Terms of Service

These Terms of Service ("Terms") constitute a legally binding agreement between you ("User," "you," or "your") and Glow Holdings, Inc., a Nevada corporation doing business as GlohCo ("Company," "we," "us," or "our"), governing your access to and use of the GlohCare platform available at www.glohcare.com (the "Service"). By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by these Terms.

1. Acceptance of Terms

By creating an account, accessing, or using the Service, you agree to these Terms, our Privacy Policy, and any applicable Business Associate Agreement ("BAA"). If you are using the Service on behalf of a healthcare organization, government agency, or other entity, you represent and warrant that you have the authority to bind that entity to these Terms. If you do not agree to these Terms, you must not access or use the Service.

2. Description of Services

GlohCare is an AI-driven behavioral health intelligence platform that provides clinical decision support, patient engagement, predictive analytics, and care coordination tools. The Service is designed for licensed healthcare providers, authorized clinical staff, facility administrators, and their patients within the United States. The platform operates through three role-based portals:

• Patient Portal: Health monitoring, AI-powered Care Concierge, appointment management, secure messaging, symptom tracking, and care plan engagement.
• Clinician Portal: Clinical Co-Pilot decision support, AI Scribe ambient documentation, GlohPredict™ risk engine, chart review, encounter management, and screening instruments.
• Administrator Portal: Facility analytics, compliance management, access control, audit trail oversight, population health dashboards, and operational reporting.

3. Eligibility

You must be at least eighteen (18) years of age to use the Service. Patients under the age of eighteen (18) may only access the Service through a parent or legal guardian account. Clinician access requires valid professional credentials (e.g., NPI, active state licensure) issued by an authorized healthcare organization. Administrator access requires designation by an authorized organizational representative. Patient access requires enrollment by a participating provider organization.

4. Account Registration and Security

You are responsible for maintaining the confidentiality and security of your account. In connection with your account, you agree to:

• Provide accurate, current, and complete information during registration and keep it updated.
• Maintain a password that meets minimum complexity requirements (at least 12 characters, including uppercase, lowercase, numeric, and special characters) and rotate it every ninety (90) days.
• Enable and maintain multi-factor authentication (MFA) for clinician and administrator accounts, as required by the Service.
• Never share your account credentials with any other person or allow any other person to access your account.
• Notify us immediately at security@glohcare.com of any unauthorized use of your account or any other security breach.
• Accept that sessions will automatically terminate after fifteen (15) minutes of inactivity for the protection of patient data.
• Accept that accounts will be temporarily locked after repeated failed login attempts.

5. Permitted Use

You may use the Service solely for its intended purposes: facilitating healthcare treatment, managing patient health information, clinical decision support, care coordination, and related healthcare operations. All use must comply with applicable federal, state, and local laws and regulations, including but not limited to HIPAA, the HITECH Act, 42 CFR Part 2, and applicable state privacy and licensing laws.

6. Prohibited Use

You agree not to:

• Access patient records without a legitimate treatment, payment, or healthcare operations purpose.
• Share, export, or transmit Protected Health Information (PHI) outside of authorized channels or in violation of applicable law.
• Attempt to circumvent, disable, or interfere with access controls, authentication mechanisms, encryption, or audit logging.
• Use the Service to discriminate against any individual or group on the basis of race, ethnicity, gender, sexual orientation, disability, or any other protected characteristic.
• Reverse engineer, decompile, disassemble, or attempt to extract the source code of the Service or any component thereof.
• Use automated scripts, bots, or scraping tools to access the Service without prior written authorization.
• Introduce malware, viruses, or any other harmful code into the Service.
• Use the Service in any manner that violates applicable laws, regulations, or professional standards of conduct.
• Sublicense, resell, or redistribute access to the Service without the Company's prior written consent.

7. Protected Health Information and HIPAA Compliance

The Service processes Protected Health Information ("PHI") as defined by the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), and the Health Information Technology for Economic and Clinical Health Act ("HITECH Act").

• Healthcare organizations ("Covered Entities") must execute a Business Associate Agreement (BAA) with the Company before any PHI is processed through the Service.
• The Company implements administrative, physical, and technical safeguards in accordance with the HIPAA Security Rule (45 CFR Part 164, Subpart C).
• All PHI is encrypted at rest using AES-256-GCM and in transit using TLS 1.3.
• Access to PHI is controlled through role-based access controls (RBAC) and row-level security (RLS) policies.
• All PHI access events are recorded in tamper-resistant audit logs retained for a minimum of six (6) years.
• Substance Use Disorder (SUD) records receive additional protections under 42 CFR Part 2, including segregated storage and independent consent requirements.
• Individual users must comply with their organization's privacy and security policies and all applicable regulations when using the Service.

