Privacy policy addendum: the AI connector
This section covers one optional feature: connecting an AI assistant, such as ChatGPT or Claude, to your health record. It applies only if you connect one. If you never do, nothing here describes you.
Where your health record lives
Your record is a single file, health-roadmap.json, in your own Dropbox or Google Drive. We do not host it and we keep no copy of it. When your assistant asks a question, our server at mcp.drstanfield.com opens that file from your cloud, answers the one request, and drops it. The file's contents exist in server memory for the length of that request and nowhere else.
What we store
No account, no health data, and no row about you. The server holds no database of users. When you connect, we hand your AI assistant an encrypted credential. Your assistant stores it. We hold the encryption key and never the credential itself, so neither we nor your AI vendor can open your storage alone.
Three things sit in the memory of a running server and vanish when it restarts: a short list of one-time authorization codes, a count of requests per network address, and a count of writes per connection. The write count is keyed on a SHA-256 hash of the credential, not on your name, your email or your file.
What we log
Our hosting provider records ordinary web request lines: time, method, path, status code. Errors go to Sentry. Before an event leaves the server, our own code deletes the request body, the cookies and the Authorization header from it, redacts sensitive query parameters (including OAuth code, state and any token) out of the URL, replaces the text of console breadcrumbs, and filters values stored under a known health, medication or identity key name. Sentry's own PII collection is off: we never set sendDefaultPii. Your health values are never recorded as analytics.
Sentry, our error-reporting provider, stores that scrubbed data in the United States (its us.sentry.io data region) and keeps events for 90 days by default, Sentry's published retention period. [Brad to confirm: our Sentry account has not changed this default setting.]
Retention
Access credentials expire after one hour. The credential your assistant refreshes with expires 90 days after it is issued. Nothing else is retained, because nothing else is stored.
How to disconnect
Two steps, and the second is the one that counts.
- Remove the connector in ChatGPT or Claude.
- Revoke our app in your storage provider:
dropbox.com/account/connected_appsormyaccount.google.com/connections.
Step 2 is the real off switch. It also disconnects this website from that folder, because both use the same app identity. You can reconnect in one click.
Who else is involved
- Your AI vendor (OpenAI or Anthropic, whichever you chose). Your questions and the answers pass through them under their own privacy policy. We do not choose them for you.
- Dropbox or Google. Your storage, under your own account.
-
Fly.io, who run our server. It runs in Ashburn, Virginia, United States (the
iadregion). - Sentry, for error reports, scrubbed as described above and stored in the United States.
Bug reports
One tool prepares a bug report as a prefilled GitHub link. It sends nothing. You open the link, read the text, and file it yourself with your own GitHub account. The tool refuses any report that looks like it contains a health value.
Questions about this feature
Contact us at drstanfield.com/pages/contact.
[Brad to confirm: this section has had legal review before publishing. It is engineering truth, not legal text.]
[Brad to confirm: whether GDPR or CCPA wording is needed here (controller vs processor, lawful basis, data subject rights). The existing Shopify policy carries that language for the store; this section currently carries none.]