This policy covers the TrialPath agent API and MCP server (collectively, "the Service") operated by Parkinson's Pathways at https://parkinsonspathways.com/api/agent/v1/* and https://parkinsonspathways.com/mcp. It does not cover the human-facing Parkinson's Pathways website, which has its own policy.
POST /api/agent/v1/keys/request, we collect the email address you submit and a Cloudflare Turnstile token used to verify you are a real person. We store the email, a SHA-256 hash of the issued key, the key prefix, and the timestamp./api/agent/v1/* and /mcp, we record: timestamp, route, HTTP method, response status, response time, your API key id (when present), the originating IP address, the user-agent string, and the billing mode (free tier, prepaid credit, or x402 paid). We do NOT log request bodies, response bodies, raw API keys, or x402 payment payloads.POST /api/agent/v1/subscriptions, we store the delivery URL (if any), the filter set, and the HMAC signing secret hash, plus per-delivery audit rows (status, timestamp, attempt count).match_patient / POST /api/agent/v1/match). The match_patient tool accepts a structured profile (required condition and age; optional sex, stage, biomarkers, priorTreatments, comorbidities, meds, acceptsPlacebo, healthyVolunteer, phasePreference, studyType, sponsorPreference, drugClasses, interventionKinds, performanceStatus, requireTerms, excludeTerms, and location/postcode/travel radius). These inputs are processed in-memory for the duration of the request and are NEVER written to the database, NEVER written to application logs (the global JSON-response logger explicitly skips /api/agent/*), and NEVER associated with a stored profile. We retain only the standard usage row for the call (timestamp, route, status, response time, billing mode), with no profile fields.All data is stored in PostgreSQL on infrastructure operated by Replit (United States). API keys are stored only as SHA-256 hashes; we cannot recover the raw key after issuance. HMAC subscription secrets are stored in plaintext for delivery signing.
We share the minimum data required to operate the Service:
challenges.cloudflare.com for verification when you request a key. See the Cloudflare Privacy Policy.We do NOT sell your data, share it with advertisers, or use it to train models. We do NOT share match_patient inputs, query parameters, or any user-identifiable call data with trial sponsors, contract research organisations (CROs), trial sites, or recruitment vendors.
You can request key revocation, deletion of your account email, and a copy of the usage rows tied to your key by emailing spencer@parkinsonspathways.com. We respond within 30 days. Per-call on-chain settlement records and prepaid-credit ledger entries cannot be deleted (they are required for accounting and replay protection), but we can disassociate them from your email.
We treat raw API keys as secrets: they are returned exactly once and stored only as SHA-256 hashes. The agent surface is fully isolated from the main database pool (separate agentDb), and our global JSON-response logger explicitly skips /api/agent/* so raw keys and x402 payloads cannot leak into application logs. Webhook delivery URLs are subject to SSRF protection (private IP ranges blocked, redirects blocked).
Parkinson's Pathways is NOT a HIPAA-covered entity and is NOT a HIPAA business associate. The Service is not designed to receive, store, or transmit Protected Health Information (PHI) as defined under 45 CFR 160.103, and we do not enter into Business Associate Agreements (BAAs) with callers of this API.
Callers must NOT submit PHI through any endpoint, including match_patient / POST /api/agent/v1/match. Patient profile inputs to match_patient must be de-identified before submission: do not include names, government identifiers, medical record numbers, full dates of birth, full-resolution geographic identifiers smaller than the first three digits of a postal code, contact information, or any other direct identifier listed in 45 CFR 164.514(b)(2). The fields the API accepts (condition, age, sex, stage, biomarkers, comorbidities, meds, postcode prefix and travel radius, etc.) are intended to be used in a de-identified form. If you need a HIPAA-compliant trial-matching service, this is not it.
The Service is a developer/agent API and is not directed at children under 16. We do not knowingly collect data from children.
Material changes to this policy are announced at /agents and via email to active key owners at least 14 days before they take effect. The "Last updated" date at the top of this page is authoritative.
Questions, deletion requests, or security reports: spencer@parkinsonspathways.com.