> For the complete documentation index, see [llms.txt](https://docs.corraldata.com/kb/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.corraldata.com/kb/mcp/privacy-policy.md).

# Privacy Policy

The CorralData MCP Server integration is governed by the [CorralData Privacy Policy](https://corraldata.com/privacy).

### How your data is handled

When you use CorralData through Claude or ChatGPT, here's what happens with your data:

* **Authentication tokens** are used to verify your identity and permissions. Tokens are validated server-side and are never stored persistently.
* **Queries and tool calls** are processed in real time and forwarded to the CorralData API on your behalf. The MCP server does not store query history or results.
* **Query results** are returned directly to your Claude or ChatGPT conversation. They are not logged or retained by the MCP server.
* **The server is stateless** — no user data, session data, or conversation history is stored between requests.

### What data does Claude or ChatGPT see?

When you use CorralData tools through Claude or ChatGPT, the tool responses (schema metadata, query results, board/widget details) become part of your conversation. This data is subject to [Anthropic's usage policy](https://www.anthropic.com/legal/consumer-terms) for Claude, or [OpenAI's usage policy](https://openai.com/policies/usage-policies/) for ChatGPT.

### HIPAA compliance and queries involving PHI

Whether the MCP integration is HIPAA compliant depends on the type of question you ask and whether your organization holds a BAA.

Operational and aggregate questions — production, recare rates, referral volume, and similar rollups — don't return individual patient information, so they're safe to ask in Claude or ChatGPT.

Questions that return patient-level detail (PHI) are different. That data passes through Claude or ChatGPT as part of your conversation. For that to be HIPAA compliant, your organization must have its own Business Associate Agreement (BAA) with the AI provider — Anthropic for Claude, or OpenAI for ChatGPT. CorralData's BAAs cover the in-app AskCorral experience; they do not extend to a personal Claude or ChatGPT account you connect to the MCP server.

**If your organization doesn't hold its own BAA with that provider, ask patient-level questions inside CorralData instead. AskCorral runs under CorralData's existing BAAs with Anthropic and OpenAI, so the same question stays covered.**

**Rule of thumb:** aggregates anywhere; patient-level data in CorralData unless you hold your own BAA with the AI provider.

### Third-party services

The MCP server connects to:

* **CorralData API** — to execute tools on your behalf
* **Keycloak** (your organization's instance) — for authentication and token validation

No data is shared with any other third-party services.

### Questions?

For privacy-related questions, refer to the full [CorralData Privacy Policy](https://corraldata.com/privacy) or contact your organization's CorralData administrator.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.corraldata.com/kb/mcp/privacy-policy.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.