Privacy Policy – Taiwan Health MCP Server

Effective date: 2025-01-01  |  Last updated: 2026-04-09

1. Overview

Taiwan Health MCP Server is an open-source Model Context Protocol (MCP) server that provides read-only access to Taiwan TFDA, ICD-10, LOINC, SNOMED CT, RxNorm, and Taiwan clinical guideline data. All underlying datasets are publicly available; this service does not collect, store, or process personal health information.

2. Data We Collect

We do not collect any personally identifiable information (PII). The server maintains an internal audit log (audit.query_log) for operational monitoring purposes. Each audit record contains:

• Tool name (e.g., search_medical_codes)
• SHA-256 hash of the tool parameters — not the raw values
• Request duration and status (success / error)
• Timestamp

Raw parameter values are never written to logs. This design ensures that patient-identifiable query terms cannot be reconstructed from the audit trail.

3. Data Sources

All medical terminology data served by this API originates from publicly available datasets:

• ICD-10-CM / ICD-10-PCS — U.S. National Library of Medicine / CMS (public domain)
• LOINC 2.80 — Regenstrief Institute (LOINC License, free for most uses)
• SNOMED CT International — SNOMED International (SNOMED License)
• RxNorm — U.S. National Library of Medicine (public domain)
• Taiwan TFDA drug, health food, and nutrition data — Taiwan TFDA open data
• TWCore IG — Taiwan Ministry of Health and Welfare (public)

4. How Data Is Used

Query results are returned directly to the requesting MCP client (Claude). We do not use query data for training, profiling, advertising, or any purpose other than fulfilling the immediate API request.

5. Third-Party Data Processing

When this server is accessed through Anthropic's Claude products, Anthropic may collect telemetry on tool calls (including parameters and responses) per their own privacy policy. Please refer to Anthropic's Privacy Policy for details.

This server does not share data with any other third parties.

6. Data Retention

Audit log records (SHA-256 hashes only) are retained for up to 90 days and then deleted. Redis cache entries expire per configured TTL (1–24 hours).

7. No Authentication Required

This service does not require user accounts or authentication. We do not store session tokens, cookies, or user identifiers of any kind.

8. Your Rights

Because we do not collect PII, there is no personal data to access, correct, or delete. If you believe this server has inadvertently processed personal data, please contact us at the address below.

9. Changes to This Policy

We may update this policy from time to time. The effective date at the top of this page will reflect the most recent revision.

10. Contact

For privacy-related questions, please open an issue at github.com/healthymind-tech/Taiwan-Health-MCP or email support@healthymind-tech.com.