Privacy Policy
This policy explains how OIT Medical Research MCP handles information when you use the hosted website, account controls, OAuth connection, and research tools.
Who operates this service
OIT Medical Research MCP is operated by Christopher Lamonte Ogle. Privacy questions may be sent to research-api@ogleits.com.
Information we handle
- Connection and account data. The service creates a pseudonymous account identifier and stores OAuth client registrations, authorization grants, and security state needed to connect an MCP client. Signed browser cookies maintain short-lived account and authorization sessions.
- Optional GitHub account data. If you choose GitHub sign-in for browser account management, the service reads your public GitHub account ID, username, display name, and avatar. GitHub's temporary access token is discarded after the profile lookup.
- Optional NCBI setting. If you save a personal NCBI API key, it is encrypted before storage and is never displayed again.
- Research requests. Search terms, article identifiers, and CMS dataset parameters are sent to the applicable public data providers to complete your request. The service does not intentionally write research queries, article identifiers, or article text to application logs.
- Operational telemetry. Each tool call may create a pseudonymous event containing an account pseudonym, tool category, outcome, duration, and HTTP status. It does not contain your account name, raw account ID, research query, or article content.
How information is used
Information is used to authenticate connections, provide requested research and public-data results, apply account-level rate limits, protect the service, remember optional provider settings, and diagnose coarse operational failures.
Where requests are sent
Depending on the tool used, request parameters and identifiers may be sent to NCBI PubMed and PubMed Central, Europe PMC, Crossref, Unpaywall, or Data.CMS.gov. Those providers process requests under their own privacy policies and terms. Cloudflare provides hosting, security, key-value storage, and pseudonymous operational analytics for the hosted service.
Sharing and sale of information
Information is shared only with the infrastructure and public-data providers needed to operate the service, or when required by law. The service does not sell personal information, use it for advertising, or share it with data brokers.
Retention
- Consent and optional GitHub authorization state: up to 10 minutes.
- Browser account session: up to 8 hours.
- OAuth access token: up to 1 hour.
- OAuth refresh token, grant, and dynamically registered client: up to 30 days.
- Pseudonymous operational telemetry: up to 3 months.
- Encrypted personal NCBI settings: until removed by you, your hosted account data is deleted, or the hosted service is decommissioned.
Your choices and controls
You may use a pseudonymous account without GitHub, revoke connected MCP clients, remove a saved NCBI key, or delete hosted account data from the account page. Account deletion revokes current grants, removes encrypted provider settings, and signs you out. Deletion from globally distributed storage may take approximately 60 seconds to propagate.
Security
The service uses encrypted HTTPS connections, signed and secure cookies, short-lived authorization state, encrypted provider settings, bounded requests, and account-level rate limits. No internet service can guarantee absolute security.
Children
The service is not directed to children under 13 and is intended for general research use by people able to accept these terms.
Policy changes
This policy may be updated as the service changes. The effective date at the top of this page will be revised when material changes are published.