LAST UPDATED: October 21, 2026
IMPORTANT NOTICE REGARDING CHANGES
PostureCo, Inc. reserves the right to modify, update, revise, or replace this Agreement at any time, in its sole discretion, without prior notice. Any changes are effective immediately upon posting. Your continued use of the Cloud Services constitutes acceptance of the revised Agreement.
This PostureCo Cloud Services Agreement ("Agreement") governs your purchase, access to, and use of PostureCo Cloud Services.
"PostureCo Cloud Services" (the "Cloud Services") means the optional, subscription-based cloud services that PostureCo offers, which were formerly branded as SyncScreen, including:
"Software" means the PostureScreen® software application and any other PostureCo application, website, or web interface through which you or your clients or patients access or use the Cloud Services, including the PostureCo Cloud web portal and RemoteScreen.
PostureScribe.AI® is governed by the PostureScribe.AI® User Agreement, Indemnification, and Terms of Service (the "PostureScribe.AI User Agreement"), available at https://www.postureanalysis.com/legal/posturescribe-ai-agreement/. This Agreement also applies to any PostureScribe.AI data that is stored in, backed up to, or synchronized through the Cloud Services.
PostureRay® on PostureCo Cloud requires a separate PostureRay® subscription and is also governed by PostureRay's own Product-Specific Terms (as defined in the Terms of Service). This Agreement applies to PostureRay data stored in the Cloud Services in addition to those terms. If they conflict as to PostureRay, PostureRay's own terms control.
The Cloud Services are owned and operated by PostureCo, Inc., a Florida corporation ("PostureCo," "we," "us," or "our").
BY CLICKING TO ACCEPT THIS AGREEMENT, BY SIGNING IT ELECTRONICALLY WHERE POSTURECO REQUIRES A SIGNATURE, OR BY PURCHASING, REGISTERING FOR, ACCESSING, OR USING THE CLOUD SERVICES, YOU AGREE TO BE LEGALLY BOUND BY THIS AGREEMENT AND BY THE TERMS OF SERVICE AND PRIVACY POLICY THAT IT INCORPORATES BY REFERENCE (SECTION 2), AND YOU ACKNOWLEDGE POSTURECO'S HIPAA COMPLIANCE STATEMENT. IF YOU DO NOT AGREE, DO NOT USE THE CLOUD SERVICES.
Your acceptance by purchasing, registering for, accessing, or using the Cloud Services applies by default, even where no click-through or signature is presented to you. PostureCo may also require you to accept this Agreement expressly at any time, by a click-through (a checkbox or button) when you sign up for the Cloud Services, when you log in to the PostureCo Cloud web portal or the Software, or after an update or release of the Software, and, where PostureCo requires it, by an electronic signature. Express acceptance is in addition to acceptance by use, and its absence does not mean that you have not accepted; if you decline it, you must stop using the Cloud Services, and PostureCo may restrict your access until you accept. Electronic acceptance has the same effect as a handwritten signature, and PostureCo may keep records of acceptances as evidence of them, as Section 1 of the Terms of Service describes.
You represent and warrant that you are at least eighteen (18) years of age and that you have the legal authority to bind yourself or the entity on whose behalf you are using the Cloud Services. If you accept this Agreement on behalf of an entity, "you" includes that entity.
Clients or patients who use RemoteScreen only to send information to you at your invitation are not PostureCo's customers and are not parties to this Agreement. The RemoteScreen® Patient App Privacy Policy (Section 7.5) describes how PostureCo handles the information they submit, and Section 4 (Prohibited Uses) of the Terms of Service and PostureCo's intellectual-property rights still apply to their use of RemoteScreen. As between you and PostureCo, you are responsible for inviting them and for the information they submit to your account, as Sections 6 and 7.5 describe.
This Agreement supplements and incorporates by reference PostureCo's Terms of Service and End User License Agreement (the "Terms of Service"), available at https://www.postureanalysis.com/legal/terms-of-service/, and PostureCo's Privacy Policy, available at https://www.postureanalysis.com/privacy-policy/. Capitalized terms used but not defined in this Agreement have the meanings given to them in the Terms of Service. Sections 8 and 9 of the Terms of Service, which address HIPAA and Business Associate Agreements for all of PostureCo's Services, apply to the Cloud Services together with Section 7 of this Agreement.
PostureCo's HIPAA Compliance Statement, available at https://www.postureanalysis.com/legal/hipaa-compliance-statement/, and the RemoteScreen® Patient App Privacy Policy, available at https://www.postureanalysis.com/legal/remotescreen-patient-privacy-policy/, are notices that describe PostureCo's practices. They are not contracts, do not create warranties, and do not amend this Agreement, the Terms of Service, or any Executed BAA (Section 7.2).
In the event of a conflict between this Agreement and any other PostureCo agreement, this Agreement shall control solely with respect to the Cloud Services, except that: (a) an Executed BAA controls as to PHI, as Section 7.4 provides; (b) a data processing agreement executed under Section 8.3, and the Standard Contractual Clauses where Section 8.4 makes them apply, control as to the personal data they cover; (c) subject to clauses (a) and (b), the PostureScribe.AI User Agreement controls as to the PostureScribe.AI features themselves, and its Section 6 (Third-Party AI Provider Terms) controls as to the RemoteScreen AI-Guided Health History, as Section 4.4 provides; (d) PostureRay's own terms control as to PostureRay, as Section 1 provides; and (e) Section 2.2 of the Terms of Service (Apple App Store terms) controls as to a PostureCo app obtained from the Apple App Store, as Sections 1.1 and 2.2 of the Terms of Service provide. Provisions that address the same subject without directly conflicting apply together. Subject to clauses (a) and (b), a provision of the Terms of Service that gives PostureCo greater protection, such as a broader disclaimer, limitation of liability, or indemnity, does not conflict with this Agreement and applies to the Cloud Services.
