Email to Fullscript — partner evaluation request

To: api@fullscript.com
Subject: Partner evaluation request — Onset Clinic (protocol sync only, sandbox ready)
Attachment: FULLSCRIPT_PARTNER_EVAL_BRIEF.pdf (one-page brief only — not this email)

---

Hello Fullscript Integrations team,

We are Last 1 Enterprises LLC, building Onset Clinic — a supplement protocol organizer for wellness practitioners — integrated with the Onset patient iOS app. We have completed sandbox E2E testing and would like to request partner / technical review for a Phase 1, protocol-only integration.

Staging demo: https://clinic-theonset-app-staging-staging.up.railway.app
(Fullscript sandbox us-snd; OAuth, webhooks, pull sync, and patient delivery are live on staging.)

Scope (included): Per-practitioner OAuth; pull active treatment plans into patient master protocols; webhook + cron auto-sync; push patient identity to Fullscript; dynamic links to open Fullscript in a new tab; delivery of merged protocols to the Onset patient app.

Scope (excluded — intentionally): Fullscript Labs API; push protocol (Onset → Fullscript, Phase 2); in-portal Embed iframe (practitioners use Fullscript directly). OAuth scopes: catalog, clinic, patients, treatment plan history only — no labs scopes.

Please see the attached one-page evaluation brief covering data flows, security posture, and staging verification.

Questions:

1. Can we proceed with partner review on this scope without Labs, Embed, or bidirectional protocol push?
2. Are SOC 2 Type 2 and Sub-BAA required before evaluation, or only before production go-live?
3. What is the recommended path and timeline for production OAuth credentials after review?

Production remains disabled (FULLSCRIPT_CUSTOMER_AVAILABLE=false) until we hear from you.

Happy to schedule a walkthrough or provide additional security documentation.

Thank you,
Ryan Curry
Last 1 Enterprises LLC / Onset
ryan@theonset.app