Effective date: August 27, 2026
Operator: Ismind.org
Contact: liu.j.benjamin@gmail.com
Overview
Personal Wellness MCP is an unofficial connector that lets an authorized MCP client or AI agent read selected data from the Google Health API for personal wellness context. It is not affiliated with, endorsed by, or sponsored by Google, Fitbit, or Alphabet. It is not a medical device and does not provide medical diagnosis, treatment, or emergency advice.
What data the connector processes
Depending on the scopes you approve and the tools you use, the connector may process:
Google OAuth authorization data, including access and refresh tokens, token expiry, and granted scopes.
Google Health identity, profile, settings, activity, fitness, health-metric, sleep, and nutrition data requested by you.
Wellness context that you enter, such as goals, devices, training schedule, nutrition preferences, soreness, injuries, or safety constraints.
Operational information needed to run the connector, such as configuration state, timestamps, request status, and error details.
How data is used
Data is used to authenticate the Google account you select, answer the MCP tool call you make, provide read-only summaries or normalized context, and maintain the connector's local authentication and diagnostic state. The connector does not sell Google user data, use it for advertising, or use it for unrelated profiling. It does not upload health data to Google through its default read-only tools.
Where data is stored and shared
OAuth credentials are stored in a local file with user-only permissions in the filesystem of the connector runtime. In a local installation, that runtime is your computer. In a hosted or containerized installation, it is the host running that instance. Tokens are not returned in MCP tool results.
When you use a Google Health tool, the connector sends the required authorization request to Google and receives the response from the Google Health API. The requested result is then returned to the MCP client or AI agent that invoked the tool. That client or agent may process the result under its own privacy policy and terms.
API-response caching is disabled by default. If you enable caching, the connector may store cached API responses in a local SQLite database until they expire or you clear the cache. The shared local wellness profile is stored separately from OAuth credentials and is intended for non-secret wellness context only.
Privacy and security controls
OAuth token files are written with restrictive user-only permissions where supported.
Tokens, client secrets, and other secret-bearing fields are not returned by MCP tools.
structured output removes identity, secret, and location-bearing fields by default.
summary output minimizes detail further. raw output is an opt-in debugging mode and should be used only when you explicitly need unredacted upstream data.
The connector is designed to keep diagnostic output separate from standard MCP JSON-RPC output.
No security measure is perfect. Protect the computer, container, hosted runtime, MCP client, and AI account that can access this connector.
Google and other services
Google processes authorization requests and Google Health data according to Google's own policies, including the Google Health API Developer and User Data Policy and Google's Privacy Policy. If you use a third-party MCP host, AI agent, cloud provider, or other integration, that provider's privacy policy also applies to data it can access while handling your request.
Your choices
You can stop access at any time by removing this app's access from your Google Account, completing the connector's revoke-access flow, or deleting the connector's local token and cache files. You can also remove locally stored wellness-profile data from the runtime that stores it. Revoking this connector does not delete data retained by Google; use Google's account controls for that.
For questions about operator-controlled data or this policy, contact liu.j.benjamin@gmail.com. Do not send OAuth tokens, client secrets, or raw health payloads by email.
Children
This connector is not directed to children and should not be used to process a child's health data without the permissions and supervision required by applicable law.
Changes to this policy
This policy may be updated when the connector's data handling changes. The effective date at the top of this page identifies the current version.