HealPot Google Health MCP (Unofficial) | Privacy
Operator: enesdemirag. This service runs on an operator-controlled VPS. Cloudflare terminates public HTTPS and forwards requests over a dedicated encrypted Tunnel. Infrastructure providers process connection metadata to operate the service.
When you authorize a connection, this server requests read access to your Google Health activity/fitness, sleep, measurements and nutrition. You choose categories on Google consent. Your Google account must already be linked to Google Health.
The server reads requested records in memory and sends results to the assistant you connect. The recipient is the assistant identified during connection consent, which may use an AI provider such as OpenAI, Anthropic, Cursor/Anysphere or xAI. That provider's own retention and processing policies apply. This is not end-to-end encryption against the server operator or your chosen assistant.
Health measurements are not persisted or used for advertising. Google credentials, MCP credential mappings, registered clients and temporary OAuth state are stored encrypted on the VPS. Temporary transactions expire; refresh references have a maximum fallback lifetime of 30 days. Active grants can renew authorization. Google testing grants may expire after seven days. HTTP access/body logging is disabled for this project.
No authorization-volume backup is configured in this initial deployment. Disconnect and revoke Google access as described below. To request deletion of remaining authorization references, use the support address shown on this application's Google consent screen. Do not send passwords, tokens or health records.
Use of information received from Google Health API adheres to the Google Health API Developer and User Data Policy, including Limited Use requirements. Health results are transferred only for the health/fitness features you authorize.