Developer guide

Your responsibilities when you hold patient data

What a headless brand must do as a business associate: keys, pages, vendors, logs, notices and records requests.

Never send patient information to a sandbox key.

On this deployment: Headless clinical API (patient data): Not available · External-site registry and scan receipts: Not built yet

Headless clinical API (patient data): Not available. What runs now: Nothing for a real patient: the headless patient API is written and has run only against a local synthetic stack; no brand's patient data access is approved in any environment, and the Developer Center's clinical-loop simulator is a script with synthetic ids.
External-site registry and scan receipts: Not built yet. What runs now: Ad hoc claim scans of copy through the sandbox API.

The checklist

Call the patient API only from your server, with a phi_server key behind an IP allowlist; never from a browser, an edge function or a mobile app.
No ad pixels, conversion APIs or third-party scripts on any page that shows or collects patient data; your privacy officer attests this and Ambition scans it.
A BAA with every vendor that touches the data (hosting, email, SMS, IDV, analytics you keep), listed in your downstream vendor inventory.
On real data, your own verified sending domain: patient data access stays closed until it is, and closes again if it's recorded as failed. Replacing it doesn't close anything: the verified domain stays in force until the new one is verified (Developers > Contact sender).
No patient data in logs, error reports, URLs or analytics events; keep request ids and digests.
Render the group's consents verbatim and send the render receipt; never pre-check a box.
Send every clinically required notice and acknowledge it in time, or Ambition sends a content-free fallback from your domain.
Refund in full on decline or expiry, and publish auto-renewal and refund terms that meet ROSCA and California law.
Sell no research-use-only peptides, at the brand or its affiliates; make no 'clinically proven' or 'same active ingredient' claims.
Name the physician group, pharmacies and labs in your consumer terms (GET /catalog/{brand}/care-network).
Route a patient's records request to POST /records-requests; Ambition holds the medical record for the group.

Status: written, not open. The headless patient API exists on the developer sandbox build and has run only against synthetic data; no brand's patient data access is approved in any environment yet, and there are no live PHI keys.

When something goes wrong

An owner can turn on the kill switch (Developers > PHI server keys): every PHI key is revoked at once and standard keys keep working. Ambition can suspend patient data access the same way. Report a suspected breach to Ambition and your privacy officer without delay.