The Cloud Services are optional and are not required to use PostureScreen® or its other local features. Some features, including RemoteScreen and the PostureCo Cloud web portal, are available only with an active Cloud Services subscription, and features, limits, and availability vary by plan and by location. For example, the RemoteScreen AI-Guided Health History is available in the USA only at this time and only with a Cloud Services Platinum plan or higher, and using it from outside the United States is prohibited (Section 7.5), while RemoteScreen posture photo and movement video uploads are available worldwide on every Cloud Services plan. PostureCo may change its plans, features, limits, and availability at any time.
The Cloud Services are provided as a convenience only and do not constitute a complete, fail-safe, or exclusive data backup solution. You acknowledge that you remain solely responsible for maintaining independent and redundant backups of your data, using only backup methods that meet your legal obligations (Section 10).
4.1 AMAZON WEB SERVICES; REGIONAL HOSTING; YOU CHOOSE YOUR REGION. The storage, backup, and synchronization infrastructure of the Cloud Services runs on Amazon Web Services ("AWS"), under a signed Business Associate Addendum between PostureCo and AWS. Cloud Services data, including PHI, is stored and processed in AWS services that AWS designates as HIPAA-eligible; information sent to an AI provider for the artificial intelligence features described in Section 4.4 is processed by that provider under its own Business Associate Agreement with PostureCo (Section 6 of the PostureScribe.AI User Agreement). PostureCo operates no data centers of its own. AWS provides the physical and environmental security of its data centers, which are covered by AWS's own independent attestations, such as SOC and ISO reports.
PostureCo uses regional AWS infrastructure. During setup, you choose, directly in the Software, the location (AWS region) where your Cloud Services data is stored, from the regions that PostureCo offers at the time (for example, the United States, Europe, or Asia, where offered). PostureCo stores your Cloud Services data in the region you select and relies on your selection. If the Software does not offer you a choice, or you do not make one, your Cloud Services data is stored in the United States. PostureCo does not promise that any particular region, or a region in or for every country, is or will remain available, or that storage in any region satisfies any data-residency or data-localization requirement that applies to you, and PostureCo may add, change, or retire regions. PostureCo may move Cloud Services data out of the region where it is stored if that region becomes unavailable or is retired, or as needed to provide, secure, or support the Cloud Services or to comply with law; where applicable data protection law or a data processing agreement limits such a move, PostureCo will make it only as that law or agreement permits. Otherwise, PostureCo does not move Cloud Services data to another region on its own initiative; it moves data between regions only at your verified request, as described below in this Section 4.1.
Choosing the correct region for your location, and for the laws that apply to you and to your clients and patients (including data-residency, data-protection, and health-information laws such as HIPAA, the GDPR, and the UK GDPR), is your sole responsibility. PostureCo has no obligation to determine, verify, or monitor where you (or your clients or patients) are located, and it cannot reliably tell, for example because a user may connect through a virtual private network (VPN) in breach of Section 8.5; any location or VPN check it chooses to make is for its own protection, may be inaccurate, and does not make PostureCo responsible for your choice of region. Except as Section 8.3, the Standard Contractual Clauses (Section 8.4), or applicable law requires, PostureCo has no obligation to ask where you are located, to recommend a region, or to tell you that a region may be wrong for you.
If you selected the wrong region, set up Cloud Services data outside your country by mistake, or later need your Cloud Services data moved to another region that PostureCo offers, you must contact PostureCo support promptly once you realize it, by email to info@postureco.com, toll free at 866-577-7297 (+1-866-577-7297 from outside the United States), or through the contact form at https://www.postureanalysis.com/postureco-support/, and you must not include any PHI in your request. After verifying your request (as Section 6 of the Privacy Policy describes), PostureCo will assist you: it will manually move your Cloud Services data to the region you designate from those that PostureCo then offers and delete it from the region it is moved from, including a region where it was created by mistake, within a reasonable time, subject to secure backup retention cycles (copies in backups are kept beyond use, meaning that they are not restored to the Cloud Services or otherwise used except as you direct or as the law requires, expire on their normal cycle, and remain protected until then; on request, PostureCo will tell you when they are expected to expire). If no region that PostureCo then offers is suitable for you, PostureCo's only obligation under this paragraph is to delete the data at your verified request (Section 5). PostureCo does not guarantee any completion time, and the affected Cloud Services may be limited or unavailable while the move takes place. Until the move is completed, and for any period before you tell PostureCo, you are solely responsible for your Cloud Services data being stored and processed in the region you selected (or in the United States, if you did not select one), including any legal consequence of it (Section 13). To the maximum extent permitted by law, and except for PostureCo's own obligations under an Executed BAA, Section 8.3, the Standard Contractual Clauses, or applicable law (including acting on your verified request within a reasonable time), PostureCo has no liability for that storage or processing.
Whatever region you select, PostureScribe.AI and the RemoteScreen AI-Guided Health History are offered and authorized only in the United States at this time, and using either of them from outside the United States is a breach of the Terms of Service (Section 8.1); the information sent to an AI provider for them is processed in the United States (Sections 4.4 and 7.5); and PostureCo's personnel and service providers in the United States may access your Cloud Services data as needed to provide, secure, and support the Cloud Services (Sections 4.2 and 8.1).
AWS stores Cloud Services data redundantly across multiple availability zones within the AWS region where it is stored. That redundancy is part of how the Cloud Services operate. It is not a separate backup that you control, and it does not replace your own backups (Sections 3 and 10).
4.2 YOUR CONTROL; BLIND STORAGE; WHEN POSTURECO HAS ACCESS. Data is uploaded to the Cloud Services only after you subscribe to and set up the Cloud Services in the Software (including choosing your region, as Section 4.1 describes), or when a client or patient whom you have invited to RemoteScreen submits information to your account. Once you have set up the Cloud Services, the Software may upload client and patient records automatically whenever you add or change them, as its features and settings provide; those uploads are made at your direction. Unless you use PostureCo Cloud Services or PostureScribe.AI (or choose to send records to PostureCo yourself), PostureCo never has access to your patient or client records. Separately, as described in Section 6 of the Terms of Service and Section 2.3 of the Privacy Policy, PostureCo automatically collects anonymized, aggregated technical and usage data and de-identified measurement data that contain no PHI and identify no one. You also authorize PostureCo to create de-identified data from Cloud Services data, for PHI only as 45 C.F.R. § 164.514 allows and only as an Executed BAA permits, and for other personal data only as applicable law and your agreements with PostureCo (including any data processing agreement under Section 8.3) permit, and to use and disclose (including by license or sale) de-identified and aggregated data, which identify no one, as Section 6 of the Terms of Service and Sections 2.3 and 13.4 of the Privacy Policy allow, including to improve PostureCo's products and to develop artificial intelligence models. PostureCo will not create de-identified data under this authorization from records first uploaded or submitted before October 15, 2026, unless you have affirmatively accepted (for example, by clicking to accept) a version of the Terms of Service, this Cloud Services Agreement, or the PostureScribe.AI User Agreement dated October 15, 2026 or later. This authorization does not affect the anonymized, aggregated, and de-identified data that PostureCo collects automatically as described above. PostureCo accesses identifiable Cloud Services data only as the next paragraph describes.
In the ordinary course of providing the Cloud Services, PostureCo's personnel do not view, review, or interpret your uploaded content, and PostureCo's systems process it automatically only as Section 5 (blind storage) describes. PostureCo's personnel and service providers may access stored data only as needed to provide, maintain, secure, and support the Cloud Services (for example, when you ask for support), to investigate or address a security incident, a technical problem, or a suspected breach of this Agreement or the Terms of Service, to comply with law or legal process, as Section 8.7 of the Terms of Service describes, as an Executed BAA or a data processing agreement permits, or as you otherwise direct or authorize. Production access is limited to designated senior technology staff. Section 21 governs any transfer of Cloud Services data to a successor.
4.3 SERVICE PROVIDERS AND SUBPROCESSORS. PostureCo uses service providers, also called subprocessors, to operate the Cloud Services, including AWS for hosting, storage, backup, and synchronization infrastructure and, for the artificial intelligence features described in Section 4.4, the AI providers identified in Section 6 of the PostureScribe.AI User Agreement. Every third-party vendor whose services could create, receive, maintain, or transmit PHI on PostureCo's behalf has signed a Business Associate Agreement with PostureCo, and each new vendor of that kind must sign one before it is engaged. Other service providers are bound by written agreements that restrict their use of the information they receive. PostureCo may add, replace, or remove service providers at any time, without prior notice except where Section 6, Section 8.3, Section 8.4, or applicable law requires notice, while maintaining equivalent or better protection. A current list of the service providers that may process PHI or other personal data about your clients or patients in the Cloud Services is available on request to info@postureco.com.
4.4 ARTIFICIAL INTELLIGENCE FEATURES. Some features that work with the Cloud Services use artificial intelligence provided by third parties:
SpaceX AI, PostureCo's primary AI provider, provides AI services to PostureCo under a signed Business Associate Agreement and with zero data retention, meaning that it does not retain the data it processes for PostureCo. PostureCo's fallback AI provider for PostureScribe.AI is Amazon Bedrock, which PostureCo uses inside its own AWS account under its Business Associate Addendum with AWS. For the AI-Guided Health History, PostureCo may also use other AI providers bound by a Business Associate Agreement with PostureCo, such as AWS, including Amazon Bedrock. Under PostureCo's arrangements, neither SpaceX AI nor AWS may use PostureScribe.AI inputs or outputs to train its models, and SpaceX AI's enterprise terms, which apply to the content PostureCo sends it for PostureScribe.AI and for the AI-Guided Health History, state that it will not use customer content to train its models. PostureCo sends PHI only to AI providers bound by a Business Associate Agreement (or an equivalent subcontractor agreement) with PostureCo, and designs these features to send an AI provider only the information needed for the task requested. PostureCo may add, change, or replace AI providers or models at any time without prior notice, except where Section 6, Section 8.3, Section 8.4, or applicable law requires notice.
AI output, including transcripts, generated documentation, and intake results, may be inaccurate, incomplete, fabricated ("hallucinations"), or offensive. You must review, edit, and verify every AI output before you use or rely on it. AI output is not medical advice, a diagnosis, or a treatment recommendation. The AI-Guided Health History does not give medical advice and is not for emergencies. Before the intake, RemoteScreen asks your client or patient to confirm that they are not having a medical emergency, that the AI does not give medical advice, and that they consent to being recorded for transcription; those prompts do not replace any notice, consent, or authorization that you are required to give or obtain (Section 7.5). PostureCo's personnel do not monitor or review RemoteScreen submissions or AI-Guided Health History results, and PostureCo is not responsible for responding to anything they contain. You are solely responsible for reviewing them and for any follow-up. You must use the AI features only in compliance with this Agreement, the PostureScribe.AI User Agreement (for PostureScribe.AI), and applicable law. Section 6 of the PostureScribe.AI User Agreement (Third-Party AI Provider Terms), including its disclaimer of warranties for AI output (Section 6.5), its prohibited uses (Section 6.6), your responsibility for Inputs (Section 6.7), and the third-party terms and policies listed in its Section 6.8, also applies to your use of the AI-Guided Health History, including everything your clients or patients provide to it, as if set out in this Agreement, whether or not you use PostureScribe.AI. For that purpose, its references to the AI Features include the AI-Guided Health History, its references to Section 1.1 of the PostureScribe.AI User Agreement are read as references to Section 7.3 of this Agreement, and its references to Section 1.9 of that agreement are read as references to Sections 6 and 7.5 of this Agreement.
Data transmitted to and stored within the Cloud Services is encrypted in transit using TLS and at rest using AES-256 encryption.
PostureCo maintains administrative, physical, and technical safeguards designed to protect Cloud Services data. In addition to encryption, they currently include:
PostureCo uses and discloses customer PHI in the Cloud Services only as an Executed BAA permits or the law requires (and, for PHI uploaded without an Executed BAA, as Section 7.3 allows). PostureCo's service providers that receive PHI act for PostureCo under Business Associate Agreements with PostureCo.
PostureCo's Chief Executive Officer and Chief Technology Officer are its designated Privacy and Security Officers. PostureCo may change its safeguards and service providers at any time while maintaining equivalent or better protection. The descriptions in Sections 4 and 5 of PostureCo's hosting, regions, redundancy, service providers, AI providers (including their agreements with PostureCo and their own published terms), and safeguards describe PostureCo's current practices and arrangements. They are not a warranty or a guarantee of any third party's performance; PostureCo does not operate the infrastructure of AWS or the systems of any AI provider; and PostureCo may change these practices and arrangements as those Sections allow. NO METHOD OF TRANSMISSION OR STORAGE IS COMPLETELY SECURE, AND POSTURECO DOES NOT GUARANTEE THE SECURITY OF ANY DATA OR THAT UNAUTHORIZED ACCESS, USE, DISCLOSURE, OR LOSS WILL NOT OCCUR. PostureCo will notify you of a breach of security affecting your Cloud Services data as and when applicable law, an Executed BAA, or a data processing agreement requires.
In the ordinary course of providing the Cloud Services, PostureCo's personnel do not view, review, or interpret your uploaded content (blind storage). PostureCo's systems process it automatically only to provide, secure, and support the Cloud Services, to comply with law, and, as Section 4.2 describes, to create or collect de-identified, anonymized, and aggregated data. Processing that you, or a client or patient you invite, start through the Software (such as synchronization or the artificial intelligence features described in Section 4.4) is performed automatically, at your direction, as part of providing the Cloud Services, and is not a review of your content by PostureCo's personnel. PostureCo's personnel and service providers access stored data only as Section 4.2 describes.
Upon receipt of a notarized written request (or equivalent legal attestation), which PostureCo requires in order to confirm that a deletion request is legitimate and authorized, PostureCo will permanently delete stored data from its servers, subject to reasonable processing time, secure backup retention cycles, and any retention that applicable law or legal process requires. Where a law that applies to a request does not permit PostureCo to require notarization, or requires PostureCo to bear its cost, PostureCo will verify the request by another reasonable method that law permits (Section 6 of the Privacy Policy). Where the Software lets you delete data yourself, you are solely responsible for any data you delete.
As Section 7 of the Terms of Service provides, any data stored in the Cloud Services may be permanently deleted thirty (30) days after termination or expiration of the applicable subscription, without notice and without liability. You are solely responsible for retrieving any data you wish to keep before then. PostureCo does not provide archival services and is not a medical-records custodian, and the Cloud Services are not a system of record for any legal record-retention obligation (Section 11).
You are solely and exclusively responsible for:
RemoteScreen is not directed to children under thirteen (13), and PostureCo does not knowingly collect personal information directly from a child under thirteen (13).
PostureCo does not provide legal advice and makes no representations regarding your compliance obligations. You are strongly advised to consult your own legal counsel.
Where a U.S. state privacy or consumer-health-data law applies to personal information about your clients or patients that PostureCo processes for you through the Cloud Services, PostureCo acts as your service provider or processor (as that law defines those terms) and, to the extent that law requires: processes that information only to provide the Cloud Services to you and for the other purposes that this Agreement and that law permit; does not sell or share it (as that law defines those terms) or use it for targeted advertising; does not retain, use, or disclose it outside the direct business relationship between you and PostureCo, or combine it with personal information from other sources, except as that law permits; provides the level of privacy protection that law requires; notifies you if it determines that it can no longer meet its obligations under that law; taking into account the nature of the processing, assists you by appropriate technical and organizational measures, insofar as possible, in responding to requests from consumers exercising their rights under that law and in meeting your other obligations under it; binds each person who processes that information for PostureCo to a duty of confidentiality; engages a subcontractor to process it only under a written contract that binds the subcontractor to the obligations that law places on service providers or processors, and tells you of its subcontractors through the list available under Section 4.3 and, where that law requires notice of a new subcontractor, as Section 8.3 describes; and permits you, on written notice, to take reasonable and appropriate steps to help ensure that it uses that information consistently with your obligations under that law and to stop and remediate any unauthorized use. You will tell PostureCo of any consumer request under that law with which PostureCo must comply and give PostureCo the information it needs to comply with it. To the extent that the anonymized, aggregated, and de-identified data described in Section 4.2 meets that law's definition of de-identified or aggregate information, it is not subject to this paragraph; PostureCo maintains and uses that data only in de-identified form, does not attempt to re-identify it except as that law permits, and, where that law requires, contractually prohibits anyone to whom it discloses that data from re-identifying it.
7.1 NOT A BUSINESS ASSOCIATE BY DEFAULT. PostureCo is not a Business Associate by default. A Business Associate Agreement ("BAA") is not automatic: purchasing, accessing, or using the Cloud Services does not by itself create a BAA. PostureCo agrees to act as your business associate only under a fully executed BAA that covers the Service in question (for the Cloud Services, an Executed BAA, as Section 7.2 defines it), and you must not provide PHI to PostureCo without one (Section 7.3 of this Agreement and Section 8.4 of the Terms of Service). Unless you use PostureCo Cloud Services or PostureScribe.AI (or choose to send records to PostureCo yourself), PostureCo never has access to your patient or client records (Section 4.2), and PostureCo does not enter into a BAA for the use of its mobile applications alone (Section 8.3 of the Terms of Service).
7.2 WHO MAY REQUEST A BAA; YOUR SOLE RESPONSIBILITY. PostureCo enters into BAAs only on the user's request, and only with healthcare providers, covered entities, and business associates located in the United States that use the Cloud Services (including RemoteScreen and PostureRay® on PostureCo Cloud), PostureScribe.AI, or the cloud backup and online ViewBox included in a PostureRay® technical support plan (Section 8.2 of the Terms of Service). The only exception is that PostureCo may consider a request from a healthcare practitioner outside the United States who wishes to use the Cloud Services, case by case and in its sole discretion, as Section 8.5 of the Terms of Service and Section 8.6 of this Agreement describe; identifying, requesting, and supplying any agreement that practitioner's law requires is the practitioner's sole responsibility. If you are a U.S.-based healthcare provider, facility, covered entity, or business associate, it is your sole responsibility to determine whether a BAA is required and, if it is, to initiate and request a BAA from PostureCo and to have it fully executed by both you and PostureCo before any PHI is uploaded, transmitted, recorded, or dictated, which includes before you turn on cloud backup or synchronization for records that contain PHI, before you use PostureScribe.AI with PHI, and before you invite any patient to RemoteScreen. You may supply your own BAA form for PostureCo's review or ask for PostureCo's standard BAA. Send your request to info@postureco.com or through the contact form at https://www.postureanalysis.com/postureco-support/, and do not include any PHI in it. PostureCo has no obligation to ask whether you need a BAA, to offer one, or to remind you. A request alone does not create a BAA, and no BAA exists unless and until it is fully executed by both you and PostureCo. PostureCo may accept, negotiate, or decline any proposed BAA or term. A BAA between you and PostureCo that both of you have fully executed and that covers your use of the Cloud Services is an "Executed BAA," whether you requested it under this Section 7.2, Section 8.2 of the Terms of Service, or Section 1.8 of the PostureScribe.AI User Agreement. A BAA that covers only PostureScribe.AI or another service, and not the Cloud Services, is not an Executed BAA under this Agreement and does not permit you to upload, store, transmit, record, or dictate any PHI to or through the Cloud Services. Fitness and wellness professionals who are not covered entities or business associates under HIPAA generally do not need a BAA, but deciding whether you need one is your responsibility, and nothing in this Agreement is legal advice.
7.3 NO PHI WITHOUT AN EXECUTED BAA. Unless an Executed BAA is in effect, you must not upload, store, transmit, record, or dictate any PHI to or through the Cloud Services, and you must not send PHI to PostureCo by any other means, including for support, except as Section 8.4 of the Terms of Service allows under a fully executed BAA that covers that means. Because the Software may upload client and patient records automatically once the Cloud Services are set up (Section 4.2), if you are a covered entity or business associate under HIPAA, you must not set up or turn on the Cloud Services on any device or account that holds PHI until an Executed BAA is in effect.
USE OF THE CLOUD SERVICES WITHOUT AN EXECUTED BAA IS AT YOUR SOLE RISK. PostureCo assumes no liability for PHI uploaded without an Executed BAA.
PostureCo has no obligation to detect PHI uploaded in breach of this Section 7.3. If PostureCo learns of such an upload, it may suspend the affected Cloud Services, require you to remove the PHI promptly and in any event within thirty (30) days, or, after notice to you, securely return or delete that PHI, which you agree PostureCo may do without liability, and you remain solely responsible for it.
7.4 WHAT POSTURECO DOES UNDER AN EXECUTED BAA. Under an Executed BAA, and as it provides, PostureCo:
This list summarizes the Executed BAA and does not add to it. To the extent the Executed BAA permits, this Section 7.4 is notice of the ongoing existence of unsuccessful security incidents, such as pings, port scans, and blocked sign-in attempts, that do not result in unauthorized access to, or use, disclosure, modification, or destruction of, PHI, and no further report of them is required.
The Executed BAA controls over any conflicting term of this Agreement, the Terms of Service, or any other PostureCo agreement, but only as to PHI; in all other respects, this Agreement and the Terms of Service control. PostureCo is not a medical-records custodian or a system of record, and you must keep your own records (Section 11).
7.5 REMOTESCREEN AND YOUR PATIENTS. RemoteScreen collects information directly from the clients or patients you invite, such as their name, date of birth, telephone number, email address, posture photos, movement videos, and, where you use the AI-Guided Health History, their spoken answers and intake results, and delivers it to your Cloud Services account. RemoteScreen is drop-off only: your client's or patient's browser cannot read back your records. If you are a U.S. covered entity or business associate, you must have an Executed BAA in effect before you invite any patient to RemoteScreen. You are solely responsible for:
The AI-Guided Health History is available only in the United States at this time. Accessing or using it from outside the United States, whether by you, by anyone using your account, or by a client or patient you invite, and including through a VPN or other location-masking technology, is prohibited and is a breach of this Agreement and of the Terms of Service until PostureCo formally releases it outside the United States, which PostureCo will do only by publishing updated terms or a written release notice on its website or in the Software; no other statement, including one by support or sales personnel, releases it. You must not invite or allow any client or patient who is outside the United States to use the AI-Guided Health History, and you are responsible for your invitees' compliance with this Section 7.5 (Section 13). RemoteScreen's posture photo and movement video features may be used outside the United States, subject to your own legal responsibilities, including your choice of region (Section 4.1) and the laws that apply to you and to your clients and patients. PostureCo may block or disable the AI-Guided Health History for any account, client, or patient, including where it suspects use from outside the United States, without liability, and PostureCo is not responsible for any use of it outside the United States.
PostureCo makes the RemoteScreen® Patient App Privacy Policy available to your clients and patients at https://www.postureanalysis.com/legal/remotescreen-patient-privacy-policy/ and may display or link to it in RemoteScreen. You are responsible for making sure that your clients and patients receive every notice the law requires. That policy does not replace your own notice of privacy practices or any notice, consent, or authorization that you must give or obtain. PostureCo may refer to you any request about RemoteScreen information that it receives from one of your clients or patients, and it is not responsible for responding to that request on your behalf.
