Terms & Conditions

These Terms & Conditions govern end‑user access to and use of the food data collection system (the “Service”). “Facility” means the long‑term care home that sponsors your account. “Authorized User” or “you” means a Facility employee or contractor who accesses the Service under the Facility’s agreement. RxFood (“Company”) delivers the Service to the Facility; the Facility remains responsible for your authorization and supervision. By accessing the Service, you accept these Terms on behalf of yourself and the Facility.

2.1 Purpose: The Service is provided solely to document meal consumption by recording photographs and/or videos of meals immediately before and after service and associated metadata.

2.2 Content Controls: You must avoid capturing resident faces or other direct identifiers unless your Facility’s privacy officer confirms valid consent or a legal authority/exception.

2.3 Prohibited Uses: You will not use the Service to store unrelated images, personal photos, or any content unrelated to meal‑consumption documentation; probe, scan, or test the Service; or otherwise circumvent security or usage controls.

3.1 On‑Premises Only: Access is restricted to on‑site use within Facility premises. Off‑premises access is prohibited.

3.2 Facility‑Owned, Managed Devices Only: You may use only Facility‑owned devices that are configured in the Facility’s mobile/endpoint device management and meet security posture requirements. BYOD/personal devices are not permitted.

3.3 Enforcement Signals: To enforce Sections 3.1–3.2, the Service may collect and verify device identifiers, operating system signals, IP addresses, network identifiers, time and approximate location, and MDM compliance status at login and during use.

3.4 Automatic Safeguards: The Company may use IP allow‑listing, geofencing, and conditional access attestation to block off‑premises access or non‑compliant devices and to suspend accounts when violations are detected.

4.1 Custody & Control: PHI captured in the Service is under the Company’s custody and control. The Company processes PHI as agent of the Facility and only on documented instructions, except as required by law.

4.2 Data Residency: PHI is stored in Canadian cloud regions operated by the Company’s sub‑processor(s).

4.3 Monitoring & Audit: The Company and the Facility log and audit user activity for security, compliance, and quality assurance.

4.4 Minimum Necessary & Data Minimization: You must capture only the minimum necessary information to fulfill the meal‑consumption purpose and follow any Facility photo‑framing guides.

4.5 Breach & Incident Reporting: If you suspect a privacy or security incident, you must report immediately through Facility procedures.

5.1 Credentials & MFA: Use only your assigned Facility identity and multi‑factor authentication if configured.

5.2 Device Hygiene: Keep systems updated; do not install unauthorized apps or profiles; maintain device encryption and screen lock per Facility policy.

5.3 No Personal Storage: Do not export, forward, or store images or data to personal email, messaging apps, social platforms, or personal cloud.

6.1 Service IP: The Service, software, and documentation are owned by the Company or its licensors.

6.2 Facility Content: Images, videos, and data you capture for the Facility remain the the Company’s content; you grant the Company and its sub‑processors a limited license to process that content solely to provide and improve the Service for the Facility.

7.1 Grounds: The Company may suspend or terminate access if it reasonably suspects violation of these Terms, off‑premises or non‑Facility device use, security risk, or instructions from the Facility.

7.2 Effect: Upon termination, you will cease use and return any Company property in your possession.

The Company may update the Service and these Terms to address security, legal, or operational needs. Material changes will be communicated via the login page or Facility administrators.

The Service is provided to Authorized Users as part of the Facility’s clinical/operational workflows. It does not provide medical advice and should not be used to make independent clinical diagnoses.

Company Privacy Contact / DPO: colleen.hunter@partnerscommunityhealth.ca

Security Incident Reporting: dlichti@xfood.com

By clicking “I agree” at login and using the Service, you acknowledge that you are an Authorized User, will comply with on‑premises and Facility‑owned device requirements, and will handle PHI in accordance with law and Facility policy.