Privacy Notice

Last updated: October 11, 2026

This notice describes how the current Hermes MyChart connector handles information and what to consider when using it with Hermes. The connector is provided by Promethean Dynamic. For privacy questions, contact chrism@promethean-dynamic.com.

The connector runs locally, but the full workflow is not necessarily local. Medical information returned to Hermes may be sent to the AI or model provider configured in Hermes, and conversations or tool outputs may be retained.

Hermes MyChart is pre-release. Live healthcare-provider access has not yet been validated. Record availability and authorization depend on your provider.

Information the connector handles

Depending on the provider, granted permissions, and requests you make, the connector can handle:

• Health records and documents returned by your provider, including identifying information contained in those records.
• Provider connection details and OAuth authorization tokens used to access permitted records.
• Search requests, retrieved results, and temporary working data used to answer requests.
• Exported copies that you ask it to create.

The connector is read-only with respect to your provider’s records. It does not modify the source medical record.

Signing in and authorizing access

Provider sign-in and authorization use the provider’s SMART OAuth flow. Review the provider’s permission screen before granting access. Authorization tokens allow the connector to make permitted requests; they are sensitive credentials and should not be shared.

Local storage

The current version stores OAuth tokens in a local plaintext file. Plaintext means the connector does not itself encrypt that token file. People or software with sufficient access to your computer, backups, or synchronized folders may be able to read it.

Pending authorization transactions and provider-selection details are also stored locally. Public provider-directory metadata can be saved to a local cache. The current connector does not implement analytics telemetry or a persistent clinical-content log. Status messages, errors and an authorization URL may appear in terminal output, which your terminal or Hermes may retain.

Retrieved records and the connector’s working cache are held in memory during operation. That does not guarantee that every copy disappears when the process ends: operating-system behavior, other applications, Hermes history, and exports can create or retain separate copies.

Exports you request are separate files and remain subject to the storage, backup, synchronization, and sharing settings you choose. Protect them as you would other medical records.

Hermes and AI or model providers

When Hermes calls the connector, the resulting medical information can become part of the context Hermes uses to answer you. Depending on your Hermes configuration, that information may be transmitted to your configured AI or model provider.

Hermes may retain conversations and tool outputs. Retention, training use, access controls, and deletion options for Hermes and model providers depend on their settings and policies. This connector does not guarantee zero retention, local-only processing, or exclusion from model training. Review those services before connecting health records.

Other recipients and copies

Your healthcare provider receives the authorization and record-access requests needed for its connection. If you share an export or place it in a synchronized folder, the recipient or storage service may receive that copy under its own practices.

If you email us, the contents of your message and your contact information are shared with Promethean Dynamic and the services used to handle that correspondence. Please do not send medical records, patient identifiers, access tokens, passwords, or unredacted logs by email.

Disconnecting and deleting information

To stop using the connection, remove the connector’s locally saved authorization and stop its process. To withdraw provider-side access, also review your provider’s connected-app settings or contact the provider about revocation. Local removal alone should not be treated as confirmation that the provider has revoked its grant. Disconnecting removes local token and pending authorization files, but leaves provider-selection details and does not erase records already held in a running process.

To remove other copies, separately review:

• Exported files, downloaded documents, trash, backups, and synchronized storage.
• Hermes conversation history and retained tool outputs.
• Your AI or model provider’s retention and deletion controls.

Disconnecting does not delete your provider’s original records. Promethean Dynamic cannot delete copies controlled by your provider or other services on your behalf merely by removing a local connection.

Website and correspondence

These product-information pages do not connect to a healthcare provider or receive your medical records. They contain no account forms, analytics integrations, advertising trackers, or page-specific cookies. Fonts and the project image are served from this website.

The website is hosted through TrustEdge.gt. Hosting and network infrastructure process connection information to deliver pages, including IP addresses, requested URLs and technical request information. Infrastructure may retain operational and error logs. This notice does not promise a fixed deletion period for infrastructure-managed logs or backups. Do not put medical information or credentials into website URLs.

Product support is not provided. You may contact Promethean Dynamic about privacy or security. Email is processed by the mail services used to deliver and handle that correspondence. Legitimate correspondence is deleted from our mail system after a reply. This is not a guarantee of immediate deletion from recipients’ systems, delivery logs or backups. Do not email medical records, patient identifiers, passwords, authorization codes, access tokens or unredacted logs.

Questions and requests

For questions about this notice or information you have sent directly by email, email chrism@promethean-dynamic.com. Describe the request without including health records or credentials. For source-record access or corrections, contact your healthcare provider. For data held by Hermes, a model provider, or an export recipient, use that service’s controls or contact it directly.

Updates to this notice will appear here with a revised date.