Thylibthylib

Effective 2026-07-17 · v2026-07-03.2

AI / LLM Data-Flow Disclosure

Version: 2026-07-03.2 Effective: 2026-07-17

This document explains a feature that is unlike most personal health-record products and that you must understand and explicitly consent to before using.

1. The feature

Thylib supports the Model Context Protocol (MCP), an open protocol that allows compatible AI assistants — including Anthropic Claude, OpenAI ChatGPT, and Google Gemini — to run structured queries on your behalf against your Thylib data and receive structured responses back.

When you ask one of those assistants a question like "What did my last lipid panel show?" or "When was Mom's last tetanus shot?", the assistant calls a Thylib MCP "tool" on your behalf. Thylib runs the query and returns the matching records.

2. What leaves Thylib

Tool responses returned to the AI assistant include the FHIR resources matching your query — conditions, lab results and vitals (Observation), medications, allergies, immunizations, procedures, diagnostic reports, clinical documents and notes, and encounter/visit records. These may include patient name, date of birth, diagnoses, lab values, medication names and doses, and free-text clinical narratives written by your care team (visit notes, report conclusions).

These responses are delivered to the AI provider hosting the assistant you have chosen to connect. Once data has left the Thylib servers, the privacy and retention practices of that AI provider apply.

What does not leave Thylib:

  • Your patient-portal credentials and OAuth tokens.
  • Your audit log.
  • Records of other family members, unless your specific query requested them and your family role permits you to view them.
  • Records of an adult connected under provider proxy access — never, until that person has confirmed consent themselves. Until then their records are viewable only in the Thylib web dashboard by the family creator, and MCP tools will not return them for anyone.

3. Currently disclosed AI providers

Connecting through MCP routes your data to whichever provider hosts the assistant you have configured. As of this document's effective date, MCP clients are commonly available from:

  • Anthropic (Claude apps, claude.ai)
  • OpenAI (ChatGPT apps)
  • Google (Gemini)
  • Open-source clients that may route to any of the above or to other model providers you configure

Each of those providers operates its own privacy and data-retention regime that is outside Thylib's control. We encourage you to read their policies before enabling MCP — including whether your conversations may be used for model training under your settings with that provider.

Thylib receives no money or other consideration from any AI provider in connection with your data. Which provider (if any) you connect is your choice alone.

4. Why this matters

Most health-record apps expose your data only through their own application. Thylib is built the other way around: letting a third-party AI assistant read your records on your behalf is the core of the service — a conversational interface over your own chart. The trade-off is that your health data passes through a company that Thylib cannot directly control.

If you are uncomfortable with that trade-off, Thylib is probably not the right product for you. You can browse and export your records in the web dashboard without ever connecting an AI assistant — in that configuration, your data does not leave the Thylib servers except for the explicit data-export feature you trigger yourself — but the assistant experience is what Thylib is built for.

5. Opt-out

You may opt out of MCP at any time by revoking the MCP credential issued to you on the connections page. Revocation takes effect immediately for new requests. Data already returned to an AI provider in past sessions is governed by that provider's retention.

6. Changes to this disclosure

Any change to this disclosure — including adding a new AI provider to the list above, changing what data leaves the system per tool, or changing this document's wording — is always treated as a material change and will require your re-acceptance on next sign-in or next MCP tool call.

7. Authorization and acknowledgement

By accepting this disclosure, you authorize the data flow it describes, and you acknowledge that you understand it. Specifically:

  1. What is disclosed, and to whom. Tool responses you trigger via MCP send your structured health records — potentially including clinical notes — to the third-party AI provider whose assistant you have connected (§3). The recipient in every case is the provider you choose to connect; no data is sent to any provider you have not connected.
  2. Purpose. Solely to answer the queries you run through that assistant. Thylib receives nothing of value from any AI provider in connection with your data.
  3. Duration. This authorization lasts until you revoke it — by disconnecting the assistant or revoking your MCP credential (§5) — or until you delete your account, whichever comes first. Any change to this disclosure requires your fresh acceptance before further MCP use (§6).
  4. Their policies apply. The provider's own privacy and retention policies govern your data once it leaves Thylib.
  5. Your copy. This document is available to view and save at any time at /ai-disclosure; we keep a timestamped record of the version you accepted and will provide a copy of your acceptance on request (privacy@thylib.com).