{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "health-gorilla", "name": "Health Gorilla", "vendor": "Health Gorilla, Inc.", "vendorUrl": "https://www.healthgorilla.com", "kind": "http-api", "category": "health-data", "summary": "Health Gorilla is a designated TEFCA QHIN whose FHIR R4 API retrieves patient records from national networks (Patient360), places lab orders and returns results, and sends ADT and clinical alerts, for organisations it onboards.", "url": "https://www.anchorterminal.com/tools/health-gorilla", "markdownUrl": "https://www.anchorterminal.com/tools/health-gorilla.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/health-gorilla.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/health-gorilla.json", "license": "Proprietary service under Health Gorilla's API Terms of Use (updated 22 January 2026), with a signed licence agreement required before production", "transports": [ "http" ], "packages": [], "auth": "oauth", "authNotes": "OAuth 2.0 credentials (client ID and secret) are issued by Health Gorilla during implementation, separately for sandbox and production. Server-to-server calls use the JWT bearer grant with an assertion signed HS256 with the client secret. User-facing apps use the authorisation code grant, and an implicit grant can be enabled. Scopes such as `system/Patient.read`, `system/Observation.write` and `patient360` are assigned at registration and cannot be self-assigned.", "pricing": "paid", "pricingNotes": "No public prices. The API Terms of Use say fees 'are determined on a case-by-case basis by our business development team', and the sandbox is requested through the contact page (checked 2026-10-14).", "priceSummary": "Paid", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer portal, llms.txt or the API terms (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://developer.healthgorilla.com", "llmsTxt": "https://developer.healthgorilla.com/llms.txt", "capabilities": [ "health.records", "health.fhir", "health.consent" ], "tags": [ "hosted", "health-records", "fhir", "qhin", "lab-orders", "oauth", "llms-txt", "webhooks", "status-page", "sales-led", "hitrust", "soc2" ], "lastRelease": "2026-10-14", "graded": true, "anchor": { "graded": true, "score": 59.3, "grade": "C", "agentReady": false, "rank": 583, "ranked": true, "rankOf": 1076, "categoryRank": 4, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 63, "payments": 5, "reliability": 58, "schema": 80, "security": 66, "transparency": 61 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 58, "points": 11.6, "reason": "Read with the hosted lines. status.healthgorilla.com on Statuspage with 11 components and history (20). In the last 90 days the API Server stopped answering for 16 minutes on 29 September 2026 after an internal backlog, and the P360 Responding Gateway lost CommonWell traffic for about 90 minutes on 5 August 2026 during a hosting provider's outage, marked critical. We read the second as a network-side outage and scored between minor and one major (15 of 30). Rate limits are enforced with no numbers (0). Backoff advice, `Retry-After` on async polling and `HG-Idempotency-Key` for POST retries (13 of 15). No SLA was found in public. The Enterprise SaaS Agreement was not read (0). The FHIR API and Patient360 are generally available (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 80, "points": 13, "reason": "Each reference page carries an OpenAPI 3.1 fragment, with no single specification file found (18 of 25). llms.txt and Markdown copies of every page (10). Pages name the required scope and explain workflows such as Patient360 retrieval and async polling (14 of 20). Inputs follow FHIR search parameters with value sets and profiles documented (10 of 15). curl examples, a status code table, OperationOutcome format and common error scenarios (13 of 15). Dated release notes with sandbox and production go-live dates, and FHIR R4 and STU3 versioned paths (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 72, "points": 11.7, "reason": "`_count` and `_offset` size searches and $everything, and C-CDA export condenses a record (15 of 25). Bundle `next` links, search and date filters (18 of 20). OperationOutcome bodies, request IDs and a troubleshooting page (17 of 20). `HG-Idempotency-Key` on POST with replay and 409 on conflict (17 of 20). No official SDK, and every call needs scopes and products provisioned for the tenant (5 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 66, "points": 11.55, "reason": "OAuth 2.0 with scopes assigned per client at registration, tenant context and short-lived tokens. The JWT bearer assertion is signed HS256 with the shared client secret, and an implicit grant can be enabled (25 of 30). Scopes per resource and action, tenant isolation and user roles intersect on every token, but write scopes carry no documented confirmation step (14 of 20). Retrieved C-CDA and FHIR documents come from outside organisations with no prompt-injection guidance (3 of 15). Exchange activity is logged with request IDs, and Network Admin reports list transactions per patient (12 of 15). HITRUST r2, SOC 2 Type II and QHIN designation, a security contact in an expired security.txt page that is not at /.well-known, and no bug bounty (12 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 5, "points": 0.63, "reason": "Read with the hosted rubric. No x402, MPP or L402 (0). Fees are set case by case by business development (0). A sandbox exists but starts with a contact form, with no price stated (5 of 20). A person requests access and Health Gorilla provisions credentials (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 63, "points": 5.51, "reason": "Release 2637_6 went to production on 14 October 2026 (30). Releases 2637_5 (7 October), 2637_4, 2637_3 and others since August (20). Closed service with dated release notes and a support desk. We did not test support (10 of 15). No official SDK was found (0 of 15). Docs carry agent tool metadata and are updated through October 2026 (3 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 61, "points": 5.34, "note": "editorial 38, provenance 83", "reason": "Closed service under API terms updated 22 January 2026, which allow termination at any time and amendment without notice (15 of 30). The privacy policy (30 August 2024) covers the website and platforms with no retention periods, and a separate notice covers patient access, with no public DPA (12 of 30). Release notes give dated changes, with no written deprecation policy (8 of 20). No sub-processor list or data location was found (3 of 20)." } ], "assessment": { "date": "2026-10-14", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "`_count` and `_offset` size searches and $everything, and C-CDA export condenses a record (15 of 25). Bundle `next` links, search and date filters (18 of 20). OperationOutcome bodies, request IDs and a troubleshooting page (17 of 20). `HG-Idempotency-Key` on POST with replay and 409 on conflict (17 of 20). No official SDK, and every call needs scopes and products provisioned for the tenant (5 of 15).", "maintenance": "Release 2637_6 went to production on 14 October 2026 (30). Releases 2637_5 (7 October), 2637_4, 2637_3 and others since August (20). Closed service with dated release notes and a support desk. We did not test support (10 of 15). No official SDK was found (0 of 15). Docs carry agent tool metadata and are updated through October 2026 (3 of 10).", "payments": "Read with the hosted rubric. No x402, MPP or L402 (0). Fees are set case by case by business development (0). A sandbox exists but starts with a contact form, with no price stated (5 of 20). A person requests access and Health Gorilla provisions credentials (0).", "reliability": "Read with the hosted lines. status.healthgorilla.com on Statuspage with 11 components and history (20). In the last 90 days the API Server stopped answering for 16 minutes on 29 September 2026 after an internal backlog, and the P360 Responding Gateway lost CommonWell traffic for about 90 minutes on 5 August 2026 during a hosting provider's outage, marked critical. We read the second as a network-side outage and scored between minor and one major (15 of 30). Rate limits are enforced with no numbers (0). Backoff advice, `Retry-After` on async polling and `HG-Idempotency-Key` for POST retries (13 of 15). No SLA was found in public. The Enterprise SaaS Agreement was not read (0). The FHIR API and Patient360 are generally available (10).", "schema": "Each reference page carries an OpenAPI 3.1 fragment, with no single specification file found (18 of 25). llms.txt and Markdown copies of every page (10). Pages name the required scope and explain workflows such as Patient360 retrieval and async polling (14 of 20). Inputs follow FHIR search parameters with value sets and profiles documented (10 of 15). curl examples, a status code table, OperationOutcome format and common error scenarios (13 of 15). Dated release notes with sandbox and production go-live dates, and FHIR R4 and STU3 versioned paths (15).", "security": "OAuth 2.0 with scopes assigned per client at registration, tenant context and short-lived tokens. The JWT bearer assertion is signed HS256 with the shared client secret, and an implicit grant can be enabled (25 of 30). Scopes per resource and action, tenant isolation and user roles intersect on every token, but write scopes carry no documented confirmation step (14 of 20). Retrieved C-CDA and FHIR documents come from outside organisations with no prompt-injection guidance (3 of 15). Exchange activity is logged with request IDs, and Network Admin reports list transactions per patient (12 of 15). HITRUST r2, SOC 2 Type II and QHIN designation, a security contact in an expired security.txt page that is not at /.well-known, and no bug bounty (12 of 20).", "transparency": "Closed service under API terms updated 22 January 2026, which allow termination at any time and amendment without notice (15 of 30). The privacy policy (30 August 2024) covers the website and platforms with no retention periods, and a separate notice covers patient access, with no public DPA (12 of 30). Release notes give dated changes, with no written deprecation policy (8 of 20). No sub-processor list or data location was found (3 of 20)." }, "sources": [ { "what": "documentation index", "url": "https://developer.healthgorilla.com/llms.txt", "seen": "2026-10-14" }, { "what": "prerequisites", "url": "https://developer.healthgorilla.com/docs/prerequisites.md", "seen": "2026-10-14" }, { "what": "sandbox", "url": "https://developer.healthgorilla.com/docs/sandbox-environment.md", "seen": "2026-10-14" }, { "what": "authorisation flows", "url": "https://developer.healthgorilla.com/docs/oauth-20.md", "seen": "2026-10-14" }, { "what": "scopes", "url": "https://developer.healthgorilla.com/docs/scopes-access-control.md", "seen": "2026-10-14" }, { "what": "idempotent requests", "url": "https://developer.healthgorilla.com/reference/idempotent-requests.md", "seen": "2026-10-14" }, { "what": "security", "url": "https://developer.healthgorilla.com/docs/copy-of-governance.md", "seen": "2026-10-14" }, { "what": "release notes", "url": "https://developer.healthgorilla.com/changelog/v2637_6-1.md", "seen": "2026-10-14" }, { "what": "API terms of use", "url": "https://developer.healthgorilla.com/docs/terms-of-use.md", "seen": "2026-10-14" }, { "what": "status incidents", "url": "https://status.healthgorilla.com/api/v2/incidents.json", "seen": "2026-10-14" }, { "what": "privacy policy", "url": "https://www.healthgorilla.com/home/privacy-policy", "seen": "2026-10-14" }, { "what": "security.txt page", "url": "https://www.healthgorilla.com/home/security-txt", "seen": "2026-10-14" } ], "openQuestions": [ "unchecked: the Enterprise SaaS Agreement (July 2024) linked from the website terms page, including any SLA", "No rate limit numbers were found in the developer portal", "No official SDK or GitHub repository was confirmed, because the GitHub API rate-limited us" ] }, "negative": 0, "verdict": "A TEFCA QHIN with a FHIR R4 API, OpenAPI fragments on every reference page, idempotency keys on POST and dated weekly release notes. Access is sales-led, with case-by-case fees, a sandbox by request and no published rate limit numbers, and the API terms allow access to be cut at any time.", "bestFor": "US providers, labs and digital health companies that need network record retrieval and lab ordering through one FHIR API with a QHIN behind it.", "strengths": [ "Designated TEFCA QHIN with Patient360 retrieval across national networks, plus lab orders and ADT alerts", "`HG-Idempotency-Key` on POST, replaying the first response and returning 409 on conflicts", "llms.txt, Markdown pages and an OpenAPI 3.1 fragment on each reference page", "Release notes dated separately for sandbox and production, the latest on 14 October 2026" ], "weaknesses": [ "No public prices. Fees are set case by case and the sandbox is requested by form", "Rate limits are enforced with no published numbers", "JWT bearer assertions are signed HS256 with the shared client secret", "The API terms allow termination or disabling of access at any time, with or without notice" ], "agentNotes": [ "Send a fresh UUID in `HG-Idempotency-Key` on every POST and reuse it only when retrying the same payload", "Poll async operations no sooner than the `Retry-After` value and treat 454 as an expired result", "Follow `link.relation=next` in Bundles rather than building offsets yourself", "Expect mocked Patient360 data in sandbox unless network connectivity is enabled for the tenant", "Log `X-HG-Request-Id` from each response for support cases" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 59.3 } ], "editorialScores": { "ergonomics": 72, "maintenance": 63, "payments": 5, "reliability": 58, "schema": 80, "security": 66, "transparency": 38 }, "provenanceScore": 83 }, "connect": { "http": "GET https://sandbox.healthgorilla.com/fhir/R4/Patient?_count=50\nAuthorization: Bearer \u003caccess-token\u003e\nAccept: application/fhir+json" }, "letme": { "capability": "https://letme.dev/health.records", "tool": "https://letme.dev/health-gorilla" }, "notable": [ "Health Gorilla is a designated Qualified Health Information Network under TEFCA, and lists HITRUST CSF r2 and SOC 2 Type II (https://developer.healthgorilla.com/docs/copy-of-governance.md)", "POST requests take an `HG-Idempotency-Key` UUID. Repeats within about an hour return the original response and a different payload under the same key returns 409 (https://developer.healthgorilla.com/reference/idempotent-requests.md)", "Sandbox access starts with a request through the contact page, and Patient360 network requests there are mocked by default (https://developer.healthgorilla.com/docs/sandbox-environment.md)", "Release notes give separate go-live dates for sandbox and production, the latest being release 2637_6 in production on 14 October 2026 (https://developer.healthgorilla.com/changelog/v2637_6-1.md)", "status.healthgorilla.com shows a 16-minute API outage on 29 September 2026 caused by an internal message backlog, and a CommonWell outage on 5 August 2026 from a hosting provider (https://status.healthgorilla.com/api/v2/incidents.json)", "The API terms bar competitors from using the APIs, and let Health Gorilla terminate or disable access at any time with or without notice (https://developer.healthgorilla.com/docs/terms-of-use.md)" ], "area": "domain-data", "details": [ { "label": "Endpoints", "value": "FHIR R4 at https://api.healthgorilla.com/fhir/R4/ and sandbox https://sandbox.healthgorilla.com/fhir/R4/, plus STU3" }, { "label": "Products", "value": "Patient360 record retrieval ($p360-retrieve, HIN document query, structured retrieval), Clinical Alerts and ADT, Lab Network orders and results, Individual Access Services, Patient Chart viewer and iFrames" }, { "label": "Credentials", "value": "OAuth 2.0 client ID and secret per environment, JWT bearer (HS256), authorisation code and optional implicit grants, scopes assigned at registration" }, { "label": "Pagination", "value": "FHIR Bundles with `link.relation=next`, `_count` and `_offset`, also on $everything" }, { "label": "Async", "value": "Long operations return 202 with `Retry-After` and `X-Progress`, and 454 once a result expires" }, { "label": "Errors", "value": "HTTP status table, FHIR OperationOutcome bodies, `X-HG-Request-Id` for correlation and a page of common error scenarios" }, { "label": "Rate limits", "value": "Enforced, with advice to avoid bursts and back off, but no numbers published" }, { "label": "OpenAPI", "value": "OpenAPI 3.1 fragments on each reference page (spec fhir-r4-api-sandbox 1.1.0), with no single specification file found" }, { "label": "Status", "value": "status.healthgorilla.com on Statuspage, 11 components including API Server and the P360 gateways" }, { "label": "Certifications", "value": "HIPAA, TEFCA QHIN, HITRUST CSF r2 and SOC 2 Type II per the security page" } ], "provenance": { "legalEntity": "Health Gorilla, Inc.", "domain": "healthgorilla.com", "domainRegistered": "2006-04-09", "endpointOnVendorDomain": true, "terms": "https://developer.healthgorilla.com/docs/terms-of-use", "privacy": "https://www.healthgorilla.com/home/privacy-policy", "statusPage": "https://status.healthgorilla.com", "changelog": "https://developer.healthgorilla.com/changelog", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The API Terms of Use (updated 22 January 2026) are between the developer and Health Gorilla, Inc., require a signed licence before production, and may be amended with or without notice.", "The privacy policy (last updated 30 August 2024) names Health Gorilla, Inc., covers the website and its platforms, gives no retention periods or sub-processors, and lists a Coral Gables, FL mailing address.", "www.healthgorilla.com/.well-known/security.txt returns the site's 404 page. A page at /home/security-txt shows a security.txt with Contact security@healthgorilla.com and Expires 2025-12-31.", "The website's Terms of Use page links an Enterprise SaaS Agreement (July 2024 version) that we did not read.", "RDAP gives healthgorilla.com a registration date of 2006-04-09." ], "score": 83, "checks": [ { "check": "Legal entity named", "value": "Health Gorilla, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "healthgorilla.com, registered 2006-04-09 (20 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "healthgorilla.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 5 of the 7 things a reader expects, and has 2 clauses that cost points", "points": 4.3, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 6 of the 8 things a reader expects", "points": 8.5, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.healthgorilla.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://developer.healthgorilla.com/docs/terms-of-use", "state": "read", "readAt": "2026-10-14", "words": 3474, "points": 4.3, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": false }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "This Agreement shall be governed by the laws of the state of California, USA and all claims relating to or arising out of this Agreement, or the breach thereof, whether sounding in contract, tort or otherwise, shall likewise be governed by the laws of the state of California, in each case, without regard to its choice…", "says": "The law of the State of California" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "…AGGREGATE LIABILITY OF HEALTH GORILLA TO DEVELOPER ARISING IN CONNECTION WITH THIS AGREEMENT SHALL BE LIMITED TO $100.", "says": "Capped at $100" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "HEALTH GORILLA MAY MODIFY OR TERMINATE OR RESTRICT ACCESS TO THE APIS AT ANY TIME WITHOUT NOTICE." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "By entering into this Agreement, Developer consents to receiving phone calls, emails, texts or any other type of messages from Health Gorilla to inform it of changes or additions to the Health Gorilla Products, this Agreement, the APIs or the API Documentation and any other matter related to the foregoing and for gene…", "says": "Says it gives notice of a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "…Web Site and Products Terms and Conditions of Use, Privacy Statement, Anti-Spam Policy, and any other acceptable use policy, content restrictions, user agreements, and other terms and conditions governing use of the Health Gorilla Products, generally available through the Health Gorilla websites, as each of the forego…" }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "(ii) use or enable its customers to use the APIs for the purposes of testing or comparison of Health Gorilla Products or for any purpose competitive with Health Gorilla Products", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "this Agreement may be amended from time to time by Health Gorilla with or without advance notice to Developer", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "HEALTH GORILLA MAY MODIFY OR TERMINATE OR RESTRICT ACCESS TO THE APIS AT ANY TIME WITHOUT NOTICE." } ], "notes": [ { "date": "2026-10-14", "text": "Health Gorilla's maximum total liability to the developer under this agreement is 100 US dollars.", "quote": "THE MAXIMUM AGGREGATE LIABILITY OF HEALTH GORILLA TO DEVELOPER ARISING IN CONNECTION WITH THIS AGREEMENT SHALL BE LIMITED TO $100." }, { "date": "2026-10-14", "text": "The developer grants Health Gorilla a perpetual licence to use ideas learned from observing its offerings and to use its name and logo in promotion.", "quote": "Developer hereby grants to Health Gorilla a non-exclusive, royalty-free, irrevocable, perpetual license (i) to use any ideas that Health Gorilla learns from observing Developer's Offerings or other use of the APIs" } ] }, { "kind": "privacy", "url": "https://www.healthgorilla.com/home/privacy-policy", "state": "read", "readAt": "2026-10-14", "statedDate": "2024-08-30", "words": 3932, "points": 8.5, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: August 30, 2024", "says": "Last updated 2024-08-30" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This Policy also describes how we collect, use, secure, and share your personal information when you:" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We may store your personal information for as long as we need it to provide you with our services and to perform the activities described in this Policy, to the extent permitted by law." }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "When you request us to share certain information with third parties." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "In the preceding 12 months, Health Gorilla has not sold personal information.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": false }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you live in another part of the world not specifically mentioned here, please contact us as detailed in the Contacting Us section of this Policy." }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": false } ], "notes": [ { "date": "2026-10-14", "text": "Health Gorilla may change the policy without prior notice and apply the changes to information it received before the change took effect.", "quote": "We reserve the right to make changes to our Policy at any time without prior notice and to apply the changes to information received by us before the effective date of the change." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/health-gorilla.json", "live": { "slug": "health-gorilla", "vendorStatus": { "page": "https://status.healthgorilla.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-14T09:39:15.462244766Z" }, "updatedAt": "2026-10-14T09:39:15.462244766Z" } } }