What OfRoot’s ChatGPT Health Integration Makes Possible Today

Quick Answer

OfRoot now has a live public integration foundation for ChatGPT and ChatGPT Health. It lets compatible AI systems verify what OfRoot is, how the private health timeline works, and which privacy boundaries are currently enforced.

The public connection cannot read accounts, patient records, symptoms, reports, or private timelines. Direct patient-data access remains disabled while OfRoot pursues the dedicated review and authorization required for a health-data connection.

Why We Built The Public Foundation First

OfRoot is built around a simple idea: people need a clearer way to understand what changed before care.

That story may include symptoms, quiet days, medication changes, appointments, questions, optional wearable observations, and the context around them. It belongs to the person building it.

AI can help organize and explain that story, but only when the boundaries are clear. We started with a public, read-only foundation so the integration itself can describe those boundaries before any private connection is considered.

What Is Live

The new public connection exposes three read-only capabilities:

• the current OfRoot integration status
• a public overview of the OfRoot product
• the data boundaries enforced by the connection

These capabilities are available through OfRoot’s public Model Context Protocol endpoint. They contain the same kind of information already available on our public website. They do not query the patient application or its database.

The integration status is also published on the OfRoot ChatGPT Health page, where anyone can see what is available, what is disabled, and what still requires review.

What The Connection Cannot Access

The current public connection cannot access:

• names, email addresses, or account profiles
• symptoms, Daily Check-Ins, or medication information
• private health timeline events
• uploaded records or doctor-ready reports
• authentication sessions or billing information

It also cannot diagnose, recommend treatment, decide whether symptoms are urgent, or write anything into an OfRoot account.

These limits are part of the product, not fine print. A public integration should never create the impression that private health information is available when it is not.

Why Direct Health Data Needs A Different Path

OpenAI’s public app guidelines place strict limits on protected health information. Authenticated access to private customer data also requires an OAuth flow with scoped authorization and token validation.

That means a direct OfRoot patient-data connection cannot be treated like an ordinary public website integration. It needs a dedicated review path, explicit user consent, narrow permissions, revocation controls, auditability, and clear limits on every action.

Until those conditions are satisfied, OfRoot reports patient-data access as disabled.

What A Future Private Connection Should Feel Like

A future approved connection should begin with the person, not the model.

The person should choose whether to connect OfRoot, understand exactly what will be shared, and be able to disconnect it. The connection should request only the smallest useful scope. Read access should come before any action that could change a health timeline.

If approved, useful experiences could include:

• asking for a concise summary of recent timeline changes
• preparing questions from selected events before an appointment
• explaining which details are missing from a selected period
• reviewing a person-approved doctor-ready report

Those examples are a direction, not current functionality. Today’s public connection cannot perform them with private data.

How This Supports The OfRoot Health Story

OfRoot should not become another place where AI speaks with more confidence than the underlying record supports.

The private timeline stays central. AI should help a person read the sequence, preserve uncertainty, and prepare for care. It should show which sources it used and keep missing context visible.

The public integration foundation makes that operating model machine-readable. It gives future reviewers and compatible systems a clear statement of what OfRoot does and where access stops.

What Comes Next

We will continue the dedicated OpenAI Health review path and build private authorization only when the required safeguards and permissions are in place.

In the meantime, the public foundation is live, testable, and transparent. You can review its current status on the OfRoot ChatGPT Health integration page or learn more about the private health timeline.

FAQ

Can ChatGPT read my OfRoot health timeline today?

No. The public connection cannot access OfRoot accounts, patient records, or private timelines.

Is OfRoot already a patient-data source inside ChatGPT Health?

No. The public integration foundation is live, but direct patient-data access remains pending dedicated OpenAI Health review and approval.

What information does the public connection return?

It returns public product information, the current integration status, and a description of the enforced data boundaries.

Will a future connection require permission?

Yes. Any approved private connection should require explicit authorization, narrow scopes, clear consent, and a way to revoke access.

Sources

• OpenAI: App submission guidelines
• OpenAI: Authentication for apps
• OpenAI: Build an MCP server

Informational Note

This article describes OfRoot’s current public integration status. It does not announce OpenAI approval, patient-data connectivity, diagnosis, emergency care, or treatment functionality.