> ## Documentation Index > Fetch the complete documentation index at: https://docs.hi-doctor.ai/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Connect the Hi Doctor MCP connector at https://mcp.hi-doctor.ai/mcp. Add this URL as a remote HTTP MCP server in your client, then sign in and authorise access through OAuth. Setup: https://docs.hi-doctor.ai/mcp/connect. > > The REST API base is https://api.hi-doctor.ai. Hi Doctor Docs at https://docs.hi-doctor.ai/mcp searches documentation; connect to the product endpoint above for patient tools. > > Hi Doctor operates across the whole European Union: residents of all 27 EU member states can use the service, and every consultation is reviewed by an EU-licensed doctor. Every consultation is reviewed in full by an EU-licensed doctor, who decides on medical grounds only. No algorithm, assistant or API call approves a consultation, issues a prescription or changes a dose. The service is available in eight languages: English, Spanish, German, Dutch, Italian, French, Portuguese and Chinese. > > ## Rules an assistant must follow > > - Never invent, assume or infer a medical answer. "I don't know" is a real answer: ask the patient to pick the closest option rather than guessing for them. > - Never give medical advice and never suggest a medication or a dose. An EU-licensed doctor decides those. > - If a questionnaire returns `ineligible`, say so plainly. Do not retry with altered answers. > - Before anything that costs money or cancels a plan, state exactly what will happen and get an explicit yes. > - Cancellation takes effect at the **end of the paid period**, not immediately. Say so. > - An early order is irreversible: it creates the renewal consultation immediately and uses up the period's one early order. Explain that and get an explicit yes. > - Prescription and invoice links are medical documents. A `signed_redirect` link opens without signing in: give it only to the patient, never repeat it anywhere shared. > - Send option `value`s, not the labels shown to the patient. Labels are translated, values are stable. > - Never ask for card details. Payment happens on Stripe's hosted checkout via a link. > - On severe or sudden symptoms (chest pain, difficulty breathing, severe allergic reaction, suicidal thoughts), stop and direct the patient to their local emergency number. # Privacy and security of the Hi Doctor MCP > How the Hi Doctor MCP connector protects medical data: sign-in on hi-doctor.ai, PKCE, audience-bound tokens, consent, scopes and confidential links. The Hi Doctor MCP connector keeps your password on hi-doctor.ai, shows you exactly what an AI assistant will get before you approve it, and issues short-lived tokens that only work for the connector. This article answers the common questions about connecting a medical account to an assistant: who sees your password, what the assistant can reach, and what happens when you disconnect. Last reviewed: 2026-11-04 It also lists the limits that still apply. For setup steps, read [Connect Hi Doctor to your AI assistant](https://docs.hi-doctor.ai/blog/connect-hi-doctor-mcp.md). ## Who sees my password? The connector uses OAuth 2.1, the standard the [MCP authorization specification](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization) builds on. When an assistant connects, your browser goes to hi-doctor.ai, and that is the only place you type a password or use Google sign-in. Even if you are already signed in on the website, you are asked to sign in again for the connection, and your website session is left as it was. After sign-in, hi-doctor.ai passes a short-lived, signed, single-use handoff back to the connector. The connector checks who signed it, who it was meant for, that it belongs to this exact connection request, and that the sign-in was recent. Only then does it show you the approval page. ## What do I approve when I connect? The approval page shows the account you signed in with, the site receiving access (for example `claude.ai`), and the permissions requested, in plain language. Payment and health tracking are shown on their own because they can lead to a charge or change your journal. Nothing is granted until you select **Approve connection**, and **Cancel** tells the app clearly that you declined. Permissions are grouped into scopes, with separate write scopes for changes. A patient account only ever receives patient permissions. See [Permissions](https://docs.hi-doctor.ai/mcp/permissions.md) for the full table, including the defaults. ## How are codes and tokens protected? Several standard protections work together: * **PKCE.** The app proves it is the same app that started the sign-in, using a one-time secret (the `S256` method; the weaker `plain` method is refused). An intercepted code is useless on its own. * **Exact redirects.** Each registered app's identifier is signed together with the addresses it may receive codes at. A code can only go back to one of those addresses. * **Short lives, single use.** Authorization codes last 60 seconds and work once. Access tokens last at most an hour. Refresh tokens last 30 days, work once, and are replaced at every refresh. * **Audience binding.