, 10.6, and 13.4) and any executed BAA or data processing agreement allow. AI-generated outputs are assistive and informational only, may contain errors, and must be independently reviewed by the user. AI outputs do not establish a standard of care.

14. DISCLAIMER OF WARRANTIES#

ALL SERVICES AND DATA ARE PROVIDED "AS IS," "AS AVAILABLE," AND "WITH ALL FAULTS," WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED.

15. LIMITATION OF LIABILITY#

TO THE MAXIMUM EXTENT PERMITTED BY FLORIDA LAW, POSTURECO SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, OR PUNITIVE DAMAGES, INCLUDING LOSS OF DATA, PATIENT CLAIMS, OR REGULATORY PENALTIES.

16. CHANGES TO THIS PRIVACY POLICY#

PostureCo may modify, update, revise, or replace this Privacy Policy at any time, in its sole discretion. Changes are effective immediately upon posting of the revised Privacy Policy, and the "Last Updated" date above will reflect the current version. Your continued use of the Services after posting constitutes acceptance of the revised Privacy Policy. However, if PostureCo makes a material change to how it uses or discloses Personal Information it has already collected, it will give notice of the change before applying it to that information and will obtain any consent that applicable law requires.

17. GOVERNING LAW, JURISDICTION AND VENUE#

This Privacy Policy shall be governed by and construed in accordance with the laws of the State of Florida, without regard to conflict-of-law principles. In the event of any dispute concerning the Services or these policies, the user agrees that jurisdiction shall be proper in the State of Florida and that the sole venue for such disputes shall be the state or federal courts located in or having jurisdiction over Pasco County, Florida, except as otherwise provided by the arbitration provisions of the PostureCo Terms of Service.

18. TEXT MESSAGES AND PHONE CALLS#

18.1 Your Choice. On PostureCo's website contact form, telephone calls and text messages are separate, optional choices: PostureCo calls or texts you at the number you give only if you check the matching box, which is never checked in advance. Text messages go only to numbers you identify as mobile numbers. Consent to text messages is not a condition of any purchase, and giving a telephone number alone, or accepting PostureCo's Terms of Service, is not consent to receive text messages.

18.2 What PostureCo Sends. Text messages are informational and customer-care messages about your request, your account, and support for the Services, such as replies, follow-up questions, and scheduling a call. PostureCo does not send marketing text messages under this consent and would ask for your separate consent first. Message frequency varies with your request. Message and data rates may apply.

18.3 Opting Out and Help. Reply STOP to any text message to stop receiving them (QUIT, END, REVOKE, OPT OUT, CANCEL, UNSUBSCRIBE, and STOP ALL also work), or HELP for help. You may also withdraw your permission for calls or text messages at any time by contacting PostureCo as described in Section 19 or by any other reasonable means, and PostureCo will honor it promptly and no later than the law requires. PostureCo may send one message confirming that you have opted out.

18.4 Your Mobile Number Stays Private. PostureCo never sells, rents, or shares your mobile telephone number, your text-messaging opt-in, or your consent with its Partners, affiliates, or any other third parties, for marketing or for any other purpose. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent are excluded from every other category of disclosure in this Privacy Policy, including Sections 7.1 and 7.2, and will not be shared with any third parties. PostureCo's own service providers, such as its customer-service system, its scheduling service, and its text-messaging provider, receive them only to deliver PostureCo's messages and support you on PostureCo's behalf; they may not use them for any other purpose and act for PostureCo, not as third parties.

18.5 No Patient Information. Text messages, voicemail, and the website contact form are not secure channels for health information. Do not send protected health information or other patient or client information through them.

18.6 Records. PostureCo keeps a record of your permission (its date and time and the wording you agreed to) and of any opt-out for as long as needed to honor your choice and to show compliance with applicable law.

19. CONTACT INFORMATION#

PostureCo, Inc. 3152 Little Road, Suite 161, Trinity, FL 34655 Email: info@postureco.com · Phone: +1-866-577-7297 Current version available at: https://www.postureanalysis.com/privacy-policy/

PostureCo's HIPAA Compliance Statement is available at: https://www.postureanalysis.com/legal/hipaa-compliance-statement/