Privacy Policy

The CorralData MCP Server integration is governed by the CorralData Privacy Policy.

How your data is handled

When you use CorralData through Claude or ChatGPT, here's what happens with your data:

• Authentication tokens are used to verify your identity and permissions. Tokens are validated server-side and are never stored persistently.

• Queries and tool calls are processed in real time and forwarded to the CorralData API on your behalf. The MCP server does not store query history or results.

• Query results are returned directly to your Claude or ChatGPT conversation. They are not logged or retained by the MCP server.

• The server is stateless — no user data, session data, or conversation history is stored between requests.

What data does Claude or ChatGPT see?

When you use CorralData tools through Claude or ChatGPT, the tool responses (schema metadata, query results, board/widget details) become part of your conversation. This data is subject to Anthropic's usage policy for Claude, or OpenAI's usage policy for ChatGPT.

HIPAA compliance and queries involving PHI

Whether the MCP integration is HIPAA compliant depends on the type of question you ask and whether your organization holds a BAA.

Operational and aggregate questions — production, recare rates, referral volume, and similar rollups — don't return individual patient information, so they're safe to ask in Claude or ChatGPT.

Questions that return patient-level detail (PHI) are different. That data passes through Claude or ChatGPT as part of your conversation. For that to be HIPAA compliant, your organization must have its own Business Associate Agreement (BAA) with the AI provider — Anthropic for Claude, or OpenAI for ChatGPT. CorralData's BAAs cover the in-app AskCorral experience; they do not extend to a personal Claude or ChatGPT account you connect to the MCP server.

If your organization doesn't hold its own BAA with that provider, ask patient-level questions inside CorralData instead. AskCorral runs under CorralData's existing BAAs with Anthropic and OpenAI, so the same question stays covered.

Rule of thumb: aggregates anywhere; patient-level data in CorralData unless you hold your own BAA with the AI provider.

Third-party services

The MCP server connects to:

• CorralData API — to execute tools on your behalf

• Keycloak (your organization's instance) — for authentication and token validation

No data is shared with any other third-party services.

Questions?

For privacy-related questions, refer to the full CorralData Privacy Policy or contact your organization's CorralData administrator.