Privacy policy

1. Data the app accesses

Google authorisation allows the local process to read the following categories:

• Activity and fitness: the permission googlehealth.activity_and_fitness.readonly covers the activity and fitness category. The current implementation requests daily aggregates for steps, total energy expenditure and active energy expenditure.
• Sleep: googlehealth.sleep.readonly allows sleep records to be read. The app receives sleep session responses, which may contain session start and end times, source information and other available sleep details. It processes these locally to calculate daily sleep minutes and detect overlaps or missing summaries.
• Account linkage: the app checks the Google Health identity endpoint to confirm that the Google account is linked. Identity IDs are not included in the MCP summary returned to ChatGPT / Codex.

Summaries include dates, source information, update times and field status. Source calendar dates are preserved. Reconciled Google Health data may include wearable, phone, third-party and manual records.

The current app does not request Google Health write, location, ECG, nutrition, contact or health measurement permissions. It does not collect heart rate, weight or symptom records. The Google Drive / Sheets connection is separately authorised, and IFTTT credentials are not transferred to this app.

Voluntary meal records

The chosen Sheet can contain dates, times, meal names, foods, amounts, optional calorie and protein estimates, and notes entered by the account holder. Relevant meal details explicitly added in the current chat may also be used. The workflow does not automatically search other chats for a dietary history. Avoid putting unnecessary personal information in free-text notes.

2. How data is used and shared

The data supports the account holder’s requested daily summaries, Sheets history, deduplication, data quality checks, and general activity and meal analysis.

1. Google and the local process. The app exchanges OAuth requests and retrieves authorised health data from Google over HTTPS. Sleep sessions are processed locally before the MCP returns daily summaries.
2. Google Sheets. ChatGPT / Codex uses connected Google tools to store daily summaries in the account holder’s chosen Sheet and read meal records. The Sheet may also contain update status and short error summaries. Google stores those records under its service policies and the account holder’s sharing settings.
3. OpenAI. The local MCP passes health summaries to ChatGPT / Codex. Relevant summaries, tool results and meal records become model context processed by OpenAI to generate answers and daily analysis. Analysis is retained in the current chat according to the service and account settings. The project does not send analysis by email or publicly share it.

This app does not sell health or meal data, use it for advertising, or include code that trains models. That does not establish a universal no-training or no-logging promise for Google, OpenAI or the hosting provider.

Google API data and Limited Use

Use and transfer of information received from Google APIs is limited to the account holder’s visible, requested features described here and must follow the Google API Services User Data Policy, including its Limited Use requirements. Google data is not sold, used for advertising or offered as a model-training feature by this app. The chosen third-party service and account controls must be compatible with these restrictions. This policy does not claim Google verification or approval.

3. Storage and security

The app runs on the account holder’s Mac. It has no central health database or public health API server. Imported OAuth client information and access and refresh tokens are stored as encrypted local files using AES-256-GCM. The encryption key is kept separately in macOS Keychain. Access to local files is restricted to the current user by the app’s file permissions.

The OAuth flow uses the system browser, PKCE and a temporary callback bound to the local loopback address. Tokens must be decrypted in memory during use. These protections do not prevent every risk from an unlocked device, malicious local software or someone with access to the user account.

The app does not intentionally persist raw health response JSON as files. Summaries pass through tool output and the host app; command-line output, terminals, tool histories, chats and application logs may retain them. The daily task’s local deduplication state is intended to keep reported dates and summary hashes, rather than raw health JSON. The project cannot impose that rule on all host logs.

An original OAuth client JSON downloaded by the account holder is a separate copy. Importing it does not automatically delete, move or encrypt that original. Downloads, backups and synced folders may retain copies.

Retention

The app has no automatic deletion schedule or fixed retention period. Local credentials remain until separately removed. Google Sheets records, chats, logs and backups are governed by the account holder’s actions and the relevant services’ policies. There is no one-click operation that removes every copy.

4. Stop, revoke and delete

1. Stop automatic work. Disable the daily task or local MCP. This stops the corresponding runs but does not revoke Google access or delete existing records.
2. Revoke Google Health access. Remove Personal Health MCP in the Google account’s third-party app and service connections. Future authorised reads should fail and require reauthorisation. Revocation does not delete Sheet rows, chats, local files or backups. It does not revoke a separate Google Drive connection.
3. Remove local copies. Delete the app’s encrypted credential files and, separately, its corresponding macOS Keychain entry and original downloaded client JSON if no longer needed. Removing files or the Keychain key does not revoke Google authorisation or delete remote records. Backups may require separate action.
4. Manage Google Sheets. Stop syncing first, then remove the relevant rows or the Sheet. Otherwise, records within the sync window may be written again. Google’s trash, version history and backup behaviour still apply. This does not delete source Google Health records.
5. Manage OpenAI data. Use the relevant ChatGPT / Codex controls to manage chats and connections. Disconnecting a Google connection does not remove previously stored copies from other services or local files.

Google Health source records remain under Google account and device controls. This app’s read-only permissions cannot delete them. Revocation or deletion in one place does not guarantee immediate permanent erasure everywhere.

5. This information website

Cloudflare Pages hosts this static website. It has no health data forms, account login, analytics tags, tracking code, third-party scripts or embedded private Sheets. The website does not receive health records or Google OAuth tokens from the MCP.

Serving a webpage may still involve Cloudflare processing network request information, such as an IP address, browser information, request time and access logs, under its policies. No claim is made that website visits leave no records.

6. Third-party policies

The relevant services provide their own privacy information and account controls:

• Google Privacy Policy
• OpenAI Privacy Policy
• Cloudflare Privacy Policy

These services may apply different retention and processing rules to different accounts, products and regions. Review the policy and controls that apply to the account used for this workflow.

7. Changes

Changes to data access, use, sharing or public availability require an updated disclosure and any additional consent required before the changed processing begins. This page’s effective date will identify the published policy version.

8. Maintainer and contact

Personal Health MCP is maintained by Ivo Xiao. For support, privacy questions or a request concerning the app, use the support email shown on its Google OAuth consent screen. This website does not collect requests through a form.