Privacy Policy
Last updated: November 5, 2026.
1. Introduction
Heta API is a public service for compiling Heta models for education and research. It is intended for models you are permitted to submit to a remote service. This Privacy Policy covers Heta API's REST and MCP interfaces and the Heta API connector and Heta Assistant plugins. The data handling described below applies when those plugins send a request to Heta API. Heta Assistant can also provide guidance or use local tools without sending model files to Heta API.
2. What Data We Collect
We process the following information to provide and maintain the service:
- User Requests: Submitted model files, their file paths, and compilation settings. These may contain model names, equations, parameter values, notes, author details, or other information you choose to include.
- Build Results: Compiler logs and errors, generated export files, model diagrams, file paths, a build identifier, and temporary file, download, and DynMS Viewer links. Generated results may reproduce information from the submitted model.
- Application Logs: The application records request time, IP address visible to Node.js, HTTP method, operation type (REST API or MCP), response status, duration, and the client-supplied user agent. For builds it also records counts of input files and requested exports, the requested retention period, and whether compilation succeeded. An MCP build creates a separate, marked internal REST request. For MCP requests it records the protocol method and tool name and, during initialization, the client's reported application name and version if supplied. This identifies the client application, not the AI model or a person. Internal error logs contain the error type, code, and application stack locations without the raw exception message. The application does not intentionally log submitted file contents, model text, file names, complete request bodies, query strings, or full request URLs.
- Web Server Logs: Apache separately records access and error logs. These may include IP addresses, full request URLs, referrers, user agents, and server errors.
We do not require an account or ask for personal details in model files. Please avoid including personal data in your requests.
3. How Your Data Is Used
Your data is used to:
- Compile the pharmacological models using the Heta-compiler.
- Generate requested output files and, when needed for connected clients, additional model representations or diagrams.
- Provide the requesting client with compilation logs, generated export contents and paths, diagrams where available, and temporary file and download links.
The direct REST and MCP build responses do not include copies of submitted source files or the generated platform.yml as file objects. They do include generated export contents, which may reproduce information from the source files. MCP also sends logs and links as text and may provide SVG model diagrams for its interface. Submitted source files and platform.yml remain accessible through the temporary build links described below.
Technical logs are used only to keep the server available and secure and to diagnose errors. Internal error details are kept in server logs; clients receive a general message for internal failures. Compiler diagnostics are still returned to the requesting client and can include model-derived information. We do not sell submitted model data or technical logs, use them for advertising or commercial purposes, or intentionally share them with unrelated third parties. Build results are returned to the requesting client and made available through temporary links as described below.
Generated results are placed under a unique code (UUID) used in their download links.
4. Data Storage and Retention
- By default, submitted model files, the generated
platform.yml, and export files are stored temporarily and scheduled for deletion 3600 seconds (1 hour) after processing. You can specify a different retention period in your request.
- With a retention period of 0 seconds, files are still written to disk while the request is processed. The application schedules their deletion immediately after sending the response; any returned build links should not be relied on for later download. An interruption of the application may delay deletion.
- Apache access and error logs and application logs are retained for up to 45 days. The model-file retention period does not apply to these logs.
5. Data Security
We use the following measures to protect your data:
- Connections to the public service use HTTPS.
- Each build receives a temporary, hard-to-guess link to its ZIP download and
/files directory. These include submitted source files, the generated platform.yml, and generated exports. The link is not a login or an access check: anyone who receives it can view the directory listing and files without signing in while they remain on the server.
- Logs of unauthorized access attempts are monitored to enhance system security.
6. Your Rights and Options
- Control Data Retention: You can control how long your data is stored by specifying the retention period in your request.
- Immediate Cleanup Request: Set the retention time to 0 seconds to schedule deletion immediately after the response, rather than make files available for later download. An application interruption may delay cleanup.
7. Third-Party Access
When you use the service through an MCP client, such as ChatGPT, Codex, or another MCP-compatible application, your submitted model and the returned logs, generated export contents, file paths, diagrams, and download links pass through that client. The client's handling of this information is governed by its own privacy policy. Anyone with a valid build link can access the submitted source files, platform.yml, and exports while they remain on the server.
MCP may also provide an optional link to the DynMS Viewer at shiny.insysbio.com for test simulations. Opening it sends the build identifier and generated DynMS file path to that service, which can access the model through its temporary file link while the files remain available. The Viewer is opened only when you choose to follow the link; compilation itself does not run a simulation.
8. Limitations
- Avoid including sensitive or confidential information in your requests. HTTPS protects data in transit, but the application does not separately encrypt temporary model files stored on the server.
- Treat a temporary build link as private: it grants access to the submitted files and results without authentication while they remain on the server.
9. Changes to the Policy
We may update this Privacy Policy from time to time. Any changes will be reflected on this page, and we recommend reviewing it periodically.
10. Contact Us
If you have questions or concerns about this Privacy Policy, you can contact us at: