Terms of Service

These Terms of Service (Terms) are a binding agreement between QRRX LLC (QR Rx, we, us) and the person or organization using the Service. If you use the Service for a clinic, practice, hospital, or other organization, you represent that you are at least 18 years old and have authority to bind that organization. If you do not agree, do not use the Service.

The Privacy Policy at qrrx.io/privacy and, when QR Rx handles Protected Health Information for a healthcare customer, the Business Associate Agreement at qrrx.io/baa are incorporated into these Terms. The BAA controls if it conflicts with these Terms regarding PHI.

QR Rx is a digital aftercare communication and workflow platform. It allows authorized healthcare teams to create and distribute care plans and aftercare cards, map external service codes to approved templates, send transactional communications, track recovery activity, collect patient-reported information, and review operational exceptions in Care Feed.

Features, interfaces, integrations, and availability may change as the Service evolves. QR Rx may add, modify, limit, or discontinue a feature when reasonably necessary for security, legal compliance, vendor compatibility, or product improvement. We will provide reasonable advance notice when a material change substantially reduces the core paid Service.

Providers include healthcare professionals, owners, administrators, and authorized team members. Patients receive access from their healthcare provider and may use a secure link, QR code, date of birth, PIN, or other verification method without creating a provider account.

Each user must provide accurate information, use only their own credentials, protect authentication factors, and promptly report suspected unauthorized access to security@qrrx.io. The clinic is responsible for assigning least-privilege roles, reviewing access, and removing users who no longer need access.

• Maintain all required professional licenses, permissions, patient notices, and authorizations.
• Review and approve the clinical accuracy, completeness, timing, medications, warnings, and suitability of every template and care plan used by the clinic.
• Use the Service only within the user's lawful role and scope of practice.
• Train team members, manage access, and maintain the clinic's own medical records and retention obligations.
• Provide accurate patient contact information and honor communication preferences and opt-out requests.
• Maintain reasonable procedures for monitoring Care Feed, delivery failures, urgent symptom notices, and other exceptions that QR Rx identifies for staff attention.

The clinic authorizes QR Rx to receive and process data from each practice-management, scheduling, electronic health record, payment, or other system that the clinic connects. The clinic represents that it is authorized to provide the credentials, webhooks, service codes, contact data, and other information supplied through an integration.

Before enabling autonomous delivery, the clinic must test the connection, approve each service-to-template mapping or mark the service as requiring no aftercare, select the delivery channel, and confirm the proposed patient experience. Once enabled, QR Rx may send a matched plan without individual staff review. Unmapped, ambiguous, incomplete, multi-service, suppressed, throttled, or failed events may remain in Care Feed instead of sending.

The clinic remains responsible for approved templates and mappings and for reviewing Care Feed. QR Rx is not responsible for vendor outages, delayed or inaccurate third-party data, clinic mapping choices, or changes made in a connected system that the clinic does not communicate or test.

QR Rx is a communication, education, and workflow tool. QR Rx does not practice medicine, diagnose, prescribe, independently verify clinical content, or replace the judgment of a licensed healthcare professional. Templates are starting points and are not patient-specific medical advice until reviewed and adopted by the treating clinic.

The Service is not an emergency service and is not continuously monitored. Patients with an emergency must call 911 or the applicable local emergency number. Clinics must provide and monitor their own urgent contact pathways and must not rely on QR Rx as the sole method for time-sensitive clinical communication.

Patient access is protected by the verification methods configured for the plan. A verified patient session generally remains valid through the plan's recovery window, typically the procedure date plus the configured recovery period plus seven days, subject to earlier expiration, revocation, device settings, or a maximum remembered-device period shown in the patient experience.

No security control eliminates all risk. Users must not share links, PINs, session tokens, credentials, or patient information with unauthorized persons and must sign out on shared devices.

If the clinic uses QR Rx to send text messages, it confirms that it has collected and will maintain any permission required to send non-promotional healthcare messages to the phone numbers it provides, and it authorizes QR Rx to send those messages on the clinic's behalf. This contractual allocation does not waive or replace any permission required by applicable law.

Messages may include a care-plan link, access instructions, appointment or recovery reminders, and clinic contact information. Message frequency varies by care plan. Message and data rates may apply. Recipients may reply STOP to opt out and HELP for help. QR Rx and the clinic will honor supported opt-out requests. Consent to receive texts is not a condition of purchasing goods or services, and an alternative delivery method may be requested from the clinic.

The clinic may not use the transactional channel for advertising, promotions, or unrelated solicitation. Mobile carriers are not liable for delayed or undelivered messages.

• Do not use the Service unlawfully, beyond your authorization, or to harm a patient or another person.
• Do not access another clinic's or patient's data without authorization or attempt to defeat authentication, rate limits, tenant boundaries, or security controls.
• Do not upload malicious code, probe the Service without written permission, scrape the Service, or resell access except under a written partner agreement.
• Do not use QR Rx for spam, unlawful marketing, discriminatory activity, or content that infringes another person's rights.
• Do not represent AI-generated, template, or translated output as independently verified by QR Rx.

QR Rx owns the Service, software, design, documentation, trademarks, and QR Rx-authored template library. Subject to these Terms, QR Rx grants authorized users a limited, revocable, nonexclusive, nontransferable right to use the Service during the subscription.

The clinic retains its rights in content it creates. The clinic grants QR Rx the limited rights needed to host, process, reproduce, translate, display, deliver, secure, and back up that content to operate the Service. The clinic represents that it has the rights needed to submit the content.

QR Rx may use feedback without restriction. Provider-authored FAQ material may enter the Cura Knowledge Base only as described in the BAA and Privacy Policy, after the applicable de-identification and clinic controls are applied.

The Privacy Policy explains how QR Rx handles personal information. When QR Rx creates, receives, maintains, or transmits PHI on behalf of a Covered Entity, the BAA applies. The clinic remains responsible for its own HIPAA compliance, Notice of Privacy Practices, legal basis for disclosures, workforce training, and medical-record obligations.

Paid subscriptions renew for successive billing periods until canceled unless an order form states otherwise. The clinic authorizes QR Rx and its payment processor to charge the payment method on file for subscription fees, approved usage charges, and applicable taxes. Prices, plan limits, and included usage are shown at checkout, in the application, or in an order form.

Unless required by law or expressly stated otherwise, fees are nonrefundable and cancellation takes effect at the end of the current paid billing period. Trials and promotional pricing may expire or convert as disclosed when accepted. QR Rx may suspend paid features for overdue amounts after reasonable notice.

QR Rx will provide at least 30 days' notice of a material price increase. Third-party carrier, messaging, API, vendor, implementation, or excess-usage charges apply only when disclosed in the applicable plan, checkout, or order form.

The Service may interoperate with services supplied by other companies. Their terms, availability, data quality, security, and product decisions are outside QR Rx's control. QR Rx may suspend an integration that creates a security, legal, or reliability risk. QR Rx is not liable for a third party's service, but remains responsible for its own obligations under the BAA and applicable law.

During an active subscription, the clinic may export available clinic data through supported tools or by contacting support. Patient access requests involving PHI will ordinarily be coordinated with the treating clinic as described in the BAA. Export formats may reflect technical limitations and do not include QR Rx software, security information, or proprietary aggregate analytics.

QR Rx uses commercially reasonable efforts to operate the Service reliably and securely, but does not guarantee uninterrupted or error-free operation unless a separate written service-level agreement applies. Maintenance, telecommunications failures, vendor outages, security events, force majeure events, and emergency changes may affect availability.

The clinic may cancel as described in its plan or order form. QR Rx may suspend or terminate access for material breach, unlawful or unsafe activity, security risk, or nonpayment. When practicable, QR Rx will give notice and an opportunity to cure, but may act immediately to protect patients, data, the Service, or other users.

Following termination, the clinic will have 30 days to request an available export unless immediate deletion is requested or prohibited by law. PHI is then returned or destroyed as described in the BAA. Residual encrypted backup copies may remain isolated until overwritten under standard backup cycles. Legal, security, billing, and acceptance records may be retained as required by law or legitimate compliance needs.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICE, TEMPLATES, INTEGRATIONS, AI OUTPUT, TRANSLATIONS, AND DOCUMENTATION ARE PROVIDED AS IS AND AS AVAILABLE. QR RX DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, AND ANY WARRANTY ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. QR RX DOES NOT WARRANT CLINICAL ACCURACY, A PARTICULAR PATIENT OUTCOME, OR THAT THIRD-PARTY DATA WILL BE COMPLETE OR TIMELY.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, GOODWILL, OR BUSINESS INTERRUPTION, EVEN IF ADVISED OF THE POSSIBILITY.