8. AI-Generated Content Disclaimer

The Service includes artificial intelligence ("AI") features including, but not limited to, the Care Concierge, Clinical Co-Pilot, AI Scribe, and GlohPredict™ risk engine. You acknowledge and agree that:

• AI outputs are drafts, not medical advice. All AI-generated clinical content, including chart summaries, SOAP note drafts, risk assessments, and care recommendations, are provided as decision-support tools and require review, validation, and approval by a licensed clinician before clinical action is taken.
• AI-generated content is clearly labeled as "AI-Assisted" or "AI Draft" within the Service and must not be used as the sole basis for any clinical decision.
• The Company does not guarantee the accuracy, completeness, timeliness, or clinical appropriateness of any AI-generated output.
• Licensed clinicians retain full professional responsibility for all clinical decisions, diagnoses, treatment plans, and documentation, regardless of whether AI-assisted tools were used.
• Patient-facing AI features (such as the Care Concierge) are designed to support wellness and engagement, not to diagnose conditions or prescribe treatment.
• AI features may produce errors, omissions, or hallucinations. Users must exercise independent professional judgment at all times.

9. Intellectual Property

The Service, including all software, algorithms, interfaces, documentation, trademarks, and content (excluding User-generated content and PHI), is the exclusive property of Glow Holdings, Inc. and is protected by United States and international intellectual property laws. "GlohCare" and "GlohPredict" are trademarks of Glow Holdings, Inc. You may not use our trademarks without prior written consent. Your use of the Service does not grant you any ownership interest in the Service or its underlying technology. All rights not expressly granted herein are reserved.

10. Data Retention

Clinical records and PHI are retained in accordance with applicable federal and state retention requirements, with a minimum retention period of six (6) years as required by HIPAA, or longer where required by applicable state law. Audit logs are retained for a minimum of six (6) years in tamper-proof, write-once storage and cannot be modified or deleted. Non-clinical account data may be deleted upon request, subject to legal retention obligations. Upon termination of a Business Associate Agreement, all PHI will be returned or securely destroyed within thirty (30) days as directed by the Covered Entity, except where retention is required by law.

11. Service Availability and Modifications

We strive to maintain high availability of the Service but do not guarantee uninterrupted access. The Service may be temporarily unavailable due to maintenance, updates, or circumstances beyond our control. We reserve the right to modify, suspend, or discontinue any feature of the Service at any time. Material changes to functionality will be communicated to organizational administrators with reasonable advance notice.

12. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL THE COMPANY, ITS OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, OR AFFILIATES BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, DATA, GOODWILL, OR OTHER INTANGIBLE LOSSES, ARISING OUT OF OR IN CONNECTION WITH YOUR ACCESS TO OR USE OF (OR INABILITY TO ACCESS OR USE) THE SERVICE, WHETHER BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE), STATUTE, OR ANY OTHER LEGAL THEORY, EVEN IF THE COMPANY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THE COMPANY'S TOTAL AGGREGATE LIABILITY TO YOU FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE SHALL NOT EXCEED THE TOTAL FEES PAID BY YOUR ORGANIZATION TO THE COMPANY IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM. THE SERVICE IS PROVIDED FOR CLINICAL DECISION SUPPORT PURPOSES AND DOES NOT CONSTITUTE MEDICAL ADVICE, DIAGNOSIS, OR TREATMENT.

13. Indemnification

You agree to indemnify, defend, and hold harmless the Company and its officers, directors, employees, agents, and affiliates from and against any and all claims, liabilities, damages, losses, costs, and expenses (including reasonable attorneys' fees) arising out of or related to: (a) your use of the Service in violation of these Terms; (b) your violation of any applicable law or regulation; (c) your negligent or wrongful acts or omissions; or (d) any clinical decisions made using the Service.

14. Termination

We may suspend or terminate your access to the Service at any time, with or without cause, and with or without notice, including for violations of these Terms, unauthorized access to PHI, or at the request of your organization. Upon termination, your right to access the Service ceases immediately. Provisions that by their nature should survive termination (including but not limited to Sections 8, 9, 12, 13, and 15) shall survive.

15. Governing Law and Dispute Resolution

These Terms shall be governed by and construed in accordance with the laws of the State of Texas, without regard to its conflict of law provisions. Any legal action or proceeding arising out of or relating to these Terms shall be brought exclusively in the federal or state courts located in Harris County, Texas, and you consent to the personal jurisdiction and venue of such courts. Before initiating any legal proceeding, the parties agree to attempt to resolve disputes through good-faith negotiation for a period of thirty (30) days.

16. Modifications to Terms

We reserve the right to modify these Terms at any time. Material changes will be communicated to organizational administrators via the platform or email at least thirty (30) days before taking effect. The "Effective Date" at the top of this page will be updated to reflect the date of the most recent revision. Your continued use of the Service after the effective date of any modification constitutes your acceptance of the modified Terms.

17. Severability

If any provision of these Terms is held to be invalid, illegal, or unenforceable, the remaining provisions shall continue in full force and effect. The invalid provision shall be modified to the minimum extent necessary to make it valid and enforceable while preserving its original intent.

18. Entire Agreement

These Terms, together with the Privacy Policy and any applicable Business Associate Agreement, constitute the entire agreement between you and the Company with respect to the Service and supersede all prior or contemporaneous communications, proposals, and agreements, whether oral or written.

19. Contact Information

For questions about these Terms or the Service, please contact: