Privacy Policy
In short: this application is self-hosted and single-user. You deploy your own copy, it talks to your own Google account, and your health data is never transmitted to the authors or to any third party beyond the infrastructure you yourself choose to run it on. There is no shared service and no operator with access to your data.
1. Who this policy covers
The Google Health MCP Server ("the Software") is open-source software published at github.com/Novrax/fitbit-googlehealth-mcp.
The Software is not offered as a hosted service. Each user installs it on infrastructure they control and registers their own Google Cloud OAuth credentials. In data-protection terms, the person who deploys an instance is the controller of the data that instance processes. The authors of the Software operate no server, receive no data, and have no ability to access any deployment.
2. What data the Software accesses
With your explicit consent at the Google sign-in screen, and only for the scopes you approve, the Software may access:
| Scope | Data |
|---|---|
| Activity & fitness | Steps, distance, floors, calories, active minutes, workouts, heart rate, heart rate variability, VO2 max |
| Health metrics & measurements | Weight, body fat, blood oxygen saturation, respiratory rate, skin temperature, resting heart rate |
| Sleep | Sleep sessions, durations and sleep-stage breakdowns |
| Nutrition | Food and hydration log entries and their nutrient values |
| Profile (read) | Account identifier and membership start date |
| Settings (read) | Unit preferences, timezone, and paired device information |
Where a scope is granted for writing, the Software can create, amend and delete entries of that type — but only entries created through your own instructions.
3. How the data is used
Solely to fulfil the requests you make yourself. When you ask Claude a question about your health data, your instance retrieves the relevant records and returns them to your Claude client. When you ask it to record a meal, a weight or a workout, it writes that entry to your Google Health account.
The Software performs no processing beyond this: no profiling, no scoring, no inference beyond what you explicitly request, and no background collection. It makes requests only while you are actively using it.
4. Where the data goes
Data flows only between these parties:
- Google — the source of the data, accessed under the scopes you approved.
- Your own deployment — by default a Cloudflare Workers instance in your own Cloudflare account, acting as a processor on your behalf under Cloudflare's terms.
- Anthropic (Claude) — receives the data returned by the requests you make, because Claude is the client you are asking. This is handled under Anthropic's own privacy terms.
Your health data is not transmitted to the authors of the Software, and not to any analytics, advertising, tracking or data-broker service. The Software contains no telemetry.
5. What is stored, and for how long
| Stored item | Where | Retention |
|---|---|---|
| Google OAuth access and refresh tokens | Cloudflare Workers KV, in your account | Until you revoke access or delete the store |
| Cached API responses | Cloudflare Workers KV, in your account | Automatically expires after 1 hour |
| Meal presets you create | Cloudflare Workers KV, in your account | Until you delete them |
Responses are cached briefly to stay within API rate limits. No permanent copy of your health history is created, and no database of your records is assembled.
6. Google API Services Limited Use disclosure
The Software's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, data obtained through Google APIs is not:
- transferred or sold to third parties for advertising, marketing or any other purpose;
- used to serve advertisements;
- used to train generalised artificial-intelligence or machine-learning models;
- read by any human, except where you direct it, where required for security purposes, or where required by law.
7. Security
Each deployment is protected by two independent controls: a high-entropy secret embedded in the endpoint URL, compared in constant time, and an IP allowlist restricting requests to Anthropic's published outbound address range. OAuth credentials are held as encrypted platform secrets and are never present in the source code.
Because you host the instance, its security ultimately depends on your own account hygiene — keep your Cloudflare and Google accounts protected, and rotate the endpoint secret if you suspect it has been exposed.
8. Your controls
- Withdraw consent at any time at myaccount.google.com/permissions. Access stops immediately.
- Delete everything stored by deleting the Workers KV namespaces and the Worker itself. No copy remains anywhere else.
- Manage the underlying records in the Google Health app, which remains the system of record for your data.
9. Children
The Software is not directed at children and should not be used to process the health data of anyone under the age at which they can give valid consent in their jurisdiction.
10. Changes
Any revision to this policy will be published on this page with an updated date above. The full revision history is visible in the public repository.
11. Contact
Questions about the Software can be raised as an issue at github.com/Novrax/fitbit-googlehealth-mcp/issues.
If you are running your own deployment, you are the controller of the data it processes; queries about that data are a matter for you and the platforms you have chosen.