{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "medplum", "name": "Medplum", "vendor": "Orangebot, Inc. (dba Medplum)", "vendorUrl": "https://www.medplum.com", "kind": "http-api", "category": "health-data", "summary": "Open-source FHIR R4 server and healthcare developer platform from Orangebot, Inc. (dba Medplum). Agents reach patient records through the hosted FHIR REST API at api.medplum.com, a remote MCP server or a self-hosted copy.", "url": "https://www.anchorterminal.com/tools/medplum", "markdownUrl": "https://www.anchorterminal.com/tools/medplum.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/medplum.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/medplum.json", "repo": "https://github.com/medplum/medplum", "license": "Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service", "transports": [ "http", "streamable-http", "sse" ], "remoteUrl": "https://api.medplum.com/mcp/stream", "packages": [ { "registry": "npm", "name": "@medplum/core" } ], "auth": "oauth", "authNotes": "OAuth 2.0 and OpenID Connect. Machine clients use the client credentials grant with a ClientApplication ID and secret created on the Project Admin page, and a POST to https://api.medplum.com/oauth2/token. SMART scopes and AccessPolicy resources limit what each user, bot or client can read or write, including read-only policies. The MCP server uses OAuth with a browser login on first connect. Client assertion, token exchange, on-behalf-of and mTLS are also documented.", "pricing": "freemium", "pricingNotes": "Hosted plans on medplum.com/pricing (checked 2026-10-14). Free for prototyping, Production $2,000 a month, Premium $6,000 a month, Enterprise by contact. The paid plans include a standard BAA and MSA. Self-hosting the Apache 2.0 server is free. Whether the free plan asks for a card was not established.", "priceSummary": "$2000 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the pricing page or the repository (checked 2026-10-14).", "endpoints": [] }, "toolCount": 3, "popularity": { "githubStars": 2738, "npmWeekly": 269965, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://www.medplum.com/docs", "llmsTxt": "https://www.medplum.com/llms.txt", "registryName": "com.medplum/mcp", "capabilities": [ "health.fhir", "health.records" ], "tags": [ "hosted", "open-source", "self-hosted", "fhir", "mcp", "oauth", "smart-on-fhir", "hipaa", "soc2", "typescript", "llms-txt", "status-page" ], "lastRelease": "2026-10-08", "graded": true, "anchor": { "graded": true, "score": 68.7, "grade": "B", "agentReady": false, "rank": 216, "ranked": true, "rankOf": 1076, "categoryRank": 1, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 73, "maintenance": 93, "payments": 25, "reliability": 75, "schema": 82, "security": 74, "transparency": 72 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 75, "points": 15, "reason": "Read with the hosted lines and scored on the hosted FHIR API at api.medplum.com, which is what an agent would call. The docs name a status page at status.medplum.com with incident history and root cause analyses (20). Its robots.txt disallows every path, so the 90-day record was not read (5). Rate limits are published per IP and tier, with a weighted FHIR interaction quota (15). Every limited response carries a `RateLimit` header with remaining units and reset time, the docs say not to retry before the reset, and conditional create and upsert make writes safe to repeat (15). The docs state a 99.99 per cent monthly SLA with service credits for the production hosted platform (10). The FHIR API is generally available (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 82, "points": 13.33, "reason": "The server generates an OpenAPI 3.1 document (packages/server/src/openapi.ts) and publishes a FHIR CapabilityStatement. The live copies sit on api.medplum.com, which robots.txt disallows, so they were not read (20 of 25). llms.txt indexes 2,600 lines of docs (10). Each FHIR resource and operation has a reference page, and the MCP doc explains when to use each tool (15 of 20). FHIR resources are typed with required fields and value sets, though the MCP tool takes `method` and `path` as free strings and `body` as any JSON (12 of 15). Docs carry curl, TypeScript and Python examples, with errors as FHIR OperationOutcome (12 of 15). Semver and GitHub releases with notes (15). Total 84, less 2 for the loosely typed MCP schema in source, 82." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 73, "points": 11.86, "reason": "FHIR `_count`, `_elements`, `_summary` and `_include` size responses (22 of 25). Cursor and offset paging, chained search and `_filter` (20). Errors are OperationOutcome with HTTP status, and 429s carry the `RateLimit` header (15 of 20). Conditional create and upsert give safe retries, but no idempotency key header and no MCP readOnlyHint or destructiveHint on `fhir-request` (8 of 20). Few required parameters, with the official SDK in TypeScript only and Python shown as raw requests (8 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 74, "points": 12.95, "reason": "OAuth 2.0 with client credentials, SMART scopes, client assertion, token exchange and mTLS. Client secrets belong to a ClientApplication that an admin can delete (28 of 30). AccessPolicy resources give read-only access by resource or element, IP access rules and per-member policies. No confirmation step for destructive writes, including through the MCP tool (15 of 20). Records are written by other users and returned to the model, and no prompt-injection guidance was found beyond a caution in the AI coding page (3 of 15). FHIR AuditEvent resources and log streaming on paid plans (12 of 15). security.txt valid with PGP, SOC 2 Type II, advisories published on GitHub, no bug bounty found (16 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 25, "points": 3.13, "reason": "Read with the hosted rubric, since the hosted service is what an agent would call. No x402, MPP or L402 (0). Plan prices are public, Production $2,000 and Premium $6,000 a month, with no per-call price (10). A free hosted plan exists for prototyping, and whether sign-up asks for a card was not established (15 of 20). A person registers at app.medplum.com and creates a ClientApplication in a browser (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 93, "points": 8.14, "reason": "v5.2.3 tagged on 8 October 2026 (30). Nine tags between 24 September and 8 October 2026 (20). 571 open issues, with commits landing daily and pull requests reviewed, and Discord plus email support. Reply times were not measured (18 of 25). Listed in the official MCP registry as com.medplum/mcp, and @medplum/core 5.2.3 is current with 269,965 weekly downloads (15). The Build workflow passed on main on 14 October 2026, with CodeQL and OpenSSF Scorecard runs (10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 72, "points": 6.3, "note": "editorial 65, provenance 78", "reason": "Apache 2.0 source for the server (30). The privacy policy was last updated on 5 April 2022 and is written for licensed clinicians, the terms on 11 April 2023 grant Medplum a broad licence over user content, and PHI is handled under a BAA. No retention periods were found (12 of 30). A written version policy sets one year active and one year maintenance per major, with security patch deadlines (18 of 20). The docs say hosting runs on AWS across several Availability Zones. No sub-processor list was found (5 of 20)." } ], "assessment": { "date": "2026-10-14", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "FHIR `_count`, `_elements`, `_summary` and `_include` size responses (22 of 25). Cursor and offset paging, chained search and `_filter` (20). Errors are OperationOutcome with HTTP status, and 429s carry the `RateLimit` header (15 of 20). Conditional create and upsert give safe retries, but no idempotency key header and no MCP readOnlyHint or destructiveHint on `fhir-request` (8 of 20). Few required parameters, with the official SDK in TypeScript only and Python shown as raw requests (8 of 15).", "maintenance": "v5.2.3 tagged on 8 October 2026 (30). Nine tags between 24 September and 8 October 2026 (20). 571 open issues, with commits landing daily and pull requests reviewed, and Discord plus email support. Reply times were not measured (18 of 25). Listed in the official MCP registry as com.medplum/mcp, and @medplum/core 5.2.3 is current with 269,965 weekly downloads (15). The Build workflow passed on main on 14 October 2026, with CodeQL and OpenSSF Scorecard runs (10).", "payments": "Read with the hosted rubric, since the hosted service is what an agent would call. No x402, MPP or L402 (0). Plan prices are public, Production $2,000 and Premium $6,000 a month, with no per-call price (10). A free hosted plan exists for prototyping, and whether sign-up asks for a card was not established (15 of 20). A person registers at app.medplum.com and creates a ClientApplication in a browser (0).", "reliability": "Read with the hosted lines and scored on the hosted FHIR API at api.medplum.com, which is what an agent would call. The docs name a status page at status.medplum.com with incident history and root cause analyses (20). Its robots.txt disallows every path, so the 90-day record was not read (5). Rate limits are published per IP and tier, with a weighted FHIR interaction quota (15). Every limited response carries a `RateLimit` header with remaining units and reset time, the docs say not to retry before the reset, and conditional create and upsert make writes safe to repeat (15). The docs state a 99.99 per cent monthly SLA with service credits for the production hosted platform (10). The FHIR API is generally available (10).", "schema": "The server generates an OpenAPI 3.1 document (packages/server/src/openapi.ts) and publishes a FHIR CapabilityStatement. The live copies sit on api.medplum.com, which robots.txt disallows, so they were not read (20 of 25). llms.txt indexes 2,600 lines of docs (10). Each FHIR resource and operation has a reference page, and the MCP doc explains when to use each tool (15 of 20). FHIR resources are typed with required fields and value sets, though the MCP tool takes `method` and `path` as free strings and `body` as any JSON (12 of 15). Docs carry curl, TypeScript and Python examples, with errors as FHIR OperationOutcome (12 of 15). Semver and GitHub releases with notes (15). Total 84, less 2 for the loosely typed MCP schema in source, 82.", "security": "OAuth 2.0 with client credentials, SMART scopes, client assertion, token exchange and mTLS. Client secrets belong to a ClientApplication that an admin can delete (28 of 30). AccessPolicy resources give read-only access by resource or element, IP access rules and per-member policies. No confirmation step for destructive writes, including through the MCP tool (15 of 20). Records are written by other users and returned to the model, and no prompt-injection guidance was found beyond a caution in the AI coding page (3 of 15). FHIR AuditEvent resources and log streaming on paid plans (12 of 15). security.txt valid with PGP, SOC 2 Type II, advisories published on GitHub, no bug bounty found (16 of 20).", "transparency": "Apache 2.0 source for the server (30). The privacy policy was last updated on 5 April 2022 and is written for licensed clinicians, the terms on 11 April 2023 grant Medplum a broad licence over user content, and PHI is handled under a BAA. No retention periods were found (12 of 30). A written version policy sets one year active and one year maintenance per major, with security patch deadlines (18 of 20). The docs say hosting runs on AWS across several Availability Zones. No sub-processor list was found (5 of 20)." }, "sources": [ { "what": "documentation index for agents", "url": "https://www.medplum.com/llms.txt", "seen": "2026-10-14" }, { "what": "MCP server docs", "url": "https://www.medplum.com/docs/ai/mcp", "seen": "2026-10-14" }, { "what": "MCP server source", "url": "https://github.com/medplum/medplum/blob/main/packages/server/src/mcp/server.ts", "seen": "2026-10-14" }, { "what": "rate limits", "url": "https://www.medplum.com/docs/rate-limits", "seen": "2026-10-14" }, { "what": "uptime and SLA", "url": "https://www.medplum.com/docs/uptime", "seen": "2026-10-14" }, { "what": "version policy", "url": "https://www.medplum.com/docs/compliance/versions", "seen": "2026-10-14" }, { "what": "client credentials", "url": "https://www.medplum.com/docs/auth/client-credentials", "seen": "2026-10-14" }, { "what": "access policies", "url": "https://www.medplum.com/docs/access/access-policies", "seen": "2026-10-14" }, { "what": "conditional create and upsert", "url": "https://www.medplum.com/docs/fhir-datastore/working-with-fhir", "seen": "2026-10-14" }, { "what": "pricing", "url": "https://www.medplum.com/pricing", "seen": "2026-10-14" }, { "what": "security page", "url": "https://www.medplum.com/security", "seen": "2026-10-14" }, { "what": "security.txt", "url": "https://www.medplum.com/.well-known/security.txt", "seen": "2026-10-14" }, { "what": "terms of service", "url": "https://www.medplum.com/terms", "seen": "2026-10-14" }, { "what": "privacy policy", "url": "https://www.medplum.com/privacy", "seen": "2026-10-14" }, { "what": "repository, tags and CI", "url": "https://github.com/medplum/medplum", "seen": "2026-10-14" }, { "what": "security advisories", "url": "https://github.com/medplum/medplum/security/advisories", "seen": "2026-10-14" }, { "what": "official MCP registry entry", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=medplum", "seen": "2026-10-14" }, { "what": "npm downloads", "url": "https://api.npmjs.org/downloads/point/last-week/@medplum/core", "seen": "2026-10-14" } ], "openQuestions": [ "unchecked: the incident history at status.medplum.com. Its robots.txt disallows all paths, so it was not fetched", "unchecked: the live OpenAPI document and CapabilityStatement on api.medplum.com, whose robots.txt disallows all paths", "unchecked: whether the free hosted plan asks for a card at sign-up", "unchecked: the domain registration date for medplum.com", "GHSA-fjgc-c3pj-xx2c is cited in the MCP source as the reason for an SSRF guard but was not found among the repository's published advisories" ] }, "negative": -2, "negativeNotes": [ "2026-07-24: GHSA-m44r-7c5h-m6mj, high severity. The external auth callback accepted redirect URIs that only had to start with a registered one, which could leak authorisation codes cross-origin. Patched in @medplum/core 5.1.6 and disclosed on GitHub (https://github.com/medplum/medplum/security/advisories/GHSA-m44r-7c5h-m6mj). With GHSA-ch8p-j6cm-r7w5 (2 June 2026, client secret exposure in self-hosted dynamic registration), both fixed and disclosed in public, so the deduction is small (-2)." ], "verdict": "Graded on the hosted FHIR API at api.medplum.com. Rate limits, a `RateLimit` header and a 99.99 per cent SLA are published, AccessPolicy resources allow read-only clients, and an official MCP server sits in the registry. Its main tool can delete records with no annotation, the status page could not be read, and the privacy policy dates from 2022.", "bestFor": "An agent working inside a digital health company's own FHIR store, reading and writing patients, observations and appointments under a BAA.", "strengths": [ "Apache 2.0 server with releases about weekly, v5.2.3 on 8 October 2026, and a written version policy", "Rate limits published per tier, with a `RateLimit` header giving remaining units and seconds to reset", "AccessPolicy resources and SMART scopes allow read-only, per-resource or per-element clients", "Official MCP server at api.medplum.com/mcp/stream, listed in the MCP registry as com.medplum/mcp, with OAuth", "99.99 per cent monthly SLA with service credits stated for the production hosted platform" ], "weaknesses": [ "The MCP `fhir-request` tool can delete or overwrite any resource the token allows, with no readOnlyHint or destructiveHint", "The privacy policy was last updated on 5 April 2022 and the terms on 11 April 2023", "No sub-processor list or retention periods were found", "Two high-severity auth advisories were published and patched in 2026", "Official SDK in TypeScript only" ], "agentNotes": [ "Use a ClientApplication with an AccessPolicy limited to the resources the task needs, and set `readonly` where no writes are needed", "Read the `RateLimit` header and wait for the reset time after a 429. Writes cost 100 quota points, searches 20 and reads 1", "Create patients with conditional create (`If-None-Exist`) or upsert on an identifier so a retry doesn't make a duplicate", "Pass paths to `fhir-request` relative to the FHIR R4 base, with no leading slash or `/fhir/R4` prefix", "Use `Prefer: respond-async` for large bundles. Operations inside the background job don't count against the quota" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68.7 } ], "editorialScores": { "ergonomics": 73, "maintenance": 93, "payments": 25, "reliability": 75, "schema": 82, "security": 74, "transparency": 65 }, "provenanceScore": 78 }, "connect": { "install": "npm install @medplum/core", "http": "curl -X POST https://api.medplum.com/oauth2/token \\\n -H \"Content-Type: application/x-www-form-urlencoded\" \\\n -d \"grant_type=client_credentials\u0026client_id=$MY_CLIENT_ID\u0026client_secret=$MY_CLIENT_SECRET\"" }, "letme": { "capability": "https://letme.dev/health.fhir", "tool": "https://letme.dev/medplum" }, "notable": [ "The MCP server at https://api.medplum.com/mcp/stream has three tools. `fhir-request` sends any GET, POST, PUT, PATCH or DELETE to the FHIR R4 API, and `search` and `fetch` are stubs kept for ChatGPT compatibility (https://www.medplum.com/docs/ai/mcp)", "Rate limits are published per IP (6,000 requests a minute on the free tier, 60,000 on paid) plus a weighted FHIR interaction quota, with a `RateLimit` header on every response (https://www.medplum.com/docs/rate-limits)", "The docs state a 99.99 per cent monthly uptime SLA with service credits for the production hosted platform (https://www.medplum.com/docs/uptime)", "Two high-severity advisories were published in 2026 and patched, an authorisation code leak in the external auth callback (GHSA-m44r-7c5h-m6mj, 24 July) and a client secret exposure in self-hosted dynamic registration (GHSA-ch8p-j6cm-r7w5, 2 June) (https://github.com/medplum/medplum/security/advisories)", "Semver releases about weekly, v5.2.3 on 8 October 2026, with a written version policy of one year active and one year maintenance per major (https://www.medplum.com/docs/compliance/versions)", "SOC 2 Type II audit completed, with the report on request, and security.txt valid to February 2027 (https://www.medplum.com/security)" ], "area": "domain-data", "details": [ { "label": "API", "value": "FHIR R4 REST at https://api.medplum.com/fhir/R4, with batch and transaction bundles, async bundles (`Prefer: respond-async`), Bulk FHIR export, GraphQL and custom operations. An OpenAPI 3.1 document is generated by the server (packages/server/src/openapi.ts)" }, { "label": "MCP server", "value": "https://api.medplum.com/mcp/stream (Streamable HTTP) and /mcp/sse. Tools fhir-request, search and fetch. OAuth. Registry name com.medplum/mcp" }, { "label": "Rate limits", "value": "Per IP per minute, login 5, auth 160, other endpoints 6,000 (free) or 60,000 (paid). FHIR quota points, read 1, search 20, history 10, create, update, patch or delete 100, with a project total of ten times the per-user limit" }, { "label": "SLA", "value": "99.99 per cent monthly for the production hosted platform, with service credits defined in the customer agreement" }, { "label": "Plans", "value": "Free, Production $2,000 a month, Premium $6,000 a month, Enterprise by contact. Self-hosted Community free" }, { "label": "Versions", "value": "Semver, majors yearly in Q4 with one year active and one year maintenance, patches about weekly. Security patches for critical issues within 7 days and high within 14" }, { "label": "Certifications", "value": "SOC 2 Type II (report on request), standard BAA on paid plans" } ], "unitPrices": [ { "item": "Production plan", "unit": "month", "usd": 2000, "note": "Hosted, BAA included, Growth usage tier" }, { "item": "Premium plan", "unit": "month", "usd": 6000, "note": "Hosted, adds lab, medication and HL7 integrations" } ], "provenance": { "legalEntity": "Orangebot, Inc.", "domain": "medplum.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.medplum.com/terms", "privacy": "https://www.medplum.com/privacy", "statusPage": "https://status.medplum.com", "changelog": "https://github.com/medplum/medplum/releases", "securityTxt": "valid", "checked": "2026-10-14", "notes": [ "The pricing and security pages name Orangebot, Inc (dba Medplum).", "www.medplum.com/.well-known/security.txt lists security@medplum.com, a PGP key and expires 2027-02-28.", "robots.txt on api.medplum.com and status.medplum.com disallows every path for all agents, so the status history and the live OpenAPI document were not read.", "The terms of service were last updated 2023-04-11 and the privacy policy 2022-04-05.", "The domain registration date was not established." ], "score": 78, "checks": [ { "check": "Legal entity named", "value": "Orangebot, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "medplum.com, no registry record we could read", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "api.medplum.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects, and has 1 clause that costs points", "points": 7.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 3 of the 8 things a reader expects", "points": 6.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.medplum.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://www.medplum.com/terms", "state": "read", "readAt": "2026-10-14", "statedDate": "2023-04-11", "words": 7143, "points": 7.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: 2023-04-11", "says": "Last updated 2023-04-11" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "These Terms and the relationship between you and Medplum shall be governed by the laws of the state of California without regard to its conflict of law provisions.", "says": "The law of the State of California" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "TO THE FULLEST EXTENT POSSIBLE BY LAW, OUR MAXIMUM LIABILITY ARISING OUT OF OR IN CONNECTION WITH THE MEDPLUM SERVICE OR YOUR USE OF MEDPLUM CONTENT, REGARDLESS OF THE CAUSE OF ACTION (WHETHER IN CONTRACT, TORT, BREACH OF WARRANTY, OR OTHERWISE), WILL NOT EXCEED $100.", "says": "Capped at $100" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "You agree that we may terminate your access to the Medplum Service at any time if we are unable at any time to determine or verify your qualifications or credentials." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "We may revise these Terms at any time by posting an updated version to this web page.", "says": "Changes are posted, with no other notice named" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "If you do not accept these Terms, you must not use the Medplum Service." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "We may change, suspend, or discontinue any aspect of the Medplum Service at any time, including hours of operation or availability of the Medplum Service or any feature, without notice or liability.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "We reserve the right to suspend or terminate your account and prevent access to the Medplum Service for any reason, at our discretion." }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "We will use arbitration to resolve any problems, and you cannot join a class action lawsuit or obtain a jury trial for any disputes you have with us related to your use of the Medplum Service." }, { "key": "old", "label": "Has not been updated for three years or more", "found": true, "quote": "Last Updated: 2023-04-11" } ], "notes": [ { "date": "2026-10-14", "text": "Medplum caps its total liability at 100 US dollars.", "quote": "TO THE FULLEST EXTENT POSSIBLE BY LAW, OUR MAXIMUM LIABILITY ARISING OUT OF OR IN CONNECTION WITH THE MEDPLUM SERVICE OR YOUR USE OF MEDPLUM CONTENT, REGARDLESS OF THE CAUSE OF ACTION (WHETHER IN CONTRACT, TORT, BREACH OF WARRANTY, OR OTHERWISE), WILL NOT EXCEED $100." }, { "date": "2026-10-14", "text": "Users grant Medplum a perpetual licence to use posted content for any purpose, including promoting Medplum.", "quote": "However, we may use it for any purpose, including in our marketing materials." }, { "date": "2026-10-14", "text": "Medical data is archived for seven years from the time it is posted.", "quote": "Medical data is archived for 7 years from the time it is posted on Medplum." } ] }, { "kind": "privacy", "url": "https://www.medplum.com/privacy", "state": "read", "readAt": "2026-10-14", "statedDate": "2022-04-05", "words": 1210, "points": 6.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: 2022-04-05", "says": "Last updated 2022-04-05" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": false }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": false }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Except as otherwise disclosed in this Privacy Policy, while you have permitted Medplum to use the information received, Medplum will not share information received from you with third parties unless Medplum has:" }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": false }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "You have a right to access, modify, or update information or delete non-required information that Medplum has received about you after you open an account with Medplum and become a user." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": false }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": false } ], "toKnow": [ { "key": "old", "label": "Has not been updated for three years or more", "found": true, "quote": "Last Updated: 2022-04-05" } ], "notes": [ { "date": "2026-10-14", "text": "The policy covers physicians' registration data and does not apply to the content of data and files sent through the application.", "quote": "It does not apply to the content of the data and files that are transmitted through the Licensed Application." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/medplum.json", "live": { "slug": "medplum", "probe": { "target": "https://api.medplum.com/mcp/stream", "method": "get", "lastAt": "2026-10-14T09:41:57.409301454Z", "lastOk": true, "lastStatus": 401, "lastMs": 255, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 256, "p95ms24h": 389, "samples24h": 17, "samples30d": 17, "days": [ { "date": "2026-10-14", "probes": 17, "ok": 17 } ] }, "vendorStatus": { "page": "https://status.medplum.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-14T08:53:23.189127499Z" }, "updatedAt": "2026-10-14T09:41:57.409301454Z" } } }