Clinic Terms of Service

1. Who these terms cover

These Clinic Terms of Service (“Terms”) are an agreement between Astra Software Labs LLP, a New Jersey limited liability partnership doing business as LumaraRx (“Lumara,” “we,” “us”), and the clinic, practice or organization that opens a clinic account (“Clinic,” “you”).

• Acceptance. You accept these Terms when you create a clinic account, start a trial, or use the clinic console. The person who signs up confirms they are authorized to bind the Clinic.
• Scope. These Terms cover the clinic console at clinic.lumararx.com, clinic accounts and subscriptions, and the Clinic’s use of patient information shared through Lumara. Patients’ own use of the Lumara app is governed by the patient Terms of Use, not by these Terms.
• Order of precedence. If you sign a Business Associate Agreement (“BAA”) or an order form with us, it controls over these Terms where they conflict. The Privacy Policy explains how we handle personal information.

2. What the service is, and what it is not

Lumara is a medication tracking and education tool. It is not a medical device, it does not provide medical advice, and it never recommends a dose.

• What the console does. It lets the Clinic invite patients, assign medication protocols, see the doses and side effects connected patients log, receive adherence and missed-dose alerts, and view reports. Any dosing figure shown is one the Clinic or the patient entered.
• Calculations and insights. The reconstitution calculator computes arithmetic from the numbers entered and shows its working. Trends and correlations (for example, sleep or HRV since a patient started a medication) are observations, not recommendations.
• Clinical judgment stays with the Clinic. The Clinic and its licensed providers are solely responsible for diagnosis, prescribing, dosing, monitoring and all other clinical decisions. The console is not a substitute for clinical judgment or an emergency system, and it is not the Clinic’s medical record: the Clinic keeps its own records as the law requires.
• Not for emergencies. Alerts may be delayed or missed (for example, when a patient’s phone is offline). The Clinic must not rely on Lumara to detect or respond to a medical emergency.
• Patient-reported data. Doses, side effects and wearable readings come from patients and their devices. We do not verify them.

3. Accounts, roles and security

Each clinic account has one owner, who is responsible for the account and everyone the Clinic gives access to.

• Seats. Each plan includes a number of provider seats, shown on the pricing page. Each login is for one named person and may not be shared.
• Accurate information. The Clinic must give accurate account details, including its legal name, phone and street address, and keep them current.
• Credentials. The Clinic is responsible for keeping logins confidential, for removing people who leave, and for all activity under its account. Tell us promptly at support@lumararx.com if you suspect unauthorized access.
• Eligibility. The console is for healthcare practices and their staff in the United States. Staff must be 18 or older.

4. Plans, trial and billing

Paid plans renew automatically every month or year until the owner cancels, and are billed in advance through Stripe.

• Free trial. A new clinic account gets a 14-day free trial with Practice-plan features, up to 5 providers and up to 25 connected patients. Nothing is charged during the trial. When it ends without a paid plan, the account moves to the expired state in Section 5.
• Plans and prices. Plans, included seats and patients, and prices are listed at lumararx.com/clinics and shown at checkout. The price at checkout is the price you pay for that billing period.
• Renewal and price changes. We will give at least 30 days’ notice by email before a price change applies to your next renewal.
• Changing plans. The owner can upgrade or downgrade at any time. The change is prorated, and the console shows the prorated amount before you confirm. A downgrade lists the features you will lose.
• Additional patients and seats. Starting November 1, 2026, we charge for each connected patient above your plan’s included number, and for each provider seat above it on plans that list a seat price, at the rates on the pricing page. We count on your monthly billing day and charge the card on file on a separate monthly invoice, including on annual plans. Growing past your plan is never blocked.
• Taxes. Prices exclude taxes. You are responsible for applicable sales, use and similar taxes.
• Failed payments. If a payment fails and is not resolved, we may move the account to the expired state.
• Refunds. Fees are non-refundable, including for partial billing periods, except when the owner deletes the clinic account (Section 5) or where the law requires otherwise.

5. Cancelling, lapsing and deleting the clinic account

The owner can cancel the subscription or delete the clinic account at any time, in Settings, without contacting us.

Cancelling. Cancellation takes effect at the end of the current paid period. The plan stays active until then, and the owner can resume it until that date. No partial refund is given.

When a plan ends (the expired state). After cancellation, a failed payment or a trial that ends unpaid:

• the Clinic keeps read-only access to its connected patients’ doses;
• inviting patients, assigning protocols, protocol templates and alerts are paused;
• patients keep using the Lumara app and keep their data.

Choosing a plan again restores full access.

Deleting the clinic account. Only the owner can delete, and must type the clinic’s name to confirm. Deletion:

1. cancels the subscription immediately, with no further charges, and refunds the unused part of the current paid period, pro-rated by day;
2. removes every staff login and every pending patient invite;
3. disconnects every patient and notifies them. The Clinic can no longer see any of their information;
4. leaves each patient’s own account intact: the medications the Clinic assigned stay in their app, and their dose history is kept;
5. removes the Clinic’s name, contact details, address and branding from the service.

Deletion cannot be undone. We do not provide an export of patient information on deletion, so download any reports your plan allows beforehand. A patient who had no other clinic and no paid plan is offered a free trial of Lumara Premium, and may then subscribe directly with us.

