NOTICE

OpenMed NOTICE
==============

OpenMed is licensed under Apache-2.0. This notice records third-party
assets that are wrapped, ported, adapted, or planned as integration surfaces
for the project. Direct package dependencies are also checked by
scripts/release/check_license_policy.py.

Permissive bundled or in-process assets
---------------------------------------

Name: Presidio
Source: https://github.com/microsoft/presidio
License: MIT
Usage: Optional recognizers and image/DICOM redaction patterns may be wrapped
behind OpenMed interfaces. OpenMed remains the orchestrator and routes
detection decisions through its own policy and span layers.

Name: DataProfiler
Source: https://github.com/capitalone/DataProfiler
License: Apache-2.0
Usage: Planned structured-data profiling and quasi-identifier discovery for
tabular anonymization workflows.

Name: KServe V2 inference protocol
Source: https://github.com/kserve/open-inference-protocol
License: Apache-2.0
Usage: OpenMed ships a minimal, locally namespaced protobuf subset for the
standard ModelInfer request and response wire fields. It provides a client-only
Triton/KServe integration and does not bundle an inference server.

Name: medspaCy ConText
Source: https://github.com/medspacy/medspacy
License: Apache-2.0
Usage: Assertion, negation, temporality, and experiencer rule patterns may be
ported into OpenMed clinical-context modules. Ported rule-set files must carry
an upstream attribution header naming the source project, source URL, license,
retrieval or port date, and a short summary of local modifications.

Name: ICU (International Components for Unicode) grapheme-break rules
Source: https://github.com/unicode-org/icu/blob/0c5873f89bf64f6bbc0a24b84f07d79b25785a42/icu4c/source/data/brkitr/rules/char.txt
License: ICU (ICU License - ICU 1.8.1 and later)
Source-file copyright: Copyright (C) 2002-2016, International Business
Machines Corporation and others. All Rights Reserved.
License-notice copyright: Copyright (c) 1995-2016 International Business
Machines Corporation and others. All rights reserved.
Usage: OpenMed adapts ICU 57.1 grapheme-cluster behavior into the compact
Devanagari range, virama, and joiner table shipped as
openmed/processing/resources/segmenter/indic_rules.json. The table records the
exact upstream revision, source path, retrieval date, and local modifications.
The complete ICU copyright and permission notice is retained in
openmed/processing/resources/segmenter/ICU.txt and is copied into every
standalone Indic or combined segmenter bundle as a declared, digest-bound
license resource.

Name: hijridate Umm al-Qura month starts
Source: https://github.com/dralshehri/hijridate (version 2.6.0,
src/hijridate/ummalqura.py)
License: MIT
Copyright: Copyright (c) Mohammed Alshehri
Usage: The 1356-1450 AH Umm al-Qura month starts are stored as month lengths
in openmed/core/data/calendars/hijri_umm_al_qura.json for lunar Hijri date
shifting. The table records its source, retrieval date, local modifications,
verification references, the MIT permission notice and a SHA-256 digest that
the loader verifies.

Name: py-nepali Bikram Sambat month lengths
Source: https://github.com/opensource-nepal/py-nepali (version 1.2.0,
nepali/date_converter.py)
License: MIT
Copyright: Copyright (c) 2018 The Python Packaging Authority (as stated in the
upstream LICENSE file)
Usage: The 2000-2083 BS month lengths are stored in
openmed/core/data/calendars/bikram_sambat.json for Bikram Sambat date
shifting. The table records its source, retrieval date, local modifications,
verification references, the MIT permission notice and a SHA-256 digest that
the loader verifies.

Name: SHIELD clinical PHI corpus
Source: https://github.com/susom/shield_dataset
Paper: https://arxiv.org/abs/2605.03301
License: Access and redistribution terms require review before use; current
access instructions point to Stanford Redivis with a signed Data Use Agreement.
Usage: Comparison and evaluation corpus for de-identification benchmarking.
No dataset copy is bundled in the package unless its exact redistribution terms
have been reviewed and approved.

Name: ARX Data Anonymization Tool
Source: https://github.com/arx-deidentifier/arx
License: Apache-2.0
Usage: Optional structured-data anonymization engine for k-anonymity,
l-diversity, t-closeness, and differential-privacy workflows. ARX may run as
an optional engine or out-of-process bridge and must not become a required core
dependency.

GPL bridge-only tools
---------------------

Name: sdcMicro
Source: https://github.com/sdcTools/sdcMicro
License: GPL-2.0-or-later
Usage: Statistical disclosure-control reference tool. It is not bundled,
vendored, imported, or required by the OpenMed package. Any future integration
must be out-of-process only, isolated behind an optional bridge, and documented
as a user-installed component.