Terms of Service

1. Acceptance; who these Terms bind

1.1 By creating an account or using the SynxRx platform at synxrx.com ("Service"), you

agree to these Terms and to the Privacy Policy at /privacy (incorporated by reference).

If you use the Service on behalf of an organization (a pharmacy, a physician practice),

you represent that you are authorized to bind that organization and "you" means that

organization.

1.2 Physician and pharmacy onboarding includes explicit acceptance of these Terms

and the BAA as part of account setup. Acceptance also occurs by actual use of the

HIPAA obligations).

2. What SynxRx is (and is not)

2.1 SynxRx, Inc. provides a Next.js web application ("Service") that connects three

types of users:

– Physicians: licensed prescribers who create and sign compounded-medication

prescriptions in the physician portal. A physician account can prescribe only after

SynxRx's internal verification step ("verified") marks the account active.

– Pharmacies: independent, state-licensed compounding pharmacies that use the Service

as their back office (order queue, compounding state tracking, quality check,

shipping, reporting).

– Patients: individuals who view their own prescriptions, request refills, pay for

orders, receive email/SMS status updates, and manage their account.

2.2 SynxRx is a software platform. SynxRx is NOT a pharmacy, a prescriber, a pharmacy

of record, or a covered entity for the medications dispensed through the Service.

SynxRx does not fill, compound, dispense, or ship any medication, and does not

supervise the practice of pharmacy.

2.3 Pharmacies remain fully responsible for their own regulatory compliance,

including licensure and compounding standards. See, e.g., the North Carolina Pharmacy

Practice Act, N.C. Gen. Stat. ch. 90, art. 3, and the North Carolina Board of

Pharmacy compounding rule 21 N.C.A.C. 46 .2801 (compounded preparations dispensed

only pursuant to a valid individual prescription; non-sterile and sterile

compounding must comply with USP <795>/<797>). For pharmacies operating in other

states, the equivalent state board rules apply.

3. Medical disclaimer

3.1 The Service is a communications and workflow tool. It is not medical advice,

and nothing in the Service replaces the judgment of a licensed prescriber or

pharmacist. All clinical decisions are made by licensed healthcare providers using

their own professional judgment.

3.2 Prescription content (medications, directions, dosages) is entered and signed by

the prescribing physician. SynxRx displays that data back to patients and pharmacies

as entered. SynxRx does not independently verify the clinical accuracy of

physician-entered content, except for the platform's own authorization checks

(signing is blocked until the physician account is internally verified).

3.3 If you are having a medical emergency, call 911 (or your local emergency

number). Do not use the Service to report an emergency.

4. HIPAA; each party's role

4.1 Protected Health Information handled in the Service is regulated by the Health

Insurance Portability and Accountability Act (HIPAA), 45 C.F.R. Parts 160, 162, and

164. SynxRx acts as a Business Associate of the pharmacies using the Service

(covered entities), and executes a Business Associate Agreement (BAA) with each

pharmacy before PHI flows; the current template is `draft-baa.md` (v2026-10-05).

4.2 Each pharmacy user represents that it is (or operates on behalf of) a covered

entity as defined at 45 C.F.R. Sec. 160.103,

and will provide SynxRx only the PHI the Service needs to perform its functions,

consistent with the minimum-necessary standard, 45 C.F.R. Sec. 164.502(b).

4.3 Physician users: a physician who is a solo practitioner or practice owner is

generally a covered entity for their own PHI.

4.4 Nothing in these Terms makes SynxRx a business associate of, or agent for,

anything except as stated in an executed BAA or in Section 4.

5. Accounts and credentials

5.1 Login is by one-time passcode (OTP) sent by email (Resend). There is no password.

5.2 You are responsible for the email inbox that receives your OTPs. Notify

support@synxrx.com immediately at any suspected compromise. SynxRx side controls:

HTTP-only session cookies, a 30-minute idle timeout, server-side role checks on every

query, organization-level tenant isolation, per-IP rate limiting, and an audit log on

every PHI read/write.