6. Patient data and HIPAA

The Clinic sees a patient’s information only while that patient is connected to it, and the patient controls that connection.

• Roles under HIPAA. Where the Clinic is a HIPAA covered entity, Lumara acts as its business associate for the protected health information (“PHI”) the Clinic accesses through the console. Where HIPAA requires a BAA, it is a separate written agreement between the Clinic and Lumara, and the Clinic must not use the console with patients’ PHI until one is in place.
• Patients own their accounts. Each patient has their own Lumara account and decides whether to connect to a clinic. A patient can disconnect at any time. From then on, the Clinic can no longer see any of that patient’s information, including what they logged before.
• What a connected clinic sees. Doses logged against the medications the Clinic assigned, adherence, side-effect check-ins and wearable readings the patient shares. Medications the patient added themselves, and those assigned by other clinics, are not shown.
• How we protect it. Data is encrypted in transit and at rest, and database-level access rules restrict each clinic to its connected patients. The patient app encrypts data on the device and locks with Face ID or a passcode.
• The Clinic’s obligations. The Clinic must have any consent and authority the law requires to invite a patient and view their information. It is responsible for its own staff’s access and for its own HIPAA compliance, including its notice of privacy practices.
• Breach notice. We will notify the Clinic of a breach of unsecured PHI as HIPAA and any BAA between us require.
• No sale of data. We do not sell patient or clinic data.

7. The Clinic’s responsibilities and acceptable use

The Clinic is responsible for how it and its staff use the console. The Clinic confirms that it and its providers hold the licenses their practice requires, and that the medications and protocols it assigns are prescribed and dispensed lawfully.

The Clinic must not:

• invite anyone who is not its patient, or send invites the recipient has not agreed to receive;
• use the console to market to patients, or to send them anything other than care-related messages;
• upload false information, or content that is unlawful or infringes another’s rights;
• share logins, resell or sublicense the service, or let anyone outside the Clinic use it;
• probe, scan or test the security of the service, or interfere with its operation;
• copy, scrape or reverse engineer the service, or use it to build a competing product;
• use the service in a way that violates HIPAA, state privacy law, or medical, pharmacy or advertising rules.

8. Confidentiality, ownership and feedback

Each party keeps what it owns, and each protects the other’s confidential information.

• Our service. Lumara owns the service, including its software, design, content and trademarks. We give the Clinic a non-exclusive, non-transferable right to use the console during its subscription, under these Terms.
• Clinic content. The Clinic owns what it creates in the console, such as protocol templates, notes and messages. It lets us host and process that content only to provide and support the service.
• Patient data. Patients’ information belongs to them and is governed by the patient Terms of Use, the Privacy Policy and, for PHI, any BAA between the Clinic and Lumara.
• Aggregated data. We may use de-identified, aggregated data (for example, how many clinics use a feature) to run and improve the service, in line with HIPAA’s de-identification standard.
• Confidentiality. Each party will use the other’s non-public business information only for this agreement and will protect it with reasonable care.
• Feedback. We may use suggestions the Clinic gives us without obligation.

9. Disclaimers, limitation of liability and indemnity

The service is provided “as is”, and each party’s liability is capped.

Disclaimer. To the extent the law allows, we disclaim all warranties, express or implied, including merchantability, fitness for a particular purpose and non-infringement. We do not warrant that the service will be uninterrupted or error-free, that alerts will always be delivered, or that patient-reported data is accurate.

Limitation of liability. To the extent the law allows:

• neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue or data;
• each party’s total liability under these Terms is limited to the fees the Clinic paid us in the 12 months before the claim arose.

These limits do not apply to the Clinic’s payment obligations or to either party’s indemnity obligations.

Indemnity by the Clinic. The Clinic will defend and indemnify Lumara against third-party claims arising from its clinical decisions and patient care, its breach of these Terms or of law, or its staff’s use of the service.

Indemnity by Lumara. Lumara will defend and indemnify the Clinic against third-party claims that the service, as provided by us, infringes their intellectual property rights.

10. Suspension, changes, governing law and notices

• Suspension and termination by us. We may suspend or end access if the Clinic materially breaches these Terms and does not cure it within 10 days of notice, or immediately where needed to protect patients, the service or other customers, or to comply with law. Where we end the agreement without cause, we will refund prepaid fees for the unused period.
• Changes to the service. We may improve and change the service. We will not materially reduce the core features of a paid plan during a billing period without notice.
• Changes to these Terms. We will email the owner at least 30 days before a material change takes effect. Continuing to use the console after that date is acceptance.
• Governing law and disputes. These Terms are governed by New Jersey law, without regard to conflict-of-law rules. Disputes are resolved by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, before one arbitrator, seated in New Jersey. Either party may still bring an individual claim in small-claims court, or ask a court for an injunction to protect its intellectual property or confidential information.
• Notices. We send notices to the owner’s account email. Notices to us go to support@lumararx.com, with a copy by mail to LumaraRx, 1280 Lexington Ave FRNT 2, New York, NY 10028, United States.
• General. The Clinic may not assign these Terms without our consent, except to a successor of its practice. If a provision is unenforceable, the rest remains in force. These Terms, any BAA and any order form are the whole agreement about the console.