Open-Source Licences

About this document

DebriefMD is built on open-source software. This document lists the third-party components distributed with the product, the licence each one is offered under, and the obligations those licences place on us.

Everything below was read from the installed dependency tree or from the font projects' own licence files. Deployment tooling that never reaches a user is out of scope: it is not distributed, so no attribution obligation attaches to it.

Version numbers reflect the tree as installed on 2026-09-15, and the fonts as verified the same day. They move as dependencies are upgraded. Regenerate this document whenever the lockfile changes materially.

---

DebriefMD's own licence

DebriefMD is proprietary software, all rights reserved. It is not open source. LICENSE.txt grants no permission to use, copy, modify, distribute, or deploy the software absent a separate signed agreement, and states explicitly that repository access alone conveys no licence.

Resolved 2026-08-02. Previously LICENSE.txt granted the MIT License under the copyright line Copyright (c) 2021 Othneil Drew, the author of the Best-README-Template project. That was template boilerplate never replaced: it named a third party unrelated to this codebase, and an MIT grant would have let anyone fork DebriefMD and run it against real patient data. Both were unintentional.

The copyright holder is © 2026 1581455 B.C. Ltd. dba WhiteCoat Prep, confirmed on 2026-08-07 and carried into LICENSE.txt the same day. It replaces the placeholder holder that stood there from 2026-08-02.

The proprietary licence above governs DebriefMD's own code only. Every third-party component listed in this document remains under its own licence, and nothing here narrows those grants. See in particular the LGPL-3.0-or-later components under "Licences requiring attention".

---

Summary: production dependency tree

These are the components that ship in the deployed application container. The tree was walked from the production dependencies of app/package.json, following each package's own dependencies and optionalDependencies.

379 packages.

Summary: full installed tree

Including development, build, and test tooling, which is not distributed to users but is present in the repository and in CI. Nested copies of a package installed at more than one version are counted separately here.

823 packages.

One package in the production tree declares no licence at all; it is named under "Licences requiring attention". Every other package in both trees carries a declaration.

---

Licences requiring attention

LGPL-3.0-or-later: ships in production

Two components in the production tree carry the GNU Lesser General Public License v3.0 or later:

These are prebuilt binaries of libvips, the image processing library used by sharp. sharp is pulled in by Next.js for image optimisation, so these binaries are present in the deployed container.

This is a normal and generally workable arrangement for a commercial product, because the LGPL is specifically designed to permit linking from proprietary software. But it is the one licence family in this codebase that carries real conditions, and counsel should confirm how we meet them. In outline, the LGPL expects that recipients of the combined work can replace the LGPL library with a modified version. Relevant considerations:

• DebriefMD is delivered as a hosted service, not as software distributed to users. Under the LGPL (unlike the AGPL), running modified software on a server is generally not "distribution" and does not by itself trigger the source provision obligations. Counsel should confirm this reading.
• We do not modify libvips. We consume the upstream prebuilt binary unchanged.
• If DebriefMD is ever distributed as an on-premise or downloadable build, for example to a hospital running it inside its own network, the analysis changes, and the relinking and notice obligations become live. Flag this before any on-premise deployment is agreed.

Alternatively, Next.js image optimisation can be disabled or replaced, which removes sharp and libvips from the tree entirely. That is worth costing out if counsel prefers to avoid the question.

No component in either tree is offered only under the GPL or the AGPL. One production component is offered under a choice of licences that includes the GPL, and is taken under the other choice; see the next section.

MIT OR GPL-3.0-or-later: a choice, taken as MIT

jszip declares a dual licence in the disjunctive form: the recipient chooses either set of terms. DebriefMD takes it under the MIT License, and nothing in this document or in the product relies on the GPL grant. This differs from pako below, whose (MIT AND Zlib) is a conjunction and binds under both.

No licence declared

buffers ships no license field in its package.json and no licence file in the installed package (only a README, its source, examples and tests). It is a 2011-era Node utility that is consumed unmodified. A package with no declared licence grants no permission on its face; counsel should decide whether the Excel exporter may keep this dependency or whether exceljs should be replaced or pinned to a version that avoids it. Recorded here rather than omitted because the previous version of this page said every package carried a declaration, and that stopped being true when exceljs was added.

MPL-2.0: build and test tooling only

Four components carry the Mozilla Public License 2.0. None of them ship in the production container:

MPL-2.0 is file-level copyleft. Its obligations attach to modified MPL-licensed files, not to the surrounding project. We do not modify these files. Using them as build tooling imposes no source-disclosure obligation on DebriefMD.

CC-BY-4.0: attribution required

A browser-compatibility dataset consumed at build time by the CSS toolchain. Creative Commons Attribution 4.0 requires that we credit the source. Listing it in this document satisfies that.

Unlicense: public domain dedication

postgres is the PostgreSQL client used by both the web application and the pipeline worker; big-integer is reached through exceljs. The Unlicense is a public-domain dedication and imposes no conditions. Recorded here for completeness.

MIT/X11 and BlueOak-1.0.0: permissive, unusually spelled

chainsaw 0.1.0 and traverse 0.3.9 (both reached through exceljs) declare MIT/X11, an older spelling of the MIT License. lru-cache 11.2.7 declares the Blue Oak Model License 1.0.0, a permissive licence whose one condition is that its notice travels with the software. Neither imposes anything beyond what MIT does.

---

Apache-2.0 notice requirement

104 production components are licensed under the Apache License, Version 2.0. Section 4(d) of that licence reads in full:

(d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.

We checked the installed tree for NOTICE files. No Apache-2.0 component in the production tree ships a NOTICE file. The only NOTICE files present belong to playwright, playwright-core, and @playwright/test, which are development-only and are not distributed.

There is therefore no third-party NOTICE content to reproduce at present. This check must be repeated whenever Apache-2.0 dependencies are added or upgraded; if a NOTICE file appears, its contents must be reproduced in this document.

The Apache-2.0 requirements to retain copyright, patent, trademark, and attribution notices in source form, and to state significant changes, are met by consuming these packages unmodified.

The principal Apache-2.0 component families in the production tree:

---

Direct dependencies

Licences below were read from each package's installed package.json.

Web application: app/package.json

react-pdf and pdfjs-dist, listed here until 2026-09-15, are no longer dependencies: neither appears in app/bun.lock, directly or transitively. The PDF renderer is @react-pdf/renderer, which is a different project.

Pipeline worker: infra/lambda/pipeline/package.json

Production dependencies only. The AWS SDK clients this worker uses are declared as development dependencies because the Lambda runtime provides them; they are Apache-2.0, as listed above.

---

Fonts

DebriefMD uses three typefaces, and distributes them in two ways. The web application loads them through next/font/google in app/src/app/layout.tsx; Next.js downloads them at build time and self-hosts them, so the font files ship inside the application container. The PDF renderer embeds its own copies, from app/src/lib/exports/fonts/ (DM Sans in the 400, 500 and 700 weights, and JetBrains Mono and Source Serif 4 in the 400 weight), into every PDF a resident exports. A PDF that embeds a font is distributing it. Attribution obligations apply on both paths.

All three are offered under the SIL Open Font License, Version 1.1. The copyright lines below were read on 2026-09-15 from the embedded .ttf files themselves, each file's own name table, which also carries the OFL licence URL.

Currently shipped, since 2026-08-11:

Superseded, kept because the builds that shipped them were real and their attribution obligations applied at the time:

The three superseded on 2026-08-11 were replaced when DebriefMD adopted the WhiteCoat Prep palette and type (#338). The three lines in the superseded table that predate 2026-09-15 were read from each project's OFL.txt, upstream and in the Google Fonts repository, on 2026-08-04.

The OFL requires that the copyright notice and licence accompany the fonts, that the fonts not be sold on their own, and that Reserved Font Names not be reused. DebriefMD uses every one of them unmodified and does not redistribute them as a font product. Reproducing the notices above satisfies the attribution requirement. Source Serif 4 declares "Source" as a Reserved Font Name, and DebriefMD does not use that name for anything of its own.

---

Licence texts

Full licence texts are shipped inside the application container alongside each package, in that package's own directory. The canonical texts are also available at:

• MIT: https://opensource.org/license/mit
• Apache License 2.0: https://www.apache.org/licenses/LICENSE-2.0
• ISC: https://opensource.org/license/isc-license-txt
• BSD 3-Clause: https://opensource.org/license/bsd-3-clause
• BSD 2-Clause: https://opensource.org/license/bsd-2-clause
• 0BSD: https://opensource.org/license/0bsd
• MPL 2.0: https://www.mozilla.org/MPL/2.0/
• LGPL 3.0: https://www.gnu.org/licenses/lgpl-3.0.html
• SIL Open Font License 1.1: https://openfontlicense.org/
• CC BY 4.0: https://creativecommons.org/licenses/by/4.0/
• The Unlicense: https://unlicense.org/

To obtain the complete licence text for any specific component, contact us through the channel listed in the open-source notice.

Maintaining this document

This document is only accurate for the dependency tree at the date above. Regenerate it when dependencies change materially, and in particular on any major framework upgrade. When regenerating, re-run the NOTICE file check described in the Apache-2.0 section, and re-check whether any newly added component carries a copyleft licence.

Report an attribution error or omission to hello@debriefmd.ca and we will correct it.

October 22, 2026 attribution update: csv-parse 6.1.0, jose 6.1.0 and pdf-lib 1.17.1 were added directly (MIT, read from installed package metadata). jszip 3.10.1 is now direct as well as transitive; its existing dual-license notice above continues to apply. These are attribution additions, not changes to data policy.