5.3 Patients may delete their own account (the record is anonymized, not hard-deleted,

to preserve prescription/order history required for regulatory retention — see

Privacy Policy Section 7 and 21 N.C.A.C. 46 .2801(h) for the 3-year North Carolina

compounded-preparation record requirement).

6. Payment terms

6.1 Orders placed through the Service are paid with Stripe Embedded Checkout; card

data is tokenized in the browser and SynxRx never stores card numbers or CVCs.

Stripe's processing terms govern: https://stripe.com/legal.

Stripe is a PCI-DSS service provider; payment card data is routed directly between

the user and Stripe and never stored by SynxRx.

6.2 Pricing for compounded preparations is set by each pharmacy; the platform

displays the pharmacy's price at checkout. Any platform fees will be disclosed at

checkout before payment.

6.3 Refunds. Refund decisions for compounded preparations rest with the dispensing

pharmacy, consistent with its posted policies and applicable law; compounding work

already begun may be excluded from refunds under pharmacy policy. SynxRx does not

initiate chargebacks.

6.4 Taxes. Applicable taxes are computed at checkout by the pharmacy's pricing rules.

7. SMS / text messaging

7.1 Opting in during registration (checkbox) authorizes automated transactional SMS:

verification codes, prescription status, order/shipping updates, refill alerts.

Message frequency depends on order activity (typical 2-10/month). Message and data

rates may apply. Carriers are not liable for delayed or undelivered messages.

7.2 STOP/HELP/START. Reply STOP to cancel; a single confirmation is sent, then no

further SMS. Reply START to resume. Reply HELP for help. Consent is elective; you

may also revoke by any reasonable means. (Automated texts are sent under prior

express consent consistent with the Telephone Consumer Protection Act, 47 U.S.C.

Sec. 227, and FCC rules, 47 C.F.R. 64.1200.)

8. Email communications

8.1 Transactional email (order confirmations, Rx statuses, OTP) is sent by Resend.

8.2 Marketing email, if ever sent, will comply with the CAN-SPAM Act, 15 U.S.C.

7701-7713 (see 15 U.S.C. Sec. 7704(a) and (c): accurate headers, physical address,

working opt-out, opt-out honored within 10 business days). Until a marketing program

exists, no marketing email is sent.

9. Content; prohibited uses

9.1 Content you post (messages, notes, addresses) stays yours; you grant SynxRx a

limited license to host it to run the Service (servers, backups, subprocessors).

9.2 You agree not to: access accounts or org data that is not yours (all org data is

isolation-enforced server-side); probe or attack the Service; upload malware;

impersonate; send spam through the Service; re-sell patient contact data scraped

from the Service; attempt to re-identify de-identified data provided by SynxRx

(consistent with 45 CFR 164.514 de-identification controls); or use the Service for

any unlawful purpose, including unauthorized pharmacy-operation or prescribing

activity.

10. Term; suspension; termination

10.1 Accounts run until terminated. A user may terminate by deleting their account

(in-app for patients) or by written notice for pharmacies/physicians; organization

administrators may deactivate members.

10.2 SynxRx may suspend access immediately (no prior notice required) for: suspected

PHI breach, unlawful activity, nonpayment, or a security risk you create.

10.3 On termination, SynxRx will return or destroy PHI as set out in the executed BAA

(45 C.F.R. Sec. 164.504(e)(2)(ii)(J)). Public-facing terms do not create pharmacy-

retention obligations; those live in the BAA and the Privacy Policy.

11. Availability; changes to the Service

The Service is hosted on Vercel (US) and Convex (US). SynxRx may change, suspend, or

discontinue any part of the Service; material changes to the Service affecting PHI

will be reflected in the BAA.

12. Disclaimers

The Service is provided "as is" without warranties of any kind, to the maximum

extent permitted by law. SynxRx does not warrant that the Service will be

uninterrupted or error-free, and expressly does not warrant the quality, safety, or

clinical appropriateness of any compounded preparation (that responsibility rests

with the dispensing pharmacy and the prescriber).