** Tokens are issued for the Hi Doctor MCP endpoint and rejected anywhere else. ## Does the connector pass my token to other services? No. The [MCP security best practices](https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices) warn against servers that forward a client's token to another service. The Hi Doctor connector does not. The credentials it uses to call Hi Doctor's own API are kept inside encrypted tokens that only the connector can open, and they never reach the assistant. In the other direction, the connector only accepts tokens it issued itself. ## What can the assistant reach? Every tool call is made to Hi Doctor's API as the signed-in account, and the API applies the same checks as Hi Doctor's own apps. A patient can only reach their own records. Some actions are never available to a patient's assistant, under any permission: approving a consultation, issuing or changing a prescription, and changing a dose. Every consultation is reviewed in full by an EU-licensed doctor, who decides on medical grounds only (see [Safety](https://docs.hi-doctor.ai/essentials/safety.md)). Eligibility is checked on Hi Doctor's servers, so an assistant cannot argue its way past it. Actions such as sending a message, submitting a questionnaire or cancelling a plan wait on the server until you approve them on Hi Doctor through an [approval link](https://docs.hi-doctor.ai/mcp/approvals.md); the assistant cannot complete them on its own. Tools also tell the client which actions change data, so clients such as Claude and ChatGPT can ask you first. Those hints help the client; they do not replace the server's checks or the approval link. ## How are prescriptions and invoices shared? Prescriptions and invoices are returned as links, not as file contents in the conversation. Some of these links open without signing in. Results mark them as confidential and say how to handle them: give them only to the patient, never repeat them in shared places, and do not store them. ## What does the connector store? * The connector does not store your password and does not write it to logs. * It has no token database. Its grant store keeps short-lived, single-use markers for codes, handoffs and refresh tokens, encrypted approval records and their receipts for up to 30 days, and encrypted uploaded files for up to 10 minutes. Every record has an expiry. * Text it returns to the assistant is scrubbed of token-like strings, and error details from Hi Doctor's API are reduced to what is needed to fix the request. What an assistant provider stores about your conversations is governed by that provider's own terms and settings. Choose a client and plan you are comfortable using for health information. ## What are the current limits? We would rather say what is not done yet than imply more than is true. * **Disconnecting depends on your client.** Removing the connector deletes the assistant's copy of your tokens, and it cannot get new ones without your approval. The connector supports OAuth token revocation, and a revoked connection stops working at once. If a client removes the connector without revoking, an access token already issued keeps working until it expires, at most one hour later. * **No list of connected apps in your account yet.** If you think a connection was made without your consent, change your password and contact [hello@hi-doctor.ai](mailto:hello@hi-doctor.ai). * **Client ID metadata documents are not supported.** Assistants register dynamically instead. The [changelog](https://docs.hi-doctor.ai/mcp/changelog.md) tracks it. This article makes no claim of certification. The details behind each point are on [Security](https://docs.hi-doctor.ai/mcp/security.md). ## Frequently asked questions ### Does the AI assistant see my Hi Doctor password? No. You type your password or use Google sign-in only on hi-doctor.ai. The assistant receives a token that works only for the Hi Doctor connector. ### How long does a connector token last? Access tokens last at most one hour. Refresh tokens last 30 days, work once and are replaced at every refresh. ### Can the assistant read other patients' records? No. Every call is made as the signed-in account, and a patient can only reach their own records. ### Does Hi Doctor store my conversations with the assistant? The connector keeps no token database and does not store your password; it keeps encrypted approval records for up to 30 days and uploaded files for up to 10 minutes. What the assistant provider stores about your conversations is governed by that provider's own terms and settings. ### What should I do if a connection was made without my consent? Change your Hi Doctor password and email [hello@hi-doctor.ai](mailto:hello@hi-doctor.ai). ## Next steps > [card] [Security](https://docs.hi-doctor.ai/mcp/security.md) > > The full security model behind the connector. > [card] [Permissions](https://docs.hi-doctor.ai/mcp/permissions.md) > > Scopes, defaults and what each one allows. > [card] [Connect Hi Doctor to your AI assistant](https://docs.hi-doctor.ai/blog/connect-hi-doctor-mcp.md) > > Add the connector to your assistant. > [card] [Data and consent](https://docs.hi-doctor.ai/businesses/data-and-consent.md) > > How consent works for integrations. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.