7.6 YOUR HIPAA RESPONSIBILITIES; HIPAA COMPLIANCE STATEMENT. Sections 9.1 through 9.4 of the Terms of Service, which set out your HIPAA responsibilities, what applies when a BAA is in effect, and the status of PostureCo's HIPAA Compliance Statement, apply to your use of the Cloud Services. Those responsibilities remain yours even when an Executed BAA is in effect, including your own risk analysis, policies, workforce training, and access controls; using and disclosing only the minimum necessary PHI; the notices you give and the authorizations you obtain; and any breach notifications that HIPAA requires you to give to individuals, the Secretary of the U.S. Department of Health and Human Services, or the media. The HIPAA Compliance Statement (Section 2) describes how PostureCo safeguards health information; it is informational only, does not create a BAA, and does not replace or amend an Executed BAA or this Agreement. No government agency certifies HIPAA compliance, and nothing in this Agreement, the HIPAA Compliance Statement, or any other PostureCo material is a certification or a guarantee that your use of the Cloud Services complies with HIPAA.
8.1 INTERNATIONAL USE AND REGIONAL HOSTING. If you access or use the Cloud Services outside the United States, you are solely responsible for choosing, during setup, the region where your Cloud Services data is stored, and for that choice being correct for your location and for the laws that apply to you and to your clients and patients, as Section 4.1 describes. PostureCo has no obligation to determine, verify, or monitor where you (or your clients or patients) are located; any location or VPN check it chooses to make is for its own protection, may be inaccurate, and does not make PostureCo responsible for your choice of region. PostureCo stores your data in the region you select. If you select the United States, or if no region is selected, your data is stored in the United States, and you acknowledge and agree that it will be transferred to and stored in the United States. If you selected the wrong region, set up data outside your country by mistake, or need your data moved, you must contact PostureCo support promptly, and PostureCo will assist you in moving it and deleting it from the other region, as Section 4.1 describes; until then, the responsibility for where your data is stored remains yours. Even when your data is stored in a region outside the United States, PostureCo's personnel and service providers located in the United States may access it as needed to provide, secure, and support the Cloud Services, subject to Section 4.2. PostureScribe.AI and the RemoteScreen AI-Guided Health History are offered and authorized only in the United States at this time. Accessing or using either of them from outside the United States, including through a VPN or other location-masking technology, is not allowed or authorized by PostureCo, is prohibited, and is a breach of Section 4 of the Terms of Service and of the agreement that governs that feature (Section 3.2 of the PostureScribe.AI User Agreement for PostureScribe.AI, and Section 7.5 of this Agreement for the AI-Guided Health History), until PostureCo formally releases that feature outside the United States as those Sections describe. Any such access or use by you or by anyone using your account or devices is entirely at your own risk, is not excused by any failure of PostureCo to detect or block it, and is covered by your indemnity (Section 13). You must not access or use the Cloud Services through a VPN or other location-masking technology (Section 8.5). You may not use the Cloud Services where doing so would violate U.S. export-control or sanctions laws. If you are a healthcare provider or other professional outside the United States, Section 8.6 also applies to you.
8.2 ROLES UNDER THE GDPR AND SIMILAR LAWS. Where the EU General Data Protection Regulation ("GDPR"), the UK GDPR, the Swiss Federal Act on Data Protection, or a similar law applies, you are the controller of the personal data about your clients or patients that you, or the clients or patients you invite to RemoteScreen, upload to the Cloud Services, and PostureCo processes that personal data as your processor, on your behalf and on your documented instructions. This Agreement, including the storage, access, and transfers that Sections 4.1, 8.1, and 8.4 describe, and your use and configuration of the Cloud Services, including your choice of region, are your documented instructions. PostureCo is the controller of its own account, billing, support, website, and security data, which the Privacy Policy describes.
8.3 DATA PROCESSING TERMS; DATA PROCESSING AGREEMENT. On request to info@postureco.com, PostureCo may provide its standard data processing agreement for signature; PostureCo may accept, negotiate, or decline any other form or any proposed change, case by case and in its sole discretion, and whether or not a separate agreement is signed, this Section 8.3 and Section 8.4 are the processor and transfer terms where the law requires them. If a data processing agreement is executed by both you and PostureCo, it controls over this Section 8.3, to the extent of any conflict, as to the personal data it covers. This Section 8.3 applies where PostureCo processes personal data as your processor and the law requires a contract containing processor terms (such as Article 28 of the GDPR or of the UK GDPR). The subject matter and nature of that processing are the storage, backup, synchronization, display, and transmission of personal data through the Cloud Services and, where you use them, the artificial intelligence features described in Section 4.4; its purpose is to provide the Cloud Services to you; its duration is the term of your subscription, the post-termination period described in Section 5, and any further period for which the data remains in secure backup retention cycles or the law requires PostureCo to keep it; the types of personal data are those that you, and the clients or patients you invite, upload, such as identification and contact details, dates of birth, photographs, videos, voice recordings and transcripts, measurements, notes, and health data; and the data subjects are your clients and patients and any other individuals whose personal data you or they upload. PostureCo will, to the extent that law requires:
Where the law permits, PostureCo may charge reasonable fees for assistance that goes beyond the standard features of the Cloud Services.
8.4 INTERNATIONAL TRANSFERS; YOUR RESPONSIBILITIES. Where the law requires a transfer mechanism for personal data that is transferred to, or accessed from, the United States or another country, PostureCo relies on a mechanism permitted by that law, such as standard contractual clauses approved by the relevant authority, as Section 10.4 of the Privacy Policy describes. Where the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection requires such a mechanism for personal data that you, or the clients or patients you invite to RemoteScreen, transfer to PostureCo through the Cloud Services (including personal data stored in a region outside the United States and accessed from the United States), and no data processing agreement executed under Section 8.3 provides one, the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 (the "Standard Contractual Clauses") are incorporated into this Agreement by reference and apply to that transfer, and by accepting this Agreement you and PostureCo agree to them, as follows:
If the Standard Contractual Clauses conflict with this Agreement, they control as to the transfers they cover; otherwise, this Agreement, including Sections 16 and 17, applies to them to the extent they permit.
