HealthMCP Privacy Policy

Effective 23 October 2026. Eesti keeles: allpool.

Who is responsible

HealthMCP (the iPhone app and the relay at health.sharks.pw) is published by Skandbig OÜ, registry code 14463755, Pärna tn 20a, Kuressaare 93814, Saaremaa, Estonia. Skandbig OÜ is the data controller for data stored on the relay. Contact: support@skandbig.ee.

What the app does

HealthMCP reads the health data you allow in the Health app and sends it to the relay, so that AI agents you connect (for example Claude, ChatGPT, Le Chat, Hermes or your own scripts) can read it on your behalf. The Siri and Shortcuts actions read data on the device only and send nothing.

Data we process

Health data you permit: steps, distance, active and resting energy, heart rate, resting heart rate, heart rate variability, blood oxygen, respiratory rate, VO2 max, body weight, sleep stages and workouts (type, time, duration, distance, energy). The first sync covers up to the last 90 days.
Technical data: a random account id, a device name you can see in the app, app version, token metadata (name, created and last used time) and the names of the agents you link. Server logs contain IP address, time and request path and are kept for at most 14 days.
Subscription status: if you subscribe, the relay stores the App Store transaction id, product, and expiry date it receives from Apple, so it can unlock Pro features. We never see your payment details; Apple handles payment.

We do not collect your name, email or phone number through the app. We do not use advertising, analytics or tracking SDKs.

Legal basis

Your explicit consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)), given on the consent screen before the first upload, and performance of the subscription contract for subscription status (Art. 6(1)(b)). You can withdraw consent at any time by deleting your data in the app.

Sharing with AI services you connect

Data is used only to answer requests from agents and tokens that you authorised with a link code or access token.
When you connect a third party AI service (such as Anthropic Claude, OpenAI ChatGPT or Mistral Le Chat), that service receives the data it asks for and processes it under its own privacy policy. The app asks for your explicit permission before you link the first agent. You can revoke any connection in the app at any time.
Health data is never sold, never used for advertising, marketing, profiling or data mining, and never stored in iCloud.
Optional webhooks you configure receive only a notification that new data arrived, never health values.

Storage and security

The relay runs on a server in the European Union (AWS, Stockholm region). Traffic is encrypted with TLS. Access tokens and link codes are stored only as one way hashes. Each account's data is isolated from every other account.

Retention and deletion

Data is kept while your account exists. Settings, Delete all my data in the app permanently deletes your account, devices, tokens, agent connections and all health data from the relay immediately. Removing the app alone does not delete relay data, so use the delete button first or email us. Cancelling a subscription does not delete data; Pro features simply lock again.

Your rights

You have the right to access, correct, delete and port your data, to withdraw consent, and to complain to the Estonian Data Protection Inspectorate (aki.ee). Contact support@skandbig.ee.

Children

HealthMCP is not intended for children under 16.

Changes

Material changes will be announced in the app before they take effect.

Privaatsuspoliitika lühidalt

Vastutav töötleja on Skandbig OÜ (14463755), support@skandbig.ee. Rakendus loeb ainult neid terviseandmeid, mida lubad, ja saadab need releele, et sinu enda ühendatud tehisintellekti agendid saaksid neid lugeda. Alus on sinu selgesõnaline nõusolek. Andmeid ei müüda ega kasutata reklaamiks. Server asub Euroopa Liidus. Rakenduses Settings, Delete all my data kustutab kõik andmed kohe. Kaebuse saad esitada Andmekaitse Inspektsioonile (aki.ee).