Privacy Policy

This policy explains how My Health MCP handles Google Health data. Last updated: July 2, 2026.

Overview

My Health MCP is a read-only Model Context Protocol server for personal Google Health API data. The app lets an authorized MCP client retrieve the user's own Google Health records after the user completes Google OAuth consent.

The app is operated by Drew Kennelly. Questions can be sent to drewkennelly@gmail.com.

Data the app requests

The app requests read-only access to the following Google Health data categories only when the user grants consent:

Google Health activity and fitness data
Google Health health metrics and measurement data
Google Health exercise GPS location data
Google Health nutrition data
Google Health sleep data
Google Health Irregular Rhythm Notifications data
Google Health ECG data
Google Health profile data

How data is used

Google Health data is used only to answer the user's requests through the MCP client, such as summarizing steps, sleep, heart rate, or other health records. The app does not use Google Health data for advertising, user profiling, sale, resale, or unrelated analytics.

My Health MCP's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Storage and retention

The local version stores OAuth tokens on the user's machine so the user does not need to re-authorize for every request. A hosted deployment can store the refresh token as a server environment variable controlled by the deployer. The app does not intentionally persist Google Health measurement data after a tool response is returned.

Access tokens and refresh tokens are treated as secrets. They should not be committed to source control or shared publicly.

Sharing

The app does not sell or rent Google user data. Google Health data is not shared with third parties except when the user intentionally connects an MCP client and asks that client to retrieve data through the app.

Security

The app exposes read-only MCP tools and does not provide write, update, or delete capabilities for Google Health records. Hosted access is protected by a bearer token configured by the deployer.

User choices and deletion

Users can revoke the app's Google OAuth access from their Google Account permissions at any time. Local token files can also be deleted from the user's machine. Hosted deployers can remove the configured refresh token from their hosting environment.

To request help with access or deletion, contact drewkennelly@gmail.com.

Important health notice

My Health MCP is not a medical device and does not provide medical advice, diagnosis, or treatment. Users should consult a qualified health professional for medical questions.