Health Data Avatar (HDA)

Health Data Avatar documents ten. Anthropic's directory entry lists two, get_files_manifest and get_file_transcript. The vendor's own connector page names eight more covering medications, wearable data, questionnaires, help search and feedback. The endpoint returned HTTP 401 to our anonymous request on 2026-09-09, so we read no live tool list and cannot settle which surface is current.

Your documents, medications, wearable data and questionnaire answers, according to Health Data Avatar. Its connector page describes a manifest of uploaded files and journals with titles, dates and tags; the extracted plain text of any single file plus your own notes on it; every medication with dosage, dates and source document; wearable statistics and individual sleep and workout events; and your questionnaire responses.

Yes. Health Data Avatar's pricing page lists MCP Server under the Premium tier at ten pounds per month, and not under the Free tier. The free plan covers storage, document processing, search, exports, journals, annotations and Telegram, but the MCP connector sits alongside Chat and PII Redaction in the paid column. The vendor's connector page does not mention this requirement.

One documented tool writes, and it does not touch your record. Health Data Avatar describes submit_hda_feedback as sending anonymous product feedback to its team, only after you explicitly agree, and not linked to your account. The other nine documented tools retrieve. We read no tool annotations, so this is the vendor's account of its own server rather than our observation.

OAuth 2.1 with PKCE. We read the server's own metadata on 2026-09-09: it publishes S256 as the only code challenge method, and its authorize endpoint rejects a request that omits code_challenge as a missing required field. The server issues its own tokens, supports dynamic client registration, and publishes a revocation endpoint. There is no API key path.

Its two metadata documents disagree. The RFC 9728 protected-resource descriptor for the endpoint publishes one scope, mcp:read. The authorization-server metadata on the same host publishes two, mcp:read and mcp:append. We read both on 2026-09-09. Health Data Avatar documents no scope names at all, so we cannot tell you which set a consent screen offers.

Two ways, both stated by Health Data Avatar. Open the Integrations page in your HDA account and revoke there, which the vendor says immediately invalidates all active tokens. Or disconnect the connector from inside Claude. The server also publishes an OAuth revocation endpoint, which we read on 2026-09-09 but did not exercise, having no token.

Not anywhere we could read. Health Data Avatar's connector page lists three security properties: HTTPS transport, OAuth 2.1 with PKCE, and that HDA does not see your conversations with other chatbots. It names no regulatory framework, no data residency, no retention period and no subprocessor. Its privacy policy and terms pages did not render text to any route we tried.