The best answer is found in the IBM license information document for the product that provides you Q Replication (remember that Q Replication comes in several different IBM products). These documents are maintained on ibm.com. However, most people don't know how to navigate them :) so I'll provide links to the most current (as of this post) for each product** and my reply. I'll also use the following picture. It came from the previously-mentioned white paper and blog.
Two-server Q Replication is included at no additional cost in 9.7, three-server in v10. If this is what your replication configuration is, then you have a topology similar to what's shown in the picture. Your DB2 AESE or ISW licensing covers Q Replication for both the HADR primary and the HADR secondary. (See the High Availability/Failover section of those licenses if you need to understand how DB2 AESE or ISW are licensed for HADR primaries and secondaries. You can also see a very good DB2 HA licensing article here on developerWorks.)
If you have a configuration where you must purchase Q Replication for DB2 AESE or ISW, you'll do so through one of the other products listed in this post.
Replication Server has Hot, Idle/Warm, and Cold Standby terms as do DB2 and InfoSphere Warehouse. Data replication products cannot process transactions on an HADR secondary. That means the HADR secondary is a Cold Standby from Replication Server's perspective. You need to purchase Replication Server for the HADR primary, but not the secondary.
IBM InfoSphere Data Replication (IIDR) 10.1 is a packaging of InfoSphere CDC and InfoSphere Replication Server. The IIDR license basically says that it provides unrestricted use of these two products and that the terms in those licenses apply unless overridden by IIDR's. In the case of HADR, the Replication Server Hot, Idle/Warm, and Cold Standby terms apply to Q Replication. That means you have the same answer that I wrote for Replication Server above: Data replication products cannot process transactions on an HADR secondary. That means the HADR secondary is a Cold Standby from Replication Server's perspective. You need to purchase Data Replication for the HADR primary, but not the secondary.