Skip to content

Reply to Fullscript — partner review, demo, compliance

To: api@fullscript.com
Subject: Re: Partner evaluation request — Onset Clinic (protocol sync only, sandbox ready)

Hello,

Thank you for the thoughtful reply and for confirming that Phase 1 review can proceed without Labs, Embed, or bidirectional protocol push. That matches how we’ve built and tested the integration, and we appreciate the clarity on production requirements.

Provider demo (sandbox)

We’d be glad to walk you through the practitioner-facing workflow end to end. A suggested agenda (~30 minutes):

  1. Connect Fullscript via OAuth in the Onset Clinic portal (staging)
  2. Import/link a patient from the Fullscript roster and pull the latest active treatment plan
  3. Review the merged master protocol (Fullscript items + any manual Onset supplements)
  4. Trigger a plan change in Fullscript and show auto-sync back into Onset (webhook/cron)
  5. Send the protocol to the patient app with delivery settings
  6. Open the patient/plan in Fullscript via dynamic link (native Fullscript UI)

Staging portal: https://clinic-theonset-app-staging-staging.up.railway.app
Fullscript sandbox: us-snd (same OAuth app we’ve used for integration testing)

We’re flexible on timing. Here are a few windows that work on our side (Pacific Time):

  • [Option 1 — e.g. Tuesday, July 8, 10:00–11:00 AM PT]
  • [Option 2 — e.g. Wednesday, July 9, 1:00–2:00 PM PT]
  • [Option 3 — e.g. Thursday, July 10, 9:00–10:00 AM PT]

If none of these work, we’re happy to adjust. Please let us know what you prefer and we’ll have a test practitioner account and sample patients ready.

SOC 2 Type II / compliance

To answer your question directly: we do not yet have a SOC 2 Type II report. We have not started a formal SOC 2 audit, though we understood from your documentation that Type II (or equivalent) would be required before production access.

We’d like to begin that process now in parallel with partner review. Our platform already implements several controls we can share during review (patient consent, connection-code protections, provider access audit logging, encrypted OAuth tokens, and a documented patient-isolation model for Fullscript sync). We’re prepared to complete your compliance questionnaire and provide any security documentation you need while we evaluate the fastest responsible path to SOC 2 Type II—or confirm whether you’ll accept equivalent interim documentation during an audit period.

Agreements and next steps

Please send over:

  • MNDA
  • Sub-BAA
  • Compliance / security review questionnaire (or intake checklist)

We’ll route those to counsel for review and execution so contracting and technical review can move in parallel.

Production Fullscript access will remain disabled on our side until compliance review and agreements are complete, as you outlined.

Thank you again—we’re looking forward to the demo and to continuing the review.

Best,
Ryan Curry
Last 1 Enterprises LLC / Onset
ryan@theonset.app

Attachment (optional): FULLSCRIPT_PARTNER_EVAL_BRIEF.pdf — one-page scope, data flows, and staging verification summary