Privacy notice

Effective date: 5 November 2026. This notice describes the current personal-use gpt-health prototype; it is not a notice for a future commercial service.

The owner explicitly connects their Oura account through Oura authorization. Requested permissions are Daily, Heartrate and Workout. Oura credentials are entered on Oura's own pages. The gateway stores application credentials and access/refresh tokens encrypted on the owner's chosen host. The encryption key is also held on that host.

Retrieved health observations and original API responses are saved as private files on that host. These health snapshots are not necessarily encrypted at rest. Public project pages contain no health observations or access credentials.

When the owner asks an assistant to use the MCP connection, selected health observations are transmitted to that assistant's service under its own terms and privacy settings. The gateway itself does not call a separately billed AI API.

This static site uses no application analytics or advertising scripts. Its hosting provider may process ordinary web request metadata under its own policies. Oura processes authorization and source data under Oura's policies.

The owner can disconnect local access, revoke application consent in Oura, and delete retained files on their host. Disconnecting does not delete archived health data. There is no automatic retention or deletion schedule in this prototype.

The prototype has no public account registration, data sales or advertising model. Direct privacy questions to the application owner through the contact email in the Oura application registration.