13. Limitation of liability

To the maximum extent permitted by law, SynxRx is not liable for any indirect,

incidental, special, consequential, punitive, or exemplary damages. SynxRx's total

aggregate liability for direct damages is capped at the fees you paid to SynxRx,

if any, in the 12 months preceding the claim. These limits do not apply to

liability that cannot be limited by law (e.g., gross negligence, willful

misconduct). Nothing in this section limits a party's obligations

under an executed BAA or applicable HIPAA or state-law duties. SynxRx is not

responsible for the acts or omissions of pharmacies or prescribers using the

Service.

14. Indemnification

14.1 You agree to indemnify and hold harmless SynxRx from third-party claims

arising from your breach of these Terms, your violation of applicable law, or your

misuse of the Service.

14.2 SynxRx is not liable for the acts or omissions of other users (pharmacies,

physicians, patients) acting outside SynxRx's instructions.

15. Disputes

15.1 Any dispute arising from these Terms or the Service will be resolved in the

courts described in Section 16, unless a binding arbitration provision is adopted

by a later version of these Terms after counsel review.

15.2 Claims will be brought individually, not as class or representative actions,

to the extent permitted by law.

16. Governing law; venue

16.1 These Terms are governed by the laws of the State of North Carolina, without

regard to conflict-of-law rules.

16.2 Venue for any dispute shall be the state and federal courts located in Wake

County, North Carolina, subject to any arbitration provision added after counsel review.

17. Changes to these Terms

SynxRx may update these Terms; material changes will be emailed and posted at

/terms with a new version date. Continued use after the effective date of a change

constitutes acceptance.

18. Severability; assignment; entire agreement

18.1 If a provision is unenforceable, the rest continues to apply.

18.2 You may not assign these Terms without SynxRx's written consent; SynxRx may

assign to a successor in connection with a merger, acquisition, or asset sale.

18.3 These Terms, the Privacy Policy, and any executed BAA together form the entire

agreement for the Service; where a BAA applies, the BAA controls PHI matters to the

extent of any conflict.

19. Contact

SynxRx, Inc. — support@synxrx.com.

Version v2026-10-05 (counsel-lane draft). Supersedes /terms v2026-04-20 (in-repo

Appendix A copy).

---

Appendix 1 — Citation index (ToS)

– HIPAA Privacy/Security/Breach Rules: 45 C.F.R. Parts 160 and 164 -

https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164

– Business Associate definition and rules: 45 C.F.R. 160.103; 164.502(e);

164.504(e) - https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504

– Minimum necessary: 45 C.F.R. 164.502(b) (Part 164, cited section above).

– De-identification standard: 45 C.F.R. 164.514 -

https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514

– PHI return/destruction at termination: 45 C.F.R. 164.504(e)(2)(ii)(J)

(same 164.504 page as above).

– Breach definition: 45 C.F.R. 164.402 -

https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.402

– Telephone Consumer Protection Act: 47 U.S.C. 227 -

https://www.law.cornell.edu/uscode/text/47/227

– FCC rules (consent / revocation): 47 C.F.R. 64.1200 -

https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-L/section-64.1200

– CAN-SPAM Act: 15 U.S.C. 7704 -

https://www.law.cornell.edu/uscode/text/15/7704

– North Carolina Pharmacy Practice Act: N.C. Gen. Stat. ch. 90, art. 3

(statute text: https://www.ncleg.gov/enactedlegislation/statutes/html/bychapter/chapter_90.html ;

Board's compiled statutes: https://www.ncbop.org/downloads/Statutes.pdf)

– NC Board of Pharmacy compounding rule: 21 N.C.A.C. 46 .2801 -

http://ncrules.state.nc.us/ncac/title%2021%20-%20occupational%20licensing%20boards%20and%20commissions/chapter%2046%20-%20pharmacy/21%20ncac%2046%20.2801.html