Auroa.io — Acceptable Use Policy (AUP)

Auroa.io (the "Platform") provides B2B software infrastructure for workforce compliance tracking, staff credential management, and automated family engagement updates. The Platform is engineered strictly for non-clinical, non-medical operational administrative usage.

The Platform is a strict ZERO-PHI (Protected Health Information) environment. Users are explicitly prohibited from uploading, typing, transmitting, or storing any data that falls under federal healthcare compliance rules or HIPAA regulations. Prohibited data includes, but is not limited to:

• Clinical patient medical charts, diagnoses, or symptoms.
• Prescription drug records, medication logs, or clinical therapies.
• Health insurance data, claims history, or Medicare/Medicaid details.

The Subscriber (the "Company") and its authorized administrators, staff, and employees bear sole legal and operational responsibility for all data inputted into the system. If any employee, contractor, or user affiliated with the Subscriber uploads PHI or clinical records into the Platform, the Subscriber is in immediate material breach of this Agreement.

The Subscriber agrees to defend, indemnify, and hold harmless Auroa.io, its parent LLC, and its operators from any and all federal or state regulatory penalties, lawsuits, financial damages, legal fees, or operational losses arising from the Subscriber's unauthorized upload of Protected Health Information (PHI) or clinical data into the non-medical platform infrastructure.

By checking the agreement box and completing the Stripe checkout session, you acknowledge and certify that Auroa.io utilizes automated, modern third-party sub-processors to run its unified system architecture, including:

• Supabase Inc. (Managed Cloud Storage & Secure User Passphrase Authentication)
• Stripe Inc. (Embedded Subscription Billing & Invoicing Gateways)
• Make.com / Celonis (Automated Webhook Payload Processing Loops)
• GoHighLevel / Twilio (Asynchronous SMS and AI Customer Support Routing)

Subscriber explicitly certifies they accept full operational liability for ensuring their staff maintains a strict non-clinical boundary while utilizing these connected sub-processor networks.