Terms of Service

These Terms govern use of the RxChange service operated by 4TressCyber LLC (“we”, “us”). By creating an account or using the service, the organisation you act for (“Customer”, “you”) agrees to them.

1. What the service is

RxChange is inventory software for pharmacy groups. It reads unused-inventory reports exported from your pharmacy management system, presents them as one searchable list across your stores, and records requests to transfer stock between them.

RxChange does not move medication, dispense, bill, or execute transfers. Those actions happen in your own pharmacy systems and physical processes. RxChange records that a request was made and by whom.

2. Not a pharmacy, and not advice

We are not a pharmacy, a wholesaler, a distributor, or a healthcare provider. Nothing in the service is medical, pharmaceutical, clinical, or legal advice. Every decision about whether a particular medication may lawfully be transferred, and on what terms, remains a professional judgement made by your licensed personnel.

3. Controlled substances

The service displays DEA schedule information contained in your reports and can record a DEA Form 222 or CSOS order number against a Schedule II transfer request.

Recording that number in RxChange does not file it, validate it, or satisfy any regulatory obligation. You remain solely responsible for compliance with the Controlled Substances Act, DEA regulations including transfer and distributor registration thresholds, and all state board of pharmacy requirements. You are responsible for determining whether RxChange forms part of your system of record and for maintaining any records the law requires you to keep elsewhere.

4. Accounts and security

• Accounts are issued to named individuals. Credentials must not be shared.
• Multi-factor authentication is mandatory and cannot be disabled. A user who has not enrolled a passkey or authenticator app cannot access any data.
• You are responsible for who you invite, what role you give them, and for removing access promptly when someone leaves. Administrators can disable an account, which ends its sessions immediately.
• You must tell us without undue delay at [email protected] if you believe an account or the service has been compromised.

5. Acceptable use

You agree not to:

• upload data you are not entitled to process, or PHI before a Business Associate Agreement is in place;
• attempt to access another organisation’s data, or probe, scan, or test the security of the service except under a written agreement with us;
• use the service to make automated bulk requests that degrade it for others;
• reverse engineer, resell, or provide the service to a third party without our written agreement;
• use the service in a way that breaks any applicable law or the terms of your own licences and registrations.

Good-faith security research is welcome. Contact [email protected] before testing, and we will not pursue you for research conducted within scope we agree.

6. Your data

As between us, your data remains yours. That includes your inventory records, transfer records, user accounts, and any protected health information you enter. We process it to provide the service, to keep it secure, and to meet our legal obligations — not to build products, train models, or sell to anyone.

Inventory is replaced each time a report loads, so the service holds the current picture rather than a history of stock levels. Import records, transfer records, and the audit log persist. See the Privacy Policy for detail.

7. Protected health information

A transfer request may optionally include a patient name, which is protected health information under HIPAA. Where we process PHI on your behalf we act as a Business Associate, and a signed Business Associate Agreement governs that processing and takes precedence over these Terms where they conflict. See HIPAA & BAA.

You must not enter PHI before a BAA is in place.

8. Availability

We aim to keep the service available and to give notice of planned maintenance, but we do not guarantee uninterrupted access unless a separate written service level agreement says so. The service depends on your reports arriving; if your pharmacy system stops sending them, the inventory shown will go stale. The dashboard shows when each store last loaded so that condition is visible rather than silent.

9. Fees

Fees, billing period, and notice periods are set out in your order form or written agreement with us. Unless that document says otherwise, fees are payable in advance and are non-refundable for a period already begun.

10. Warranties and disclaimer

We warrant that we will provide the service with reasonable skill and care. Beyond that, and to the fullest extent permitted by law, the service is provided “as is” without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, and non-infringement.

We do not warrant that the data displayed is accurate or complete. It is derived from reports your systems produce. Verify physical stock before relying on it.

11. Limitation of liability

To the fullest extent permitted by law, neither party is liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, or goodwill, arising from these Terms or the service.

Our total aggregate liability arising from or relating to the service is limited to the fees you paid us in the twelve months before the event giving rise to the claim.

Nothing here limits liability that cannot lawfully be limited, including for death or personal injury caused by negligence, or for fraud.

12. Indemnity

You will indemnify us against claims arising from your data, your use of the service in breach of these Terms, or your failure to comply with pharmacy, controlled-substance, or privacy law.

13. Term, suspension, and termination

• Either party may terminate on the notice set out in your order form.
• We may suspend access without notice where necessary to protect the service or other customers, or where required by law. We will tell you why as soon as we reasonably can.
• On termination you may export your data. Unless the law or your BAA requires otherwise, we delete customer data within 90 days of termination, and encrypted backups age out on their normal retention cycle after that.

14. Changes

We may change these Terms. For material changes we will give reasonable advance notice by email to your administrators. Continuing to use the service after a change takes effect means you accept it.

15. Governing law

These Terms are governed by the laws of the State of Utah, United States, without regard to conflict of law rules, and the courts of that jurisdiction have exclusive jurisdiction.

16. Contact

4TressCyber LLC
8633 S Sandy Pkwy, Sandy, UT 84070
[email protected]