EXCEPT FOR AMOUNTS OWED, A PARTY'S INDEMNIFICATION OBLIGATIONS, FRAUD, WILLFUL MISCONDUCT, OR LIABILITY THAT CANNOT LAWFULLY BE LIMITED, QR RX'S TOTAL AGGREGATE LIABILITY ARISING OUT OF THE SERVICE WILL NOT EXCEED THE GREATER OF THE FEES PAID OR PAYABLE FOR THE SERVICE DURING THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM OR 500 US DOLLARS.

The BAA governs responsibility for PHI-related obligations. Some jurisdictions do not allow certain exclusions, so these limitations apply only to the extent permitted.

The clinic will defend and indemnify QR Rx and its personnel from third-party claims arising from clinic content, clinical decisions, unlawful instructions, lack of required authority or permissions, misuse of the Service, or the clinic's material breach of these Terms. QR Rx will provide prompt notice and reasonable cooperation, and the clinic may control the defense so long as a settlement does not admit fault by or impose nonmonetary obligations on QR Rx without consent.

Before filing a claim, the parties will attempt in good faith for 30 days to resolve it through written notice. Except for eligible small-claims matters or requests for temporary injunctive relief, disputes will be resolved by confidential, binding, individual arbitration before one arbitrator under the American Arbitration Association Commercial Arbitration Rules. Arbitration may occur remotely or in New York County, New York.

EACH PARTY WAIVES TRIAL BY JURY AND AGREES NOT TO PARTICIPATE IN A CLASS, COLLECTIVE, CONSOLIDATED, OR REPRESENTATIVE ACTION. The arbitrator may grant relief only to the individual party. A new customer may opt out of arbitration by emailing legal@qrrx.io within 30 days after first accepting these Terms with the account email, practice name, and a clear statement that it opts out. Governing law is New York law, without regard to conflicts principles, except that the Federal Arbitration Act governs arbitration.

Optional AI-assisted features may help organize templates, translate provider-approved content, extract branding, or help a patient locate information already contained in an approved plan or verified knowledge base. Output can be incomplete or incorrect. Clinics must review AI-assisted clinical or translated material before approving it for autonomous use.

Cura is not a clinician, does not diagnose, and must defer questions outside approved content to the clinic. QR Rx will not intentionally provide PHI to an AI vendor unless that vendor is authorized under an appropriate BAA or the information has been de-identified in accordance with HIPAA. Applicable data flows and clinic controls are described in the BAA, Privacy Policy, and Subprocessor Register.

Each party will protect the other's nonpublic business, technical, security, pricing, and operational information using reasonable care and will use it only to perform or receive the Service. This section does not apply to information lawfully known without restriction, independently developed, publicly available through no breach, or lawfully received from another source. Legally compelled disclosure is permitted after notice when lawful.

QR Rx may update these Terms. We will provide reasonable notice of material changes and will require a new electronic acceptance when the change materially affects legal rights, PHI handling, autonomous communications, dispute terms, or other high-impact obligations. Nonmaterial clarifications take effect when posted. The version accepted by the user is recorded.

Neither party is liable for delay caused by events beyond reasonable control, except payment obligations. The clinic may not assign these Terms without QR Rx's consent, except with a merger or sale of substantially all assets; QR Rx may assign them in connection with a reorganization, financing, merger, or sale. If a provision is unenforceable, it will be narrowed and the remainder will continue. A waiver must be written and is not continuing.

These Terms, the BAA, Privacy Policy, applicable order form, and expressly incorporated policies are the entire agreement for the Service. An executed order form controls pricing and commercial scope; the BAA controls PHI; these Terms control otherwise. Sections that by their nature should survive termination do survive, including ownership, confidentiality, payment, disclaimers, liability, indemnification, disputes, and general terms.

Legal notices to QR Rx must be sent to legal@qrrx.io. Security reports must be sent to security@qrrx.io. Privacy requests must be sent to privacy@qrrx.io. QR Rx may send notices to the account email or through the Service. Notices are effective when received, except in-product notices are effective when displayed to the authorized account.