Privacy Policy for the Pharmaco-Net MCP Server
This policy covers the MCP connector only: what happens when you link Claude, or another MCP client, to your Pharmaco-Net account through this server. It does not replace Pharmaco-Net's main privacy policy, which governs your account and the web platform itself.
Last updated: July 14, 2026
Scope
Pharmaco-Net (operated by Calici Co., Ltd.) publishes two related things: the Pharmaco-Net web platform, and this MCP server, which exposes part of that platform to AI assistants over the Model Context Protocol. This page describes only the MCP server's own data handling. Anything you do on the Pharmaco-Net website directly, outside of a tool call from your assistant, is covered by the main site's policy linked above.
What this server collects
When you connect an assistant to this server, it collects:
- An OAuth access token for your Pharmaco-Net account, issued after you sign in. This server never sees or stores your password: the login form on this server posts your credentials straight to the Pharmaco-Net authentication endpoint over HTTPS, and this server only receives the resulting token.
- The parameters your assistant passes to a tool call (for example, a protein target name, a PDB code, or module configuration values) for the duration of that request.
- Standard request metadata (timestamps, which tool was called, and whether it succeeded) in server logs, kept for operational troubleshooting.
This server does not read your AI assistant's conversation history, memory, or files. It only sees the specific arguments a tool call includes.
How this server uses it
Your access token is used to call the Pharmaco-Net backend on your behalf, scoped to your own account, exactly as if you had performed the action yourself on the website. Tool parameters are forwarded to the Pharmaco-Net backend, or to the third-party research APIs described below, to produce the tool's result. Nothing is used for advertising, and nothing is sold.
What this server stores
Beyond the access token used for your current session, this server keeps two small, purpose-built caches in its own ChromaDB instance:
- Shared experiment history. When an experiment is saved (via
the
pharmaco_save_experimenttool), a short summary is stored: the target, workflow type, a text description of the outcome, and result metrics such as best score or hit count. This does not include your name, account ID, or any conversation text, and it is shared anonymously across all users of this server so similar past experiments can inform new ones. - Research cache. Results from RCSB PDB, PubMed, and PubChem lookups are cached by query text (for example, "protein:cdk2") so repeat lookups don't re-hit the external API. This cache holds only public scientific data returned by those services, never anything about you.
Third-party sharing
This server calls the following third-party services on your behalf, using only the search terms needed to answer the request (never your account details):
- RCSB PDB (
rcsb.org): public protein structure lookups. - PubMed / NCBI E-utilities (
ncbi.nlm.nih.gov): public literature search. - PubChem (
pubchem.ncbi.nlm.nih.gov): public bioassay and compound data. - Google Sign-In, if you choose to log in with Google rather than a Pharmaco-Net password.
All four are read-only, publicly documented APIs or standard OAuth sign-in flows. This server does not sell or share your data with advertisers, data brokers, or any other third party.
Data retention
Access tokens expire automatically (typically after one hour) and are refreshed silently by your client; nothing about them is kept once expired. Research-cache entries expire on a fixed schedule (7 to 14 days depending on the source) and are no longer served once stale. Shared experiment-history summaries are anonymous and kept indefinitely so they keep being useful as reference points for future research.
Security
All traffic to and from this server runs over HTTPS. Authentication uses OAuth 2.0 with PKCE, and access tokens are signed RS256 JSON Web Tokens. The server's signing key is never committed to source control and is not accessible outside its hosting environment.
Changes to this policy
If this policy changes, the "Last updated" date at the top of this page will change with it. Material changes affecting what's collected or shared will also be noted on the server's landing page.
Contact
Questions about this policy or this server's data handling: [email protected].