Privacy policy
MedCP needs your email address to give you an access key, and little else. We do not store or log your search queries, we sell no data and we show no ads.
Version 2, in force from 1 November 2026.
1. Controller
IDENTIQ, 6 rue d'Armaille, 75017 Paris, France, is the controller of the personal data described here. For any privacy request, write to [email protected]. We have not appointed a data protection officer.
2. What we collect
- Email address, which you enter on medcp.app. It receives the sign-up link and identifies the holder of a key. To keep one key per mailbox, we compare addresses without their “+” tag, and without dots for Gmail.
- Sign-up link: a random, single-use token, valid 30 minutes. We store only its hash.
- Access key: we store its hash, a public prefix (
medos_and the next 8 characters), its creation and revocation dates and its limits. We never store the key itself. - Usage counters: per key and per UTC day, the number of requests, of reranked searches and of full-text pages.
- Request logs: for each request, a request id, the method, the route without its parameters, the status, the duration, the key prefix, the number of results and, for MCP, the method and tool name. They do not record which full text you read, except when one fails to load: the error then names the article, so that we can fix it. They contain neither your queries, nor the tool arguments, nor your IP address. Sign-up logs name at most the domain of an address (such as example.org), when a mailbox has used up its links for the day.
- IP address at sign-up: held in memory only, never written to disk or logs, to limit the number of link requests per network; Cloudflare Turnstile also uses it to check that a person is signing up.
- Messages you send us, with your address.
Your search queries are processed in memory to answer the request, then discarded. When you use MedCP through an AI provider (Anthropic, OpenAI or another), that provider's own policy governs what it does with your data.
To serve a full text from PMC, our server downloads the article from NLM's PMC Article Datasets on Amazon Web Services. That download names the article and carries no data about you.
3. Why, on what legal basis, for how long
| Purpose | Data | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Send the sign-up link | Email, token hash | Contract, art. 6(1)(b) | Until one day after the link expires, then deleted |
| Provide the key and apply the limits | Email, key hash and prefix, limits, usage counters | Contract, art. 6(1)(b) | While the key is active, then 12 months |
| Prevent abuse of the sign-up | IP address, Turnstile signals | Legitimate interest in security, art. 6(1)(f) | In memory, 24 hours at most |
| Run, debug and secure the API | Request logs | Legitimate interest, art. 6(1)(f) | 30 days |
| Service emails: a key replaced, terms changed, service ending | Contract, art. 6(1)(b) | While the key is active | |
| Answer your messages | Your address, your messages | Legitimate interest, art. 6(1)(f) | 12 months after the last exchange |
| Count site visits | Page views, without cookies or identifiers | Legitimate interest, art. 6(1)(f) | Aggregates at Cloudflare |
We send no newsletters or marketing email. If we ever do, it will be only with a separate opt-in.
4. Who processes it for us
| Provider | What it does | Data | Where |
|---|---|---|---|
| Hetzner Online GmbH, Germany | Hosts the API server and its database | All data in section 2, except the site visits | Germany |
| Cloudflare, Inc., USA | Hosts the site; carries the API traffic to our server through its network (Cloudflare Tunnel); sends the sign-up email; runs Turnstile, Web Analytics and DNS; forwards the messages sent to [email protected] to our mailbox | IP address, browser data, page views, API requests and answers in transit (queries included), the sign-up email and its address, messages sent to us | Worldwide network, including the United States |
| Google (Google Workspace) | Hosts the mailbox that receives the messages sent to [email protected] | Your address, your messages | The EU and other countries, including the United States |
For Turnstile, Cloudflare also acts as a controller when it uses the signals to improve its bot detection (Turnstile Privacy Addendum).
5. Transfers outside the EU
Cloudflare processes data in the United States and in other countries of its network. It relies on its certification under the EU-U.S. Data Privacy Framework and on the European Commission's standard contractual clauses (Cloudflare DPA). For the messages in our mailbox, Google relies on the same framework for the United States (Google Cloud Alternative Transfer Solution) and on the standard contractual clauses for other countries (Cloud Data Processing Addendum). Hetzner processes data in the EU.
6. Cookies and browser storage
- The site sets no cookies of its own and no tracking cookies. Cloudflare Web Analytics uses no cookies or local storage and does not fingerprint visitors (Cloudflare Web Analytics).
- On the sign-up form, Turnstile collects your IP address, TLS fingerprint and browser user agent, only to detect bots (addendum). It is strictly necessary to protect the sign-up, so it needs no consent.
- The page that opens your sign-up link keeps the link's token in this tab's session storage until it is used, so that a reload still works; the browser erases it when you close the tab. If you turn the animation off, the site remembers that choice in your browser's local storage. Neither is sent to us.
7. Your rights
- You may ask for access to your data, its correction or deletion, a copy in a portable format, the restriction of its processing, or object to it.
- Write to [email protected] from the address concerned. We answer within one month.
- Deleting your data revokes your key. Logs keep only the key prefix and expire after 30 days.
- You may complain to a supervisory authority, such as the CNIL (www.cnil.fr) in France, or the one where you live or work.
8. Security
Traffic is encrypted with TLS. Keys and tokens are stored only as hashes. Access to the server and the database is limited to IDENTIQ's operators.
9. Automated decisions and minors
We make no automated decisions with legal or similar effects. Turnstile may block a sign-up it takes for a bot; write to us if that happens to you. The service is not meant for people under 18.
10. Changes
We publish each new version on medcp.app with its date. We email key holders at least 30 days before a material change applies.