Open source
Free software, so you can check it.
Oolo is licensed under the GNU Affero General Public License v3.0 only
(AGPL-3.0-only). You can read every line, build it yourself, and see for yourself
that it does what we say.
The license, in plain words
You may use, study, change and share the code. If you give someone a modified version, or let people use one over a network, you must offer them the source code under the same license. This is a summary and not legal advice. The LICENSE file is what counts.
- Why the AGPL. It keeps every improved version open. Licenses like MIT or Apache-2.0 would allow closed copies, and a closed copy of a health app is exactly the thing you can’t audit.
- No “open core”. The interface, the formulas and the prompts are all open. If part of the app were closed, you couldn’t verify that the visible app doesn’t leak data, and a closed part would block F-Droid.
- Permissive dependencies only. Third-party code must use MIT, Apache-2.0, BSD, ISC or a similar license. Copyleft code we don’t own conflicts with app-store terms. A check in our build enforces this, and the transparency page lists every component.
- Contributor terms. Today, every commit is signed off under the Developer
Certificate of Origin (
git commit -s). The project may later move to a contributor license agreement, which would commit us to keep contributions under an OSI-approved license. If that changes, we will ask before relying on it for past contributions.
What is licensed how
Scroll sideways to see every column.
| Part | License | Notes |
|---|---|---|
| The app, the services and the packages in the repository | AGPL-3.0-only | Everything, including the interface, formulas and prompts. |
| Dependencies | MIT, Apache-2.0, BSD, ISC and similar | Checked on every change by scripts/check-licenses.ts. |
| Model weights, including any we fine-tune | Each model’s own license. Apache-2.0 or MIT by default. | Listed with hashes on the transparency page. |
| Medical terminology data packs | Their own licenses | Shipped as separate data packs. |
| Education content, lab templates, test-name synonyms | CC BY-SA 4.0 Planned for v1 | Share-alike, in the spirit of OpenStreetMap. |
| Standalone helper libraries, such as units and LOINC lookup | MIT Planned for v2 | So clinics and researchers can reuse them. |
| Real documents in the evaluation set | Not published | Donated with consent. They stay private to protect the people who donated them. |
| The name and logo | A trademark policy Placeholder | Forks must use their own name. |
Build it
You need Node.js 26 (see .nvmrc; most tasks work on 22.13 or newer) and pnpm 9.15,
which corepack enable sets up from the version pinned in the repository. For iOS you
also need a Mac with Xcode 26 and CocoaPods. For Android you need Android Studio, an SDK and JDK
17.
git clone https://github.com/aryaminus/oolo.git
cd health
corepack enable
pnpm install
pnpm verify # lint, types, unit tests and evals: the same checks CI runsThe app uses native modules, such as the encrypted database and on-device models, so it needs a development build rather than Expo Go.
pnpm --filter @app/mobile exec expo run:ios # iOS simulator
pnpm --filter @app/mobile exec expo run:android # Android emulator or device
pnpm --filter @app/mobile run web # web, in the browserOn first run, choose “Explore with sample data” to try every screen with a made-up profile.
pnpm --filter @app/sync-relay dev # ciphertext-only sync relay
pnpm --filter @app/token-broker dev # stateless OAuth token broker
pnpm eval # synthetic evaluation suite and release gates
pnpm exec tsx scripts/check-licenses.ts # the license policy check
pnpm --filter @app/site build # this website, into apps/site/distMore detail is in the README. Builds you make yourself, and the F-Droid build, are fully unlocked.
Contribute
You don’t need to write code. The ladder runs from easiest to hardest:
- Lab templates. Teach the reader one lab’s report layout.
- Test-name synonyms. Map what labs print, in any language, to the right test.
- Translations. Help Oolo speak your language.
- Device testing. Try it on the phone you actually have.
- Code.
The one rule that is never relaxed: no real patient data, anywhere. Not in issues, pull requests, fixtures, screenshots or logs, and that includes your own reports. Redaction misses things, and git history is forever. Use the app’s sample-data mode, the synthetic report generator, or a lab’s public sample report filled with made-up values.
- Sign off every commit (
git commit -s). - Product rules are code rules: no disease labels on your values, no risk scores, no “optimal” ranges narrower than the lab’s, no contraception or conception claims.
- Nothing leaves the device by default, and no new network domain is added without a decision-log entry.
- Everyone follows the Code of Conduct.
Found a security problem? Don’t open an issue. See how to report it privately.
How the project is run
The code is where the promises are kept, so the rest of the project is run in the open as well. What follows is the plan, and only the security policy and the code of conduct exist today.
- A public roadmap, and a public process (RFCs) for big changes. Planned for v1
- A clinical content review board for the education content. Planned for v1
- A maintainer council with a published charter and a women-majority composition. Later
- Once outside maintainers join, a fiscal host or foundation to hold the trademark and the funds. Until then the company holds them, under a published policy. Later
Source: business and licensing plan. Last checked 17 October 2026.
Name and trademark Policy to be published
“Oolo” is the product name, and oolo.me is its only website. Once counsel has cleared the name we will register it and the logo and publish a trademark policy that requires forks to rebrand. You are free to fork the code. You are not free to present a fork as the official app, because people rely on the official app to be what it says it is.