You are solely responsible for your lawful basis for processing; for the notices you give and the consents you obtain, including explicit consent to the processing of health data where the law requires it; for any data protection impact assessment that the law requires of you; for choosing the region where your Cloud Services data is stored (Section 4.1); and for determining whether you may use the Cloud Services, including their regional hosting and any access from the United States, under the laws that apply to you.
Except for the obligations that Section 8.3, the Standard Contractual Clauses, or applicable law places directly on PostureCo as a processor or data importer, you are solely responsible for compliance with GDPR, UK GDPR, and any other applicable international data protection or privacy laws. PostureCo makes no claims, representations, or warranties regarding compliance with laws outside the United States, and international use of the Cloud Services is at your sole risk.
To the maximum extent permitted by law, PostureCo disclaims all liability arising from your international use of the Cloud Services.
8.5 NO VPNS OR LOCATION MASKING. No one may access or use the Cloud Services, including the PostureCo Cloud web portal, RemoteScreen, and the Software, through a virtual private network (VPN), proxy server, anonymizing network, or any other technology that hides, masks, or changes the location from which the Cloud Services are accessed, including a VPN provided by an employer or practice. You must not do so, you must make sure that no one using your account does so, and you must tell the clients or patients you invite to RemoteScreen not to do so. Any such use by you or under your account is a material breach of this Agreement and of the Terms of Service (Section 4 of the Terms of Service). PostureCo may not be able to detect VPN or other location-masking use, has no obligation to monitor for or detect it, and may (but need not) block, suspend, or terminate access to the Cloud Services if it suspects it. You are solely responsible for every consequence of VPN or location-masking use by you, by anyone using your account, or by a client or patient you invite, including the use of a feature where it is not available (such as PostureScribe.AI outside the United States, Section 3.2 of the PostureScribe.AI User Agreement, or the AI-Guided Health History outside the United States, Section 7.5), Cloud Services data stored in a region that is wrong for you (Section 4.1), and any resulting violation of law (Section 13). To the maximum extent permitted by law, and except for PostureCo's own obligations under an Executed BAA, Section 8.3, the Standard Contractual Clauses, or applicable law, PostureCo has no liability for any of those consequences.
8.6 HEALTHCARE PROVIDERS OUTSIDE THE UNITED STATES; LAWS THAT APPLY TO YOU. If you are a healthcare provider or other professional outside the United States and you use the Cloud Services, including if you use them only to back up health information, you are solely responsible for identifying and complying with every law that applies to you and to your clients' and patients' information, including data-protection, health-information, professional-secrecy, data-residency, health-data-hosting, and record-retention laws (see also Section 9.5 of the Terms of Service).
Where the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection applies, the processor terms in Section 8.3 (which address Article 28 of the GDPR and of the UK GDPR) and, where Section 8.4 makes them apply, the Standard Contractual Clauses are built into this Agreement: they apply, as those Sections provide, when you accept this Agreement, without a separate signature, and a separately signed data processing agreement is available on request (on PostureCo's standard form; Section 8.3). Under those laws, they are the counterpart of a HIPAA Business Associate Agreement. They are not a BAA, and they do not address any other requirement of those laws or of any other law.
Anything else that a law that applies to you requires, including any other contract (such as an agreement similar to a HIPAA Business Associate Agreement) and any registration, notification, authorization, certification, or approval (for example, a country-specific requirement for hosting health data), is solely your responsibility to identify, to request from PostureCo, and to supply to PostureCo for review, before you upload any information it concerns to the Cloud Services; any such agreement exists only once it is fully executed by both you and PostureCo. Send your request to info@postureco.com or through the contact form at https://www.postureanalysis.com/postureco-support/, and do not include any client or patient information in it. PostureCo has no obligation to ask about, identify, offer, or remind you of any such requirement. A request alone creates nothing, and PostureCo may accept, negotiate, or decline any request or term, case by case and in its sole discretion (Section 8.5 of the Terms of Service). PostureCo makes no representation that the Cloud Services, PostureCo, or its service providers meet any requirement of a law outside the United States, or hold any country-specific certification, registration, or approval, unless PostureCo expressly confirms it in a writing signed by PostureCo.
If a law that applies to you requires an agreement, registration, or other step that is not in place, you must not use the Cloud Services for the information concerned. Using them anyway is a material breach of this Agreement and of the Terms of Service (and may violate that law) and is entirely at your own risk; PostureCo is not responsible for any consequence of it, including where you never asked PostureCo for an agreement or never sent PostureCo any document to sign; and you will defend, indemnify, and hold harmless PostureCo completely from it (Section 13).
PostureCo makes its apps available worldwide through app stores and online, and it cannot vet or verify who downloads, buys, or uses the Software or the Cloud Services, what kind of professional or organization you are (for example, a healthcare provider, covered entity, business associate, fitness or wellness professional, or consumer), where you are, or which laws apply to you, and it relies on you; wherever you are, you must determine and comply with every law that applies to you and to the information you handle, including HIPAA and laws like it elsewhere in the world (Section 9.6 of the Terms of Service). Using the Cloud Services in violation of any such law is a material breach of this Agreement and of the Terms of Service: your right to use the affected Cloud Services ends automatically for that use, you must stop that use immediately, PostureCo may suspend or terminate your access, without refund to the extent the law allows (Section 18 of the Terms of Service), and your indemnity applies (Section 13). PostureCo makes no representation that the Cloud Services are appropriate, lawful, or available for use in any particular location, and it may restrict their availability in any country. Nothing in this Section 8.6 limits any right that applicable consumer law gives you and that cannot be waived by contract.
PostureCo shall not be responsible or liable for any data corruption, loss, deletion, or inaccessibility arising from or related to:
PostureCo strongly recommends, but does not require, that you maintain independent and redundant backups of your data, using only backup methods that meet your legal obligations. Depending on your circumstances, those may include encrypted backups on computers and storage devices that you control and secure, and your own electronic health record or other system of record; whether a method meets your obligations is for you to decide.
Cloud backups of your devices and consumer cloud services, such as Apple iCloud Backup and iCloud Photos, are Third-Party Backup Services (Section 7.1 of the Terms of Service). They are provided by their providers under their own terms, they are not part of the Cloud Services, PostureCo does not control them, and no BAA with PostureCo covers them. Apple's iCloud terms do not allow HIPAA covered entities or business associates to use iCloud for protected health information. If your data includes PHI, or other client or patient information that the law protects, you must keep it out of every Third-Party Backup Service unless that service, and your use of it, meet your legal obligations, including any business associate agreement those obligations require. This includes the copies of Cloud Services data that are synchronized to your devices (Sections 7.1 through 7.4 of the Terms of Service). If you are not a HIPAA covered entity or business associate and no other such law applies to your data, for example if you work in health and fitness only, whether you also use a Third-Party Backup Service is your choice, and Section 7.4 of the Terms of Service still applies.
You acknowledge that failure to maintain independent and redundant backups that meet your legal obligations materially increases the risk of data loss, which you voluntarily assume. PostureCo is not responsible for any Third-Party Backup Service or for any information in it, as Section 7.4 of the Terms of Service provides, and your indemnity applies (Section 13).
Nothing in this Agreement creates a fiduciary relationship, agency, partnership, joint venture, bailment, or trust relationship between you and PostureCo.
PostureCo is not a data custodian, medical records custodian, or trustee of your data.
You expressly waive any claim that PostureCo owes heightened duties of care beyond those expressly stated in this Agreement.
PostureCo shall not be liable for any failure, delay, interruption, data loss, or unavailability resulting from events beyond its reasonable control, including but not limited to:
You agree to defend, indemnify, and hold harmless PostureCo, its officers, directors, employees, contractors, licensors, and affiliates from and against any and all claims, damages, losses, liabilities, penalties, fines, costs, and expenses (including attorneys' fees) arising out of or related to:
This obligation survives termination of this Agreement.
To the fullest extent permitted by law, you waive any and all rights of subrogation against PostureCo for losses covered by insurance maintained by you.
You agree to ensure that any applicable insurance policies include a waiver of subrogation in favor of PostureCo, where permitted.
THE CLOUD SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE."
POSTURECO DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT, TO THE MAXIMUM EXTENT PERMITTED BY FLORIDA LAW.
TO THE MAXIMUM EXTENT PERMITTED BY LAW, POSTURECO'S TOTAL LIABILITY ARISING OUT OF OR RELATED TO THE CLOUD SERVICES SHALL NOT EXCEED THE AMOUNT PAID BY YOU FOR THE CLOUD SERVICES IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM.
IN NO EVENT SHALL POSTURECO BE LIABLE FOR INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, OR EXEMPLARY DAMAGES.
TO THE MAXIMUM EXTENT PERMITTED BY LAW, THESE LIMITATIONS APPLY TO ALL CLAIMS ARISING OUT OF OR RELATED TO THE CLOUD SERVICES, INCLUDING CLAIMS ARISING OUT OF OR RELATED TO PHI, ANY SECURITY INCIDENT, ANY DATA LOSS, OR ANY EXECUTED BAA OR DATA PROCESSING AGREEMENT, UNLESS THAT EXECUTED BAA OR DATA PROCESSING AGREEMENT EXPRESSLY PROVIDES OTHERWISE. THE DAMAGES EXCLUDED ABOVE INCLUDE LOST PROFITS, LOST DATA, PATIENT CLAIMS, REGULATORY PENALTIES, AND COSTS OF INVESTIGATION, BREACH NOTIFICATION, AND CREDIT MONITORING.
You acknowledge that you have not relied on any representations or statements not expressly set forth in this Agreement.
Your sole and exclusive remedies for any claim arising out of or relating to the Cloud Services are those expressly provided in this Agreement.
Except where inconsistent with or expressly superseded by the Terms of Service or applicable End User License Agreement, any dispute, claim, or controversy arising out of or relating specifically to the Cloud Services or this Agreement shall be resolved by final and binding arbitration conducted in Pasco County, Florida, consistent with Section 16 of the Terms of Service, on an individual basis only.
YOU EXPRESSLY WAIVE ANY RIGHT TO PARTICIPATE IN A CLASS ACTION, COLLECTIVE ACTION, OR REPRESENTATIVE PROCEEDING AGAINST POSTURECO WITH RESPECT TO THE CLOUD SERVICES.
Judgment on the arbitration award may be entered in any court of competent jurisdiction.
This Agreement shall be governed by and construed in accordance with the laws of the State of Florida, without regard to conflict-of-law principles.
This Agreement, together with the Terms of Service, the Privacy Policy, any Executed BAA, any data processing agreement executed under Section 8.3, any other agreement that both you and PostureCo sign under Section 8.6, and, where they apply, the PostureScribe.AI User Agreement and PostureRay's own terms, constitutes the entire agreement between you and PostureCo with respect to the Cloud Services and supersedes all prior agreements or understandings relating to SyncScreen or cloud-based storage services.
If any provision of this Agreement is held invalid or unenforceable, it will be enforced to the maximum extent permitted by law, and the remaining provisions remain in full force and effect.
PostureCo may assign or transfer this Agreement, in whole or in part, without your consent, to a successor to all or part of PostureCo's business or assets in a merger, acquisition, reorganization, bankruptcy, or sale, and may transfer Cloud Services data to that successor as part of the transaction, subject to the same protections that this Agreement provides, any Executed BAA, and applicable law. You may not assign or transfer this Agreement or your Cloud Services account without PostureCo's prior written consent. This Agreement binds and benefits the parties and their permitted successors and assigns.
PostureCo, Inc. · Cloud Services Agreement · Last updated October 21, 2026