Each app here was built in a sandbox clinic with synthetic patients, passed a checklist — the scopes it asks for, its privacy notice, the data it handles, its webhooks and a test run — and was approved by MedAppz. A clinic connects one from Admin → Integrations, and it gets a key with only the approved scopes. Ratings come only from clinics